Deltree \clients\client1
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients
NTCreateX \clients 0x1 0x3 12114
Close 12114
NTCreateX \clients\client1 0x1 0x2 12115
Close 12115
NTCreateX \clients\client1\mixfile 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\FILLER"*
NTCreateX \clients\client1\~dmtmp 0x1 0x2 12119
Close 12119
NTCreateX \clients\client1\filler.000 0x40 0x2 12120
QUERY_FS_INFORMATION 1
WriteX 12120 65534 1 1
QUERY_FILE_INFORMATION 12120
WriteX 12120 0 65471 65471
WriteX 12120 65471 64 64
WriteX 12120 65535 65471 65471
WriteX 12120 131006 64 64
WriteX 12120 131070 65471 65471
WriteX 12120 196541 64 64
WriteX 12120 196605 65471 65471
WriteX 12120 262076 64 64
WriteX 12120 262140 65471 65471
WriteX 12120 327611 64 64
WriteX 12120 327675 65471 65471
WriteX 12120 393146 64 64
WriteX 12120 393210 65471 65471
WriteX 12120 458681 64 64
WriteX 12120 458745 65471 65471
WriteX 12120 524216 64 64
WriteX 12120 524280 65471 65471
WriteX 12120 589751 64 64
WriteX 12120 589815 65471 65471
WriteX 12120 655286 64 64
WriteX 12120 655350 65471 65471
WriteX 12120 720821 64 64
WriteX 12120 720885 65471 65471
WriteX 12120 786356 64 64
WriteX 12120 786420 65471 65471
WriteX 12120 851891 64 64
WriteX 12120 851955 65471 65471
WriteX 12120 917426 64 64
WriteX 12120 917490 65471 65471
WriteX 12120 982961 64 64
WriteX 12120 983025 65471 65471
WriteX 12120 1048496 64 64
WriteX 12120 1048560 16 16
Close 12120
NTCreateX \clients\client1\filler.001 0x40 0x2 12121
WriteX 12121 65534 1 1
QUERY_FILE_INFORMATION 12121
WriteX 12121 0 65471 65471
WriteX 12121 65471 64 64
WriteX 12121 65535 65471 65471
WriteX 12121 131006 64 64
WriteX 12121 131070 65471 65471
WriteX 12121 196541 64 64
WriteX 12121 196605 65471 65471
WriteX 12121 262076 64 64
WriteX 12121 262140 65471 65471
WriteX 12121 327611 64 64
WriteX 12121 327675 65471 65471
WriteX 12121 393146 64 64
WriteX 12121 393210 65471 65471
WriteX 12121 458681 64 64
WriteX 12121 458745 65471 65471
WriteX 12121 524216 64 64
WriteX 12121 524280 65471 65471
WriteX 12121 589751 64 64
WriteX 12121 589815 65471 65471
WriteX 12121 655286 64 64
WriteX 12121 655350 65471 65471
WriteX 12121 720821 64 64
WriteX 12121 720885 65471 65471
WriteX 12121 786356 64 64
WriteX 12121 786420 65471 65471
WriteX 12121 851891 64 64
WriteX 12121 851955 65471 65471
WriteX 12121 917426 64 64
WriteX 12121 917490 65471 65471
WriteX 12121 982961 64 64
WriteX 12121 983025 65471 65471
WriteX 12121 1048496 64 64
WriteX 12121 1048560 16 16
Close 12121
NTCreateX \clients\client1\filler.002 0x40 0x2 12122
WriteX 12122 65534 1 1
QUERY_FILE_INFORMATION 12122
WriteX 12122 0 65471 65471
WriteX 12122 65471 64 64
WriteX 12122 65535 65471 65471
WriteX 12122 131006 64 64
WriteX 12122 131070 65471 65471
WriteX 12122 196541 64 64
WriteX 12122 196605 65471 65471
WriteX 12122 262076 64 64
WriteX 12122 262140 65471 65471
WriteX 12122 327611 64 64
WriteX 12122 327675 65471 65471
WriteX 12122 393146 64 64
WriteX 12122 393210 65471 65471
WriteX 12122 458681 64 64
WriteX 12122 458745 65471 65471
WriteX 12122 524216 64 64
WriteX 12122 524280 65471 65471
WriteX 12122 589751 64 64
WriteX 12122 589815 65471 65471
WriteX 12122 655286 64 64
WriteX 12122 655350 65471 65471
WriteX 12122 720821 64 64
WriteX 12122 720885 65471 65471
WriteX 12122 786356 64 64
WriteX 12122 786420 65471 65471
WriteX 12122 851891 64 64
WriteX 12122 851955 65471 65471
WriteX 12122 917426 64 64
WriteX 12122 917490 65471 65471
WriteX 12122 982961 64 64
WriteX 12122 983025 65471 65471
WriteX 12122 1048496 64 64
WriteX 12122 1048560 16 16
Close 12122
NTCreateX \clients\client1\filler.003 0x40 0x2 12123
WriteX 12123 65534 1 1
QUERY_FILE_INFORMATION 12123
WriteX 12123 0 65471 65471
WriteX 12123 65471 64 64
WriteX 12123 65535 65471 65471
WriteX 12123 131006 64 64
WriteX 12123 131070 65471 65471
WriteX 12123 196541 64 64
WriteX 12123 196605 65471 65471
WriteX 12123 262076 64 64
WriteX 12123 262140 65471 65471
WriteX 12123 327611 64 64
WriteX 12123 327675 65471 65471
WriteX 12123 393146 64 64
WriteX 12123 393210 65471 65471
WriteX 12123 458681 64 64
WriteX 12123 458745 65471 65471
WriteX 12123 524216 64 64
WriteX 12123 524280 65471 65471
WriteX 12123 589751 64 64
WriteX 12123 589815 65471 65471
WriteX 12123 655286 64 64
WriteX 12123 655350 65471 65471
WriteX 12123 720821 64 64
WriteX 12123 720885 65471 65471
WriteX 12123 786356 64 64
WriteX 12123 786420 65471 65471
WriteX 12123 851891 64 64
WriteX 12123 851955 65471 65471
WriteX 12123 917426 64 64
WriteX 12123 917490 65471 65471
WriteX 12123 982961 64 64
WriteX 12123 983025 65471 65471
WriteX 12123 1048496 64 64
WriteX 12123 1048560 16 16
Close 12123
NTCreateX \clients\client1\filler.004 0x40 0x2 12124
WriteX 12124 65534 1 1
QUERY_FILE_INFORMATION 12124
WriteX 12124 0 65471 65471
WriteX 12124 65471 64 64
WriteX 12124 65535 65471 65471
WriteX 12124 131006 64 64
WriteX 12124 131070 65471 65471
WriteX 12124 196541 64 64
WriteX 12124 196605 65471 65471
WriteX 12124 262076 64 64
WriteX 12124 262140 65471 65471
WriteX 12124 327611 64 64
WriteX 12124 327675 65471 65471
WriteX 12124 393146 64 64
WriteX 12124 393210 65471 65471
WriteX 12124 458681 64 64
WriteX 12124 458745 65471 65471
WriteX 12124 524216 64 64
WriteX 12124 524280 65471 65471
WriteX 12124 589751 64 64
WriteX 12124 589815 65471 65471
WriteX 12124 655286 64 64
WriteX 12124 655350 65471 65471
WriteX 12124 720821 64 64
WriteX 12124 720885 65471 65471
WriteX 12124 786356 64 64
WriteX 12124 786420 65471 65471
WriteX 12124 851891 64 64
WriteX 12124 851955 65471 65471
WriteX 12124 917426 64 64
WriteX 12124 917490 65471 65471
WriteX 12124 982961 64 64
WriteX 12124 983025 65471 65471
WriteX 12124 1048496 64 64
WriteX 12124 1048560 16 16
Close 12124
NTCreateX \clients\client1\~dmtmp\WORD 0x1 0x2 12125
Close 12125
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x2 12126
WriteX 12126 65534 1 1
QUERY_FILE_INFORMATION 12126
WriteX 12126 0 65471 65471
WriteX 12126 65471 64 64
WriteX 12126 65535 65471 65471
WriteX 12126 131006 64 64
WriteX 12126 131070 65471 65471
WriteX 12126 196541 64 64
WriteX 12126 196605 63491 63491
Close 12126
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x2 12127
WriteX 12127 65534 1 1
QUERY_FILE_INFORMATION 12127
WriteX 12127 0 65471 65471
WriteX 12127 65471 64 64
WriteX 12127 65535 65471 65471
WriteX 12127 131006 64 64
WriteX 12127 131070 65471 65471
WriteX 12127 196541 64 64
WriteX 12127 196605 63491 63491
Close 12127
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x2 12128
WriteX 12128 65534 1 1
QUERY_FILE_INFORMATION 12128
WriteX 12128 0 65471 65471
WriteX 12128 65471 64 64
WriteX 12128 65535 65471 65471
WriteX 12128 131006 64 64
WriteX 12128 131070 65471 65471
WriteX 12128 196541 64 64
WriteX 12128 196605 63491 63491
Close 12128
NTCreateX \clients\client1\~dmtmp\EXCEL 0x1 0x2 12129
Close 12129
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x2 12130
WriteX 12130 65534 1 1
QUERY_FILE_INFORMATION 12130
WriteX 12130 0 65471 65471
WriteX 12130 65471 64 64
WriteX 12130 65535 65471 65471
WriteX 12130 131006 64 64
WriteX 12130 131070 65471 65471
WriteX 12130 196541 64 64
WriteX 12130 196605 63491 63491
Close 12130
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x2 12131
WriteX 12131 65534 1 1
QUERY_FILE_INFORMATION 12131
WriteX 12131 0 65471 65471
WriteX 12131 65471 64 64
WriteX 12131 65535 65471 65471
WriteX 12131 131006 64 64
WriteX 12131 131070 65471 65471
WriteX 12131 196541 64 64
WriteX 12131 196605 63491 63491
Close 12131
NTCreateX \clients\client1\~dmtmp\PWRPNT 0x1 0x2 12132
Close 12132
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x2 12133
WriteX 12133 65534 1 1
QUERY_FILE_INFORMATION 12133
WriteX 12133 0 65471 65471
WriteX 12133 65471 64 64
WriteX 12133 65535 65471 65471
WriteX 12133 131006 64 64
WriteX 12133 131070 65471 65471
WriteX 12133 196541 64 64
WriteX 12133 196605 63491 63491
Close 12133
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x2 12134
WriteX 12134 65534 1 1
QUERY_FILE_INFORMATION 12134
WriteX 12134 0 65471 65471
WriteX 12134 65471 64 64
WriteX 12134 65535 65471 65471
WriteX 12134 131006 64 64
WriteX 12134 131070 65471 65471
WriteX 12134 196541 64 64
WriteX 12134 196605 63491 63491
Close 12134
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x2 12135
WriteX 12135 65534 1 1
QUERY_FILE_INFORMATION 12135
WriteX 12135 0 65471 65471
WriteX 12135 65471 64 64
WriteX 12135 65535 65471 65471
WriteX 12135 131006 64 64
WriteX 12135 131070 65471 65471
WriteX 12135 196541 64 64
WriteX 12135 196605 63491 63491
Close 12135
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x2 12136
WriteX 12136 65534 1 1
QUERY_FILE_INFORMATION 12136
WriteX 12136 0 65471 65471
WriteX 12136 65471 64 64
WriteX 12136 65535 65471 65471
WriteX 12136 131006 64 64
WriteX 12136 131070 65471 65471
WriteX 12136 196541 64 64
WriteX 12136 196605 63491 63491
Close 12136
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x2 12137
WriteX 12137 65534 1 1
QUERY_FILE_INFORMATION 12137
WriteX 12137 0 65471 65471
WriteX 12137 65471 64 64
WriteX 12137 65535 65471 65471
WriteX 12137 131006 64 64
WriteX 12137 131070 65471 65471
WriteX 12137 196541 64 64
WriteX 12137 196605 63491 63491
Close 12137
NTCreateX \clients\client1\~dmtmp\COREL 0x1 0x2 12138
Close 12138
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x2 12139
WriteX 12139 65534 1 1
QUERY_FILE_INFORMATION 12139
WriteX 12139 0 65471 65471
WriteX 12139 65471 64 64
WriteX 12139 65535 65471 65471
WriteX 12139 131006 64 64
WriteX 12139 131070 65471 65471
WriteX 12139 196541 64 64
WriteX 12139 196605 63491 63491
Close 12139
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x2 12140
WriteX 12140 65534 1 1
QUERY_FILE_INFORMATION 12140
WriteX 12140 0 65471 65471
WriteX 12140 65471 64 64
WriteX 12140 65535 65471 65471
WriteX 12140 131006 64 64
WriteX 12140 131070 65471 65471
WriteX 12140 196541 64 64
WriteX 12140 196605 63491 63491
Close 12140
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x2 12141
WriteX 12141 65534 1 1
QUERY_FILE_INFORMATION 12141
WriteX 12141 0 65471 65471
WriteX 12141 65471 64 64
WriteX 12141 65535 65471 65471
WriteX 12141 131006 64 64
WriteX 12141 131070 65471 65471
WriteX 12141 196541 64 64
WriteX 12141 196605 63491 63491
Close 12141
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x2 12142
WriteX 12142 65534 1 1
QUERY_FILE_INFORMATION 12142
WriteX 12142 0 65471 65471
WriteX 12142 65471 64 64
WriteX 12142 65535 65471 65471
WriteX 12142 131006 64 64
WriteX 12142 131070 65471 65471
WriteX 12142 196541 64 64
WriteX 12142 196605 63491 63491
Close 12142
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x2 12143
WriteX 12143 65534 1 1
QUERY_FILE_INFORMATION 12143
WriteX 12143 0 65471 65471
WriteX 12143 65471 64 64
WriteX 12143 65535 65471 65471
WriteX 12143 131006 64 64
WriteX 12143 131070 65471 65471
WriteX 12143 196541 64 64
WriteX 12143 196605 63491 63491
Close 12143
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x2 12144
WriteX 12144 65534 1 1
QUERY_FILE_INFORMATION 12144
WriteX 12144 0 65471 65471
WriteX 12144 65471 64 64
WriteX 12144 65535 65471 65471
WriteX 12144 131006 64 64
WriteX 12144 131070 65471 65471
WriteX 12144 196541 64 64
WriteX 12144 196605 63491 63491
Close 12144
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x2 12145
WriteX 12145 65534 1 1
QUERY_FILE_INFORMATION 12145
WriteX 12145 0 65471 65471
WriteX 12145 65471 64 64
WriteX 12145 65535 65471 65471
WriteX 12145 131006 64 64
WriteX 12145 131070 65471 65471
WriteX 12145 196541 64 64
WriteX 12145 196605 63491 63491
Close 12145
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x2 12146
WriteX 12146 65534 1 1
QUERY_FILE_INFORMATION 12146
WriteX 12146 0 65471 65471
WriteX 12146 65471 64 64
WriteX 12146 65535 65471 65471
WriteX 12146 131006 64 64
WriteX 12146 131070 65471 65471
WriteX 12146 196541 64 64
WriteX 12146 196605 63491 63491
Close 12146
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x2 12147
WriteX 12147 65534 1 1
QUERY_FILE_INFORMATION 12147
WriteX 12147 0 65471 65471
WriteX 12147 65471 64 64
WriteX 12147 65535 65471 65471
WriteX 12147 131006 64 64
WriteX 12147 131070 65471 65471
WriteX 12147 196541 64 64
WriteX 12147 196605 63491 63491
Close 12147
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x2 12148
WriteX 12148 65534 1 1
QUERY_FILE_INFORMATION 12148
WriteX 12148 0 65471 65471
WriteX 12148 65471 64 64
WriteX 12148 65535 65471 65471
WriteX 12148 131006 64 64
WriteX 12148 131070 65471 65471
WriteX 12148 196541 64 64
WriteX 12148 196605 63491 63491
Close 12148
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x2 12149
WriteX 12149 65534 1 1
QUERY_FILE_INFORMATION 12149
WriteX 12149 0 65471 65471
WriteX 12149 65471 64 64
WriteX 12149 65535 65471 65471
WriteX 12149 131006 64 64
WriteX 12149 131070 65471 65471
WriteX 12149 196541 64 64
WriteX 12149 196605 63491 63491
Close 12149
NTCreateX \clients\client1\~dmtmp\WORDPRO 0x1 0x2 12150
Close 12150
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x2 12151
WriteX 12151 65534 1 1
QUERY_FILE_INFORMATION 12151
WriteX 12151 0 65471 65471
WriteX 12151 65471 64 64
WriteX 12151 65535 65471 65471
WriteX 12151 131006 64 64
WriteX 12151 131070 65471 65471
WriteX 12151 196541 64 64
WriteX 12151 196605 63491 63491
Close 12151
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x2 12152
WriteX 12152 65534 1 1
QUERY_FILE_INFORMATION 12152
WriteX 12152 0 65471 65471
WriteX 12152 65471 64 64
WriteX 12152 65535 65471 65471
WriteX 12152 131006 64 64
WriteX 12152 131070 65471 65471
WriteX 12152 196541 64 64
WriteX 12152 196605 63491 63491
Close 12152
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x2 12153
WriteX 12153 65534 1 1
QUERY_FILE_INFORMATION 12153
WriteX 12153 0 65471 65471
WriteX 12153 65471 64 64
WriteX 12153 65535 65471 65471
WriteX 12153 131006 64 64
WriteX 12153 131070 65471 65471
WriteX 12153 196541 64 64
WriteX 12153 196605 63491 63491
Close 12153
NTCreateX \clients\client1\~dmtmp\PM 0x1 0x2 12154
Close 12154
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x2 12155
WriteX 12155 65534 1 1
QUERY_FILE_INFORMATION 12155
WriteX 12155 0 65471 65471
WriteX 12155 65471 64 64
WriteX 12155 65535 65471 65471
WriteX 12155 131006 64 64
WriteX 12155 131070 65471 65471
WriteX 12155 196541 64 64
WriteX 12155 196605 63491 63491
Close 12155
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x2 12156
WriteX 12156 65534 1 1
QUERY_FILE_INFORMATION 12156
WriteX 12156 0 65471 65471
WriteX 12156 65471 64 64
WriteX 12156 65535 65471 65471
WriteX 12156 131006 64 64
WriteX 12156 131070 65471 65471
WriteX 12156 196541 64 64
WriteX 12156 196605 63491 63491
Close 12156
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x2 12157
WriteX 12157 65534 1 1
QUERY_FILE_INFORMATION 12157
WriteX 12157 0 65471 65471
WriteX 12157 65471 64 64
WriteX 12157 65535 65471 65471
WriteX 12157 131006 64 64
WriteX 12157 131070 65471 65471
WriteX 12157 196541 64 64
WriteX 12157 196605 63491 63491
Close 12157
NTCreateX \clients\client1\~dmtmp\PARADOX 0x1 0x2 12158
Close 12158
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x2 12159
WriteX 12159 65534 1 1
QUERY_FILE_INFORMATION 12159
WriteX 12159 0 65471 65471
WriteX 12159 65471 64 64
WriteX 12159 65535 65471 65471
WriteX 12159 131006 64 64
WriteX 12159 131070 65471 65471
WriteX 12159 196541 64 64
WriteX 12159 196605 63491 63491
Close 12159
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x2 12160
WriteX 12160 65534 1 1
QUERY_FILE_INFORMATION 12160
WriteX 12160 0 65471 65471
WriteX 12160 65471 64 64
WriteX 12160 65535 65471 65471
WriteX 12160 131006 64 64
WriteX 12160 131070 65471 65471
WriteX 12160 196541 64 64
WriteX 12160 196605 63491 63491
Close 12160
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x2 12161
WriteX 12161 65534 1 1
QUERY_FILE_INFORMATION 12161
WriteX 12161 0 65471 65471
WriteX 12161 65471 64 64
WriteX 12161 65535 65471 65471
WriteX 12161 131006 64 64
WriteX 12161 131070 65471 65471
WriteX 12161 196541 64 64
WriteX 12161 196605 63491 63491
Close 12161
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x2 12162
WriteX 12162 65534 1 1
QUERY_FILE_INFORMATION 12162
WriteX 12162 0 65471 65471
WriteX 12162 65471 64 64
WriteX 12162 65535 65471 65471
WriteX 12162 131006 64 64
WriteX 12162 131070 65471 65471
WriteX 12162 196541 64 64
WriteX 12162 196605 63491 63491
Close 12162
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x2 12163
WriteX 12163 65534 1 1
QUERY_FILE_INFORMATION 12163
WriteX 12163 0 65471 65471
WriteX 12163 65471 64 64
WriteX 12163 65535 65471 65471
WriteX 12163 131006 64 64
WriteX 12163 131070 65471 65471
WriteX 12163 196541 64 64
WriteX 12163 196605 63491 63491
Close 12163
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x2 12164
WriteX 12164 65534 1 1
QUERY_FILE_INFORMATION 12164
WriteX 12164 0 65471 65471
WriteX 12164 65471 64 64
WriteX 12164 65535 65471 65471
WriteX 12164 131006 64 64
WriteX 12164 131070 65471 65471
WriteX 12164 196541 64 64
WriteX 12164 196605 63491 63491
Close 12164
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x2 12165
WriteX 12165 65534 1 1
QUERY_FILE_INFORMATION 12165
WriteX 12165 0 65471 65471
WriteX 12165 65471 64 64
WriteX 12165 65535 65471 65471
WriteX 12165 131006 64 64
WriteX 12165 131070 65471 65471
WriteX 12165 196541 64 64
WriteX 12165 196605 63491 63491
Close 12165
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x2 12166
WriteX 12166 65534 1 1
QUERY_FILE_INFORMATION 12166
WriteX 12166 0 65471 65471
WriteX 12166 65471 64 64
WriteX 12166 65535 65471 65471
WriteX 12166 131006 64 64
WriteX 12166 131070 65471 65471
WriteX 12166 196541 64 64
WriteX 12166 196605 63491 63491
Close 12166
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x2 12167
WriteX 12167 65534 1 1
QUERY_FILE_INFORMATION 12167
WriteX 12167 0 65471 65471
WriteX 12167 65471 64 64
WriteX 12167 65535 65471 65471
WriteX 12167 131006 64 64
WriteX 12167 131070 65471 65471
WriteX 12167 196541 64 64
WriteX 12167 196605 63491 63491
Close 12167
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x2 12168
WriteX 12168 65534 1 1
QUERY_FILE_INFORMATION 12168
WriteX 12168 0 65471 65471
WriteX 12168 65471 64 64
WriteX 12168 65535 65471 65471
WriteX 12168 131006 64 64
WriteX 12168 131070 65471 65471
WriteX 12168 196541 64 64
WriteX 12168 196605 63491 63491
Close 12168
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x2 12169
WriteX 12169 65534 1 1
QUERY_FILE_INFORMATION 12169
WriteX 12169 0 65471 65471
WriteX 12169 65471 64 64
WriteX 12169 65535 65471 65471
WriteX 12169 131006 64 64
WriteX 12169 131070 65471 65471
WriteX 12169 196541 64 64
WriteX 12169 196605 63491 63491
Close 12169
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x2 12170
WriteX 12170 65534 1 1
QUERY_FILE_INFORMATION 12170
WriteX 12170 0 65471 65471
WriteX 12170 65471 64 64
WriteX 12170 65535 65471 65471
WriteX 12170 131006 64 64
WriteX 12170 131070 65471 65471
WriteX 12170 196541 64 64
WriteX 12170 196605 63491 63491
Close 12170
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x2 12171
WriteX 12171 65534 1 1
QUERY_FILE_INFORMATION 12171
WriteX 12171 0 65471 65471
WriteX 12171 65471 64 64
WriteX 12171 65535 65471 65471
WriteX 12171 131006 64 64
WriteX 12171 131070 65471 65471
WriteX 12171 196541 64 64
WriteX 12171 196605 63491 63491
Close 12171
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x2 12172
WriteX 12172 65534 1 1
QUERY_FILE_INFORMATION 12172
WriteX 12172 0 65471 65471
WriteX 12172 65471 64 64
WriteX 12172 65535 65471 65471
WriteX 12172 131006 64 64
WriteX 12172 131070 65471 65471
WriteX 12172 196541 64 64
WriteX 12172 196605 63491 63491
Close 12172
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x2 12173
WriteX 12173 65534 1 1
QUERY_FILE_INFORMATION 12173
WriteX 12173 0 65471 65471
WriteX 12173 65471 64 64
WriteX 12173 65535 65471 65471
WriteX 12173 131006 64 64
WriteX 12173 131070 65471 65471
WriteX 12173 196541 64 64
WriteX 12173 196605 63491 63491
Close 12173
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x2 12174
WriteX 12174 65534 1 1
QUERY_FILE_INFORMATION 12174
WriteX 12174 0 65471 65471
WriteX 12174 65471 64 64
WriteX 12174 65535 65471 65471
WriteX 12174 131006 64 64
WriteX 12174 131070 65471 65471
WriteX 12174 196541 64 64
WriteX 12174 196605 63491 63491
Close 12174
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x2 12175
WriteX 12175 65534 1 1
QUERY_FILE_INFORMATION 12175
WriteX 12175 0 65471 65471
WriteX 12175 65471 64 64
WriteX 12175 65535 65471 65471
WriteX 12175 131006 64 64
WriteX 12175 131070 65471 65471
WriteX 12175 196541 64 64
WriteX 12175 196605 63491 63491
Close 12175
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x2 12176
WriteX 12176 65534 1 1
QUERY_FILE_INFORMATION 12176
WriteX 12176 0 65471 65471
WriteX 12176 65471 64 64
WriteX 12176 65535 65471 65471
WriteX 12176 131006 64 64
WriteX 12176 131070 65471 65471
WriteX 12176 196541 64 64
WriteX 12176 196605 63491 63491
Close 12176
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x2 12177
WriteX 12177 65534 1 1
QUERY_FILE_INFORMATION 12177
WriteX 12177 0 65471 65471
WriteX 12177 65471 64 64
WriteX 12177 65535 65471 65471
WriteX 12177 131006 64 64
WriteX 12177 131070 65471 65471
WriteX 12177 196541 64 64
WriteX 12177 196605 63491 63491
Close 12177
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x2 12178
WriteX 12178 65534 1 1
QUERY_FILE_INFORMATION 12178
WriteX 12178 0 65471 65471
WriteX 12178 65471 64 64
WriteX 12178 65535 65471 65471
WriteX 12178 131006 64 64
WriteX 12178 131070 65471 65471
WriteX 12178 196541 64 64
WriteX 12178 196605 63491 63491
Close 12178
NTCreateX \clients\client1\~dmtmp\ACCESS 0x1 0x2 12179
Close 12179
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x2 12180
WriteX 12180 65534 1 1
QUERY_FILE_INFORMATION 12180
WriteX 12180 0 65471 65471
WriteX 12180 65471 64 64
WriteX 12180 65535 65471 65471
WriteX 12180 131006 64 64
WriteX 12180 131070 65471 65471
WriteX 12180 196541 64 64
WriteX 12180 196605 63491 63491
Close 12180
NTCreateX \clients\client1\~dmtmp\SEED 0x1 0x2 12181
Close 12181
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x2 12182
WriteX 12182 65534 1 1
QUERY_FILE_INFORMATION 12182
WriteX 12182 0 65471 65471
WriteX 12182 65471 64 64
WriteX 12182 65535 65471 65471
WriteX 12182 131006 64 64
WriteX 12182 131070 65471 65471
WriteX 12182 196541 64 64
WriteX 12182 196605 65471 65471
WriteX 12182 262076 64 64
WriteX 12182 262140 65471 65471
WriteX 12182 327611 64 64
WriteX 12182 327675 5 5
Close 12182
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x2 12183
WriteX 12183 65534 1 1
QUERY_FILE_INFORMATION 12183
WriteX 12183 0 65471 65471
WriteX 12183 65471 64 64
WriteX 12183 65535 65471 65471
WriteX 12183 131006 64 64
WriteX 12183 131070 65471 65471
WriteX 12183 196541 64 64
WriteX 12183 196605 65471 65471
WriteX 12183 262076 64 64
WriteX 12183 262140 65471 65471
WriteX 12183 327611 64 64
WriteX 12183 327675 65471 65471
WriteX 12183 393146 64 64
WriteX 12183 393210 65471 65471
WriteX 12183 458681 64 64
WriteX 12183 458745 65471 65471
WriteX 12183 524216 64 64
WriteX 12183 524280 65471 65471
WriteX 12183 589751 64 64
WriteX 12183 589815 65471 65471
WriteX 12183 655286 64 64
WriteX 12183 655350 65471 65471
WriteX 12183 720821 64 64
WriteX 12183 720885 65471 65471
WriteX 12183 786356 64 64
WriteX 12183 786420 65471 65471
WriteX 12183 851891 64 64
WriteX 12183 851955 65471 65471
WriteX 12183 917426 64 64
WriteX 12183 917490 65471 65471
WriteX 12183 982961 64 64
WriteX 12183 983025 65471 65471
WriteX 12183 1048496 64 64
WriteX 12183 1048560 16 16
Close 12183
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x2 12184
WriteX 12184 65534 1 1
QUERY_FILE_INFORMATION 12184
WriteX 12184 0 65471 65471
WriteX 12184 65471 64 64
WriteX 12184 65535 65471 65471
WriteX 12184 131006 64 64
WriteX 12184 131070 65471 65471
WriteX 12184 196541 64 64
WriteX 12184 196605 65471 65471
WriteX 12184 262076 64 64
WriteX 12184 262140 65471 65471
WriteX 12184 327611 64 64
WriteX 12184 327675 65471 65471
WriteX 12184 393146 64 64
WriteX 12184 393210 65471 65471
WriteX 12184 458681 64 64
WriteX 12184 458745 65471 65471
WriteX 12184 524216 64 64
WriteX 12184 524280 65471 65471
WriteX 12184 589751 64 64
WriteX 12184 589815 65471 65471
WriteX 12184 655286 64 64
WriteX 12184 655350 65471 65471
WriteX 12184 720821 64 64
WriteX 12184 720885 65471 65471
WriteX 12184 786356 64 64
WriteX 12184 786420 65471 65471
WriteX 12184 851891 64 64
WriteX 12184 851955 65471 65471
WriteX 12184 917426 64 64
WriteX 12184 917490 65471 65471
WriteX 12184 982961 64 64
WriteX 12184 983025 65471 65471
WriteX 12184 1048496 64 64
WriteX 12184 1114094 1 1
QUERY_FILE_INFORMATION 12184
WriteX 12184 1048560 65471 65471
WriteX 12184 1114031 64 64
WriteX 12184 1114095 65471 65471
WriteX 12184 1179566 64 64
WriteX 12184 1179630 65471 65471
WriteX 12184 1245101 64 64
WriteX 12184 1245165 65471 65471
WriteX 12184 1310636 64 64
WriteX 12184 1310700 65471 65471
WriteX 12184 1376171 64 64
WriteX 12184 1376235 65471 65471
WriteX 12184 1441706 64 64
WriteX 12184 1441770 65471 65471
WriteX 12184 1507241 64 64
WriteX 12184 1507305 65471 65471
WriteX 12184 1572776 64 64
WriteX 12184 1572840 65471 65471
WriteX 12184 1638311 64 64
WriteX 12184 1638375 65471 65471
WriteX 12184 1703846 64 64
WriteX 12184 1703910 65471 65471
WriteX 12184 1769381 64 64
WriteX 12184 1769445 65471 65471
WriteX 12184 1834916 64 64
WriteX 12184 1834980 32796 32796
Close 12184
QUERY_PATH_INFORMATION \clients\client1
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12185
Close 12185
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12186
QUERY_FILE_INFORMATION 12186
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 12186
QUERY_FILE_INFORMATION 12186
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12187
QUERY_FILE_INFORMATION 12187
QUERY_FILE_INFORMATION 12187
QUERY_FILE_INFORMATION 12187
ReadX 12187 2156 24 24
ReadX 12187 2139 276 276
ReadX 12187 2136 14 14
ReadX 12187 2136 7 7
ReadX 12187 2138 12 12
ReadX 12187 2137 8 8
ReadX 12187 2135 15 15
ReadX 12187 0 16 16
ReadX 12187 16 2048 2048
ReadX 12187 2064 2048 2048
ReadX 12187 257 2048 2048
ReadX 12187 385 2048 2048
ReadX 12187 513 2048 2048
ReadX 12187 641 2048 2048
ReadX 12187 769 2048 2048
ReadX 12187 897 2048 2048
ReadX 12187 1025 2048 2048
ReadX 12187 1153 2048 2048
ReadX 12187 1281 2048 2048
ReadX 12187 1409 2048 2048
ReadX 12187 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12189
Close 12189
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12191
WriteX 12191 15 1 1
QUERY_FILE_INFORMATION 12191
WriteX 12191 0 10575 10575
Flush 12191
Close 12191
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12192
Close 12192
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12193
QUERY_FILE_INFORMATION 12193
QUERY_FILE_INFORMATION 12193
QUERY_FILE_INFORMATION 12193
ReadX 12193 2157 24 24
ReadX 12193 2139 276 276
ReadX 12193 2137 14 14
ReadX 12193 2137 7 7
ReadX 12193 2139 12 12
ReadX 12193 2138 8 8
ReadX 12193 2136 15 15
Close 12187
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12194
Close 12194
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12195
QUERY_FILE_INFORMATION 12195
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12196
QUERY_FILE_INFORMATION 12196
ReadX 12196 0 512 512
ReadX 12196 512 512 512
ReadX 12196 1024 512 512
QUERY_FILE_INFORMATION 12196
QUERY_FILE_INFORMATION 12196
Close 12196
QUERY_FILE_INFORMATION 12195
ReadX 12195 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12197
QUERY_FILE_INFORMATION 12197
ReadX 12197 0 512 512
ReadX 12197 512 512 512
ReadX 12197 1024 512 512
ReadX 12197 288 20 20
ReadX 12197 308 2084 2084
ReadX 12197 388 2084 2084
ReadX 12197 388 2084 2084
ReadX 12186 2157 1386 1386
ReadX 12197 2472 399 399
ReadX 12197 3072 1536 1536
ReadX 12197 544 149 149
ReadX 12197 693 485 485
Close 12197
ReadX 12186 2157 4096 4096
ReadX 12186 6253 4096 4096
ReadX 12186 10349 4096 4096
ReadX 12186 14445 4096 4096
ReadX 12186 18541 4096 4096
ReadX 12186 22637 256 256
ReadX 12186 22893 4096 4096
ReadX 12186 26989 4096 4096
ReadX 12186 31085 4096 4096
ReadX 12186 35181 4096 4096
ReadX 12186 39277 4096 4096
ReadX 12186 43373 4096 4096
ReadX 12186 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12186 2157 1024 1024
ReadX 12186 1667 4688 4688
ReadX 12186 6355 3516 3516
ReadX 12186 9871 16384 16384
ReadX 12186 26255 3771 3771
ReadX 12186 30026 2048 2048
ReadX 12186 32074 1024 1024
ReadX 12186 33098 6652 6652
ReadX 12186 39750 16384 16384
ReadX 12186 56134 10496 10496
ReadX 12186 66630 1784 1784
ReadX 12186 68414 90 90
ReadX 12186 68504 273 273
ReadX 12186 68777 1600 1600
ReadX 12186 70377 640 640
ReadX 12186 71017 1280 1280
ReadX 12186 72297 8464 8464
ReadX 12186 80761 158 158
ReadX 12186 80919 912 912
ReadX 12186 81831 1980 1980
ReadX 12186 83811 2256 2256
ReadX 12186 86067 400 400
ReadX 12186 86467 252 252
ReadX 12186 86719 42 42
ReadX 12186 86761 725 725
ReadX 12186 2009 512 512
ReadX 12186 3895 9 9
ReadX 12186 3781 46 46
ReadX 12186 4059 92 92
ReadX 12186 3781 92 92
ReadX 12186 3986 184 184
ReadX 12186 3987 16384 16384
ReadX 12186 3902 16384 16384
ReadX 12186 3781 10240 10240
ReadX 12186 3821 16384 16384
ReadX 12186 3891 935 935
ReadX 12186 4060 10240 10240
ReadX 12186 4059 184 184
ReadX 12186 256 184 184
ReadX 12186 256 1026 1026
ReadX 12186 3901 326 326
ReadX 12186 3899 652 652
ReadX 12186 256 2 2
ReadX 12186 258 4948 4948
Close 12186
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12199
Close 12199
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12201
WriteX 12201 4055 1 1
QUERY_FILE_INFORMATION 12201
WriteX 12201 0 65471 65471
WriteX 12201 65471 65 65
WriteX 12201 65536 65471 65471
WriteX 12201 131007 65 65
WriteX 12201 131072 65471 65471
WriteX 12201 196543 65 65
WriteX 12201 196608 65471 65471
WriteX 12201 262079 65 65
WriteX 12201 262144 65471 65471
WriteX 12201 327615 65 65
WriteX 12201 327680 65471 65471
WriteX 12201 393151 65 65
WriteX 12201 393216 65471 65471
WriteX 12201 458687 65 65
WriteX 12201 458752 65471 65471
WriteX 12201 524223 65 65
WriteX 12201 524288 65471 65471
WriteX 12201 589759 65 65
WriteX 12201 589824 35257 35257
Close 12201
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12203
Close 12203
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12205
WriteX 12205 4055 1 1
QUERY_FILE_INFORMATION 12205
WriteX 12205 0 65471 65471
WriteX 12205 65471 65 65
WriteX 12205 65536 65471 65471
WriteX 12205 131007 65 65
WriteX 12205 131072 65471 65471
WriteX 12205 196543 65 65
WriteX 12205 196608 65471 65471
WriteX 12205 262079 65 65
WriteX 12205 262144 65471 65471
WriteX 12205 327615 65 65
WriteX 12205 327680 65471 65471
WriteX 12205 393151 65 65
WriteX 12205 393216 65471 65471
WriteX 12205 458687 65 65
WriteX 12205 458752 65471 65471
WriteX 12205 524223 65 65
WriteX 12205 524288 65471 65471
WriteX 12205 589759 65 65
WriteX 12205 589824 57598 57598
Close 12205
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12207
WriteX 12207 15 1 1
QUERY_FILE_INFORMATION 12207
WriteX 12207 0 12543 12543
Flush 12207
Close 12207
Close 12193
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12208
Close 12208
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12209
QUERY_FILE_INFORMATION 12209
QUERY_FILE_INFORMATION 12209
QUERY_FILE_INFORMATION 12209
ReadX 12209 288 24 24
ReadX 12209 287 276 276
ReadX 12209 286 14 14
ReadX 12209 286 7 7
ReadX 12209 287 12 12
ReadX 12209 287 8 8
ReadX 12209 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12210
Close 12210
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12211
QUERY_FILE_INFORMATION 12211
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 12211
QUERY_FILE_INFORMATION 12211
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12212
QUERY_FILE_INFORMATION 12212
QUERY_FILE_INFORMATION 12212
QUERY_FILE_INFORMATION 12212
ReadX 12212 1938 24 24
ReadX 12212 1920 276 276
ReadX 12212 1918 14 14
ReadX 12212 1918 7 7
ReadX 12212 1919 12 12
ReadX 12212 1919 8 8
ReadX 12212 1917 15 15
ReadX 12212 0 16 16
ReadX 12212 16 2048 2048
ReadX 12212 2064 2048 2048
ReadX 12212 257 2048 2048
ReadX 12212 385 2048 2048
ReadX 12212 513 2048 2048
ReadX 12212 641 2048 2048
ReadX 12212 769 2048 2048
ReadX 12212 897 2048 2048
ReadX 12212 1025 2048 2048
ReadX 12212 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12214
Close 12214
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12216
WriteX 12216 15 1 1
QUERY_FILE_INFORMATION 12216
WriteX 12216 0 11588 11588
Flush 12216
Close 12216
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12217
Close 12217
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12218
QUERY_FILE_INFORMATION 12218
QUERY_FILE_INFORMATION 12218
QUERY_FILE_INFORMATION 12218
ReadX 12218 1909 24 24
ReadX 12218 1892 276 276
ReadX 12218 1889 14 14
ReadX 12218 1889 7 7
ReadX 12218 1891 12 12
ReadX 12218 1890 8 8
ReadX 12218 1888 15 15
Close 12212
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12220
WriteX 12220 15 1 1
QUERY_FILE_INFORMATION 12220
WriteX 12220 0 11615 11615
Flush 12220
Close 12220
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12218
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12221
Close 12221
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12222
QUERY_FILE_INFORMATION 12222
QUERY_FILE_INFORMATION 12222
QUERY_FILE_INFORMATION 12222
ReadX 12222 1947 24 24
ReadX 12222 1929 276 276
ReadX 12222 1927 14 14
ReadX 12222 1927 7 7
ReadX 12222 1929 12 12
ReadX 12222 1928 8 8
ReadX 12222 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12224
Close 12224
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12226
WriteX 12226 4088 1 1
QUERY_FILE_INFORMATION 12226
WriteX 12226 0 65471 65471
WriteX 12226 65471 65 65
WriteX 12226 65536 16050 16050
Close 12226
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12211 1939 64 64
ReadX 12211 128 248 248
ReadX 12211 128 568 568
ReadX 12211 3872 1536 1536
ReadX 12211 3456 2560 2560
ReadX 12211 3136 512 512
ReadX 12211 2880 4096 4096
ReadX 12211 3264 3072 3072
ReadX 12211 320 4096 4096
ReadX 12211 1024 4096 4096
ReadX 12211 3616 4096 4096
ReadX 12211 1939 64 64
ReadX 12211 128 248 248
ReadX 12211 128 608 608
ReadX 12211 2858 1024 1024
ReadX 12211 2810 4096 4096
ReadX 12211 2826 4096 4096
ReadX 12211 2580 2048 2048
ReadX 12211 2800 2560 2560
ReadX 12211 2100 4096 4096
ReadX 12211 2084 4096 4096
ReadX 12211 868 4096 4096
ReadX 12211 2324 4096 4096
ReadX 12211 884 4096 4096
ReadX 12211 2604 1024 1024
ReadX 12211 580 4096 4096
ReadX 12211 596 4096 4096
ReadX 12211 2752 4096 4096
ReadX 12211 2842 1024 1024
ReadX 12211 660 4096 4096
ReadX 12211 2720 4096 4096
ReadX 12211 2736 4096 4096
ReadX 12211 628 4096 4096
ReadX 12211 2704 4096 4096
ReadX 12211 1556 4096 4096
ReadX 12211 576 4096 4096
ReadX 12211 3168 1536 1536
ReadX 12211 832 4096 4096
ReadX 12211 1088 4096 4096
ReadX 12211 1344 4096 4096
ReadX 12211 1600 4096 4096
ReadX 12211 1856 4096 4096
ReadX 12211 2112 4096 4096
ReadX 12211 1892 4096 4096
ReadX 12211 820 4096 4096
ReadX 12211 788 4096 4096
ReadX 12211 1604 4096 4096
ReadX 12211 3648 4096 4096
ReadX 12211 2608 4096 4096
ReadX 12211 548 4096 4096
ReadX 12211 740 4096 4096
ReadX 12211 1344 4096 4096
ReadX 12211 3392 4096 4096
ReadX 12211 3904 4096 4096
ReadX 12211 644 4096 4096
ReadX 12211 676 4096 4096
ReadX 12211 2688 4096 4096
ReadX 12211 320 4096 4096
ReadX 12211 900 4096 4096
ReadX 12211 1908 4096 4096
ReadX 12211 852 4096 4096
ReadX 12211 724 4096 4096
ReadX 12211 2292 4096 4096
ReadX 12211 612 4096 4096
ReadX 12211 388 4096 4096
ReadX 12211 2368 4096 4096
ReadX 12211 2624 4096 4096
ReadX 12211 500 4096 4096
ReadX 12211 356 4096 4096
ReadX 12211 1024 4096 4096
ReadX 12211 576 4096 4096
ReadX 12211 340 4096 4096
ReadX 12211 420 4096 4096
ReadX 12211 1600 4096 4096
ReadX 12211 404 4096 4096
ReadX 12211 1428 4096 4096
ReadX 12211 2656 4096 4096
ReadX 12211 2624 4096 4096
ReadX 12211 452 4096 4096
ReadX 12211 692 4096 4096
ReadX 12211 564 4096 4096
ReadX 12211 372 4096 4096
ReadX 12211 468 4096 4096
ReadX 12211 484 4096 4096
ReadX 12211 1088 4096 4096
ReadX 12211 1924 4096 4096
ReadX 12211 2768 4096 4096
ReadX 12211 832 4096 4096
ReadX 12211 836 4096 4096
ReadX 12211 1856 4096 4096
ReadX 12211 2640 4096 4096
ReadX 12211 436 4096 4096
ReadX 12211 1828 4096 4096
ReadX 12211 804 4096 4096
ReadX 12211 1860 4096 4096
ReadX 12211 1812 4096 4096
ReadX 12211 756 4096 4096
ReadX 12211 1636 4096 4096
ReadX 12211 772 4096 4096
ReadX 12211 2036 4096 4096
ReadX 12211 1220 4096 4096
ReadX 12211 1652 4096 4096
ReadX 12211 2588 4096 4096
ReadX 12211 916 4096 4096
ReadX 12211 260 4096 4096
ReadX 12211 932 4096 4096
ReadX 12211 2624 4096 4096
ReadX 12211 308 4096 4096
ReadX 12211 292 4096 4096
ReadX 12211 1140 4096 4096
ReadX 12211 276 4096 4096
ReadX 12211 2020 4096 4096
ReadX 12211 2880 4096 4096
ReadX 12211 516 4096 4096
ReadX 12211 1844 4096 4096
ReadX 12211 1124 4096 4096
ReadX 12211 3136 4096 4096
ReadX 12211 324 4096 4096
ReadX 12211 1156 4096 4096
ReadX 12211 1172 4096 4096
ReadX 12211 2112 4096 4096
ReadX 12211 2368 4096 4096
ReadX 12211 964 4096 4096
ReadX 12211 980 4096 4096
ReadX 12211 1012 4096 4096
ReadX 12211 532 4096 4096
ReadX 12211 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12211 1620 4096 4096
ReadX 12211 1604 4096 4096
ReadX 12211 2116 4096 4096
ReadX 12211 2132 4096 4096
ReadX 12211 2148 4096 4096
ReadX 12211 2276 4096 4096
ReadX 12211 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12228
Close 12228
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12230
QUERY_FILE_INFORMATION 12195
WriteX 12230 4088 1 1
QUERY_FILE_INFORMATION 12230
QUERY_FILE_INFORMATION 12195
Close 12195
WriteX 12230 0 65471 65471
WriteX 12230 65471 65 65
WriteX 12230 65536 64850 64850
Close 12230
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12232
WriteX 12232 15 1 1
QUERY_FILE_INFORMATION 12232
ReadX 12211 2068 4096 4096
ReadX 12211 1588 4096 4096
ReadX 12211 1572 4096 4096
WriteX 12232 0 18630 18630
Flush 12232
Close 12232
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12222
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12233
Close 12233
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12234
QUERY_FILE_INFORMATION 12234
QUERY_FILE_INFORMATION 12234
QUERY_FILE_INFORMATION 12234
ReadX 12234 661 24 24
ReadX 12234 659 356 356
ReadX 12234 659 14 14
ReadX 12234 659 7 7
ReadX 12234 659 12 12
ReadX 12234 659 8 8
ReadX 12234 659 15 15
ReadX 12234 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12211 612 4096 4096
ReadX 12211 564 4096 4096
ReadX 12211 1876 4096 4096
ReadX 12211 628 4096 4096
ReadX 12211 740 4096 4096
ReadX 12211 724 4096 4096
ReadX 12211 644 4096 4096
ReadX 12211 2324 4096 4096
ReadX 12211 660 4096 4096
ReadX 12211 852 4096 4096
ReadX 12211 868 4096 4096
Close 12234
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 12209
ReadX 12211 2368 4096 4096
ReadX 12211 1024 4096 4096
ReadX 12211 320 4096 4096
ReadX 12211 580 4096 4096
ReadX 12211 3136 512 512
ReadX 12211 2880 4096 4096
Close 12211
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12235
WriteX 12235 0 65471 65471
WriteX 12235 65471 63 63
WriteX 12235 65534 65471 65471
WriteX 12235 131005 63 63
Close 12235
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12236
WriteX 12236 0 65471 65471
WriteX 12236 65471 63 63
WriteX 12236 65534 65471 65471
WriteX 12236 131005 63 63
WriteX 12236 131068 65471 65471
WriteX 12236 196539 63 63
WriteX 12236 196602 65471 65471
WriteX 12236 262073 63 63
Close 12236
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12237
WriteX 12237 0 65471 65471
WriteX 12237 65471 63 63
WriteX 12237 65534 65471 65471
WriteX 12237 131005 63 63
WriteX 12237 131068 65471 65471
WriteX 12237 196539 63 63
WriteX 12237 196602 65471 65471
WriteX 12237 262073 63 63
WriteX 12237 262136 65471 65471
WriteX 12237 327607 63 63
WriteX 12237 327670 65471 65471
WriteX 12237 393141 63 63
WriteX 12237 393204 65471 65471
WriteX 12237 458675 63 63
WriteX 12237 458738 65471 65471
WriteX 12237 524209 63 63
Close 12237
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12238
Close 12238
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12239
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12239 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12240
ReadX 12240 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12241
ReadX 12241 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12242
ReadX 12242 0 511 511
ReadX 12239 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12239
Close 12240
Close 12241
Close 12242
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12243
ReadX 12243 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12244
ReadX 12244 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12245
ReadX 12245 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12246
ReadX 12246 0 511 511
ReadX 12243 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12247
FIND_FIRST \clients\client1\~dmtmp\*
Close 12247
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12248
QUERY_FILE_INFORMATION 12248
WriteX 12248 2047 1 1
QUERY_FILE_INFORMATION 12248
WriteX 12248 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12249
Close 12249
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12250
WriteX 12250 52 1 1
QUERY_FILE_INFORMATION 12250
WriteX 12250 0 53 53
WriteX 12250 53 28 28
WriteX 12250 81 4 4
WriteX 12250 85 28 28
WriteX 12250 113 38 38
WriteX 12250 151 28 28
WriteX 12250 179 2 2
WriteX 12250 181 28 28
WriteX 12250 209 3 3
WriteX 12250 212 279 279
WriteX 12250 9 4 4
Close 12250
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12251
ReadX 12251 0 53 53
ReadX 12251 53 28 28
ReadX 12251 81 4 4
ReadX 12251 85 28 28
ReadX 12251 113 38 38
ReadX 12251 151 28 28
ReadX 12251 179 2 2
ReadX 12251 181 28 28
ReadX 12251 209 3 3
Close 12251
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12243
Close 12244
Close 12245
Close 12246
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12252
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12252 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12253
ReadX 12253 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12254
ReadX 12254 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12255
ReadX 12255 0 511 511
ReadX 12252 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12257
Close 12257
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12258
WriteX 12258 52 1 1
QUERY_FILE_INFORMATION 12258
WriteX 12258 0 53 53
WriteX 12258 53 28 28
WriteX 12258 81 28 28
WriteX 12258 109 28 28
WriteX 12258 137 28 28
WriteX 12258 165 28 28
WriteX 12258 193 28 28
WriteX 12258 221 28 28
WriteX 12258 249 4 4
WriteX 12258 253 4 4
WriteX 12258 257 4 4
WriteX 12258 261 28 28
WriteX 12258 289 2 2
WriteX 12258 291 2 2
WriteX 12258 293 2 2
WriteX 12258 295 248 248
WriteX 12258 9 4 4
Close 12258
Close 12252
Close 12253
Close 12254
Close 12255
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12259
ReadX 12259 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12260
ReadX 12260 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12261
ReadX 12261 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12262
ReadX 12262 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12263
ReadX 12263 0 53 53
ReadX 12263 53 28 28
ReadX 12263 81 28 28
ReadX 12263 109 28 28
ReadX 12263 137 28 28
ReadX 12263 165 28 28
ReadX 12263 193 28 28
ReadX 12263 221 28 28
ReadX 12263 249 4 4
ReadX 12263 253 4 4
ReadX 12263 257 4 4
ReadX 12263 261 28 28
ReadX 12263 289 2 2
ReadX 12263 291 2 2
ReadX 12263 293 2 2
Close 12263
ReadX 12259 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12259
Close 12260
Close 12261
Close 12262
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12248
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12264
Close 12264
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12265
ReadX 12265 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12266
ReadX 12266 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12267
ReadX 12267 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12268
ReadX 12268 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12269
ReadX 12269 0 53 53
ReadX 12269 53 28 28
ReadX 12269 81 28 28
ReadX 12269 109 28 28
ReadX 12269 137 28 28
ReadX 12269 165 28 28
ReadX 12269 193 28 28
ReadX 12269 221 28 28
ReadX 12269 249 4 4
ReadX 12269 253 4 4
ReadX 12269 257 4 4
ReadX 12269 261 28 28
ReadX 12269 289 2 2
ReadX 12269 291 2 2
ReadX 12269 293 2 2
Close 12269
ReadX 12265 2048 2048 2048
Close 12265
Close 12266
Close 12267
Close 12268
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12270
ReadX 12270 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12271
ReadX 12271 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12272
ReadX 12272 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12273
ReadX 12273 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12274
ReadX 12274 0 53 53
ReadX 12274 53 28 28
ReadX 12274 81 28 28
ReadX 12274 109 28 28
ReadX 12274 137 28 28
ReadX 12274 165 28 28
ReadX 12274 193 28 28
ReadX 12274 221 28 28
ReadX 12274 249 4 4
ReadX 12274 253 4 4
ReadX 12274 257 4 4
ReadX 12274 261 28 28
ReadX 12274 289 2 2
ReadX 12274 291 2 2
ReadX 12274 293 2 2
Close 12274
ReadX 12270 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12278
FIND_FIRST \clients\client1\~dmtmp\*
Close 12278
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12279
QUERY_FILE_INFORMATION 12279
WriteX 12279 2047 1 1
QUERY_FILE_INFORMATION 12279
WriteX 12279 0 2048 2048
Close 12279
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12280
ReadX 12280 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12280
Close 12270
Close 12271
Close 12272
Close 12273
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12281
ReadX 12281 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12281 4095 1 1
QUERY_FILE_INFORMATION 12281
WriteX 12281 2048 2048 2048
QUERY_FILE_INFORMATION 12281
Flush 12281
WriteX 12281 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12282
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12282 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12283
ReadX 12283 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12284
ReadX 12284 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12285
ReadX 12285 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12286
ReadX 12286 0 53 53
ReadX 12286 53 28 28
ReadX 12286 81 28 28
ReadX 12286 109 28 28
ReadX 12286 137 28 28
ReadX 12286 165 28 28
ReadX 12286 193 28 28
ReadX 12286 221 28 28
ReadX 12286 249 4 4
ReadX 12286 253 4 4
ReadX 12286 257 4 4
ReadX 12286 261 28 28
ReadX 12286 289 2 2
ReadX 12286 291 2 2
ReadX 12286 293 2 2
Close 12286
ReadX 12282 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12290
FIND_FIRST \clients\client1\~dmtmp\*
Close 12290
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12291
QUERY_FILE_INFORMATION 12291
WriteX 12291 2047 1 1
QUERY_FILE_INFORMATION 12291
WriteX 12291 0 2048 2048
Close 12291
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12292
ReadX 12292 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12296
Close 12296
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12297
QUERY_FILE_INFORMATION 12297
WriteX 12297 2047 1 1
QUERY_FILE_INFORMATION 12297
WriteX 12297 0 2048 2048
Close 12297
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12298
ReadX 12298 0 511 511
ReadX 12282 384 2048 2048
ReadX 12282 768 16384 16384
ReadX 12282 1792 14336 14336
Close 12298
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12299
ReadX 12299 0 511 511
Close 12299
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12301
Close 12301
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12292 4095 1 1
QUERY_FILE_INFORMATION 12292
WriteX 12292 2048 2048 2048
WriteX 12292 0 88 88
Close 12292
WriteX 12282 1152 2048 2048
WriteX 12282 1408 6144 6144
WriteX 12282 1920 2048 2048
WriteX 12282 0 88 88
Close 12282
WriteX 12283 0 88 88
Close 12283
WriteX 12284 0 88 88
Close 12284
Close 12285
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12302
ReadX 12302 0 511 511
ReadX 12302 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12302
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12303
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12303 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12304
ReadX 12304 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12305
ReadX 12305 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12306
ReadX 12306 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12307
ReadX 12307 0 53 53
ReadX 12307 53 28 28
ReadX 12307 81 28 28
ReadX 12307 109 28 28
ReadX 12307 137 28 28
ReadX 12307 165 28 28
ReadX 12307 193 28 28
ReadX 12307 221 28 28
ReadX 12307 249 4 4
ReadX 12307 253 4 4
ReadX 12307 257 4 4
ReadX 12307 261 28 28
ReadX 12307 289 2 2
ReadX 12307 291 2 2
ReadX 12307 293 2 2
Close 12307
ReadX 12303 2048 2048 2048
Close 12303
Close 12304
Close 12305
Close 12306
Close 12281
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12308
QUERY_FILE_INFORMATION 12308
Close 12308
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12309
Close 12309
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12310
ReadX 12310 0 511 511
ReadX 12310 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12311
ReadX 12311 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12312
ReadX 12312 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12313
ReadX 12313 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12314
ReadX 12314 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12315
ReadX 12315 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12316
ReadX 12316 0 53 53
ReadX 12316 53 2 2
ReadX 12316 55 2 2
ReadX 12316 57 184 184
ReadX 12316 241 298 298
Close 12316
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12317
ReadX 12317 0 41 41
ReadX 12310 2048 2048 2048
Close 12317
Close 12310
Close 12311
Close 12314
Close 12315
Close 12312
Close 12313
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12318
ReadX 12318 0 511 511
ReadX 12318 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12319
ReadX 12319 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12320
ReadX 12320 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12321
ReadX 12321 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12322
ReadX 12322 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12323
ReadX 12323 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12324
ReadX 12324 0 53 53
ReadX 12324 53 2 2
ReadX 12324 55 2 2
ReadX 12324 57 184 184
ReadX 12324 241 298 298
Close 12324
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12325
ReadX 12325 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12326
ReadX 12326 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12327
ReadX 12327 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12328
ReadX 12328 0 511 511
ReadX 12327 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12329
ReadX 12329 0 53 53
ReadX 12329 53 2 2
ReadX 12329 55 480 480
ReadX 12329 535 2 2
Close 12329
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12330
ReadX 12330 0 41 41
ReadX 12318 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12334
FIND_FIRST \clients\client1\~dmtmp\*
Close 12334
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12335
QUERY_FILE_INFORMATION 12335
WriteX 12335 2047 1 1
QUERY_FILE_INFORMATION 12335
WriteX 12335 0 2048 2048
Close 12335
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12336
ReadX 12336 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12336
Close 12325
Close 12326
Close 12327
Close 12328
Close 12330
Close 12318
Close 12319
Close 12322
Close 12323
Close 12320
Close 12321
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12337
ReadX 12337 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12338
Close 12338
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12339
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12339 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12340
ReadX 12340 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12341
ReadX 12341 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12342
ReadX 12342 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12343
ReadX 12343 0 53 53
ReadX 12343 53 2 2
ReadX 12343 55 480 480
ReadX 12343 535 2 2
Close 12343
ReadX 12339 2048 2048 2048
Close 12339
Close 12340
Close 12341
Close 12342
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12344
ReadX 12344 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12345
ReadX 12345 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12346
ReadX 12346 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12347
ReadX 12347 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12348
ReadX 12348 0 53 53
ReadX 12348 53 2 2
ReadX 12348 55 480 480
ReadX 12348 535 2 2
Close 12348
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12349
ReadX 12349 0 511 511
ReadX 12349 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12350
ReadX 12350 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12351
ReadX 12351 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12352
ReadX 12352 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12353
ReadX 12353 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12354
ReadX 12354 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12355
ReadX 12355 0 41 41
ReadX 12349 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12356
ReadX 12356 0 53 53
ReadX 12356 53 2 2
ReadX 12356 55 2 2
ReadX 12356 57 184 184
ReadX 12356 241 298 298
Close 12356
ReadX 12344 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12360
FIND_FIRST \clients\client1\~dmtmp\*
Close 12360
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12361
QUERY_FILE_INFORMATION 12361
WriteX 12361 2047 1 1
QUERY_FILE_INFORMATION 12361
WriteX 12361 0 2048 2048
Close 12361
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12362
ReadX 12362 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12362
Close 12355
Close 12349
Close 12350
Close 12353
Close 12354
Close 12351
Close 12352
Close 12344
Close 12345
Close 12346
Close 12347
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12363
ReadX 12363 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12337 4095 1 1
QUERY_FILE_INFORMATION 12337
WriteX 12337 2048 2048 2048
QUERY_FILE_INFORMATION 12337
Flush 12337
WriteX 12337 0 88 88
WriteX 12363 4095 1 1
QUERY_FILE_INFORMATION 12363
WriteX 12363 2048 2048 2048
QUERY_FILE_INFORMATION 12363
Flush 12363
WriteX 12363 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12364
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12364 0 511 511
ReadX 12364 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12365
ReadX 12365 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12366
ReadX 12366 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12367
ReadX 12367 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12368
ReadX 12368 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12369
ReadX 12369 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12370
ReadX 12370 0 53 53
ReadX 12370 53 2 2
ReadX 12370 55 2 2
ReadX 12370 57 184 184
ReadX 12370 241 298 298
Close 12370
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12371
ReadX 12371 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12372
ReadX 12372 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12373
ReadX 12373 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12374
ReadX 12374 0 511 511
ReadX 12373 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12375
ReadX 12375 0 53 53
ReadX 12375 53 2 2
ReadX 12375 55 480 480
ReadX 12375 535 2 2
Close 12375
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12376
ReadX 12376 0 41 41
ReadX 12364 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12377
ReadX 12377 0 53 53
ReadX 12377 53 2 2
ReadX 12377 55 480 480
ReadX 12377 535 2 2
Close 12377
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12378
ReadX 12378 0 53 53
ReadX 12378 53 2 2
ReadX 12378 55 2 2
ReadX 12378 57 184 184
ReadX 12378 241 298 298
Close 12378
ReadX 12371 2048 2048 2048
ReadX 12372 2048 2048 2048
ReadX 12371 320 16384 16384
ReadX 12371 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12379
FIND_FIRST \clients\client1\~dmtmp\*
Close 12379
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12380
QUERY_FILE_INFORMATION 12380
WriteX 12380 4095 1 1
QUERY_FILE_INFORMATION 12380
WriteX 12380 0 4096 4096
Close 12380
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12381
ReadX 12381 0 41 41
Close 12371
Close 12372
Close 12373
Close 12374
Close 12376
Close 12364
Close 12365
Close 12368
Close 12369
Close 12366
Close 12367
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12382
Close 12382
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12383
QUERY_FILE_INFORMATION 12383
WriteX 12383 4095 1 1
QUERY_FILE_INFORMATION 12383
WriteX 12383 0 4096 4096
Close 12383
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12384
ReadX 12384 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 12381
ReadX 12381 0 4096 4096
WriteX 12384 0 4096 4096
Close 12384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12386
ReadX 12386 0 41 41
Close 12381
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12386
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12387
Close 12387
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12388
ReadX 12388 0 41 41
Close 12388
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12389
Close 12389
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12390
QUERY_FILE_INFORMATION 12390
WriteX 12390 2047 1 1
QUERY_FILE_INFORMATION 12390
WriteX 12390 0 2048 2048
Close 12390
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12391
ReadX 12391 0 511 511
ReadX 12391 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12392
ReadX 12392 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12392
Close 12391
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12393
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12393 0 511 511
ReadX 12393 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12394
ReadX 12394 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12395
ReadX 12395 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12396
ReadX 12396 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12397
ReadX 12397 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12398
ReadX 12398 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12399
ReadX 12399 0 53 53
ReadX 12399 53 2 2
ReadX 12399 55 2 2
ReadX 12399 57 184 184
ReadX 12399 241 298 298
Close 12399
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12400
ReadX 12400 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12401
ReadX 12401 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12402
ReadX 12402 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12403
ReadX 12403 0 511 511
ReadX 12402 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12404
ReadX 12404 0 53 53
ReadX 12404 53 2 2
ReadX 12404 55 480 480
ReadX 12404 535 2 2
Close 12404
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12405
ReadX 12405 0 41 41
ReadX 12393 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12406
ReadX 12406 0 53 53
ReadX 12406 53 2 2
ReadX 12406 55 480 480
ReadX 12406 535 2 2
Close 12406
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12407
ReadX 12407 0 53 53
ReadX 12407 53 2 2
ReadX 12407 55 2 2
ReadX 12407 57 184 184
ReadX 12407 241 298 298
Close 12407
ReadX 12400 2048 2048 2048
Close 12400
Close 12401
Close 12402
Close 12403
Close 12405
Close 12393
Close 12394
Close 12397
Close 12398
Close 12395
Close 12396
Close 12337
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12408
QUERY_FILE_INFORMATION 12408
Close 12408
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12363
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12409
QUERY_FILE_INFORMATION 12409
Close 12409
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12410
Close 12410
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12411
ReadX 12411 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12412
ReadX 12412 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12413
ReadX 12413 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12414
ReadX 12414 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12415
ReadX 12415 0 53 53
ReadX 12415 53 2 2
ReadX 12415 55 480 480
ReadX 12415 535 2 2
Close 12415
ReadX 12411 2048 2048 2048
Close 12411
Close 12412
Close 12413
Close 12414
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12416
ReadX 12416 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12417
ReadX 12417 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12418
ReadX 12418 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12419
ReadX 12419 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12420
ReadX 12420 0 53 53
ReadX 12420 53 2 2
ReadX 12420 55 480 480
ReadX 12420 535 2 2
Close 12420
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12421
ReadX 12421 0 511 511
ReadX 12421 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12422
ReadX 12422 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12423
ReadX 12423 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12424
ReadX 12424 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12425
ReadX 12425 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12426
ReadX 12426 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12427
ReadX 12427 0 41 41
ReadX 12421 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12428
ReadX 12428 0 53 53
ReadX 12428 53 2 2
ReadX 12428 55 2 2
ReadX 12428 57 184 184
ReadX 12428 241 298 298
Close 12428
ReadX 12416 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12432
FIND_FIRST \clients\client1\~dmtmp\*
Close 12432
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12433
QUERY_FILE_INFORMATION 12433
WriteX 12433 2047 1 1
QUERY_FILE_INFORMATION 12433
WriteX 12433 0 2048 2048
Close 12433
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12434
ReadX 12434 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12434
Close 12427
Close 12421
Close 12422
Close 12425
Close 12426
Close 12423
Close 12424
Close 12416
Close 12417
Close 12418
Close 12419
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12435
ReadX 12435 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12436
Close 12436
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12437
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12437 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12438
ReadX 12438 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12439
ReadX 12439 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12440
ReadX 12440 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12441
ReadX 12441 0 53 53
ReadX 12441 53 28 28
ReadX 12441 81 28 28
ReadX 12441 109 28 28
ReadX 12441 137 28 28
ReadX 12441 165 28 28
ReadX 12441 193 28 28
ReadX 12441 221 28 28
ReadX 12441 249 4 4
ReadX 12441 253 4 4
ReadX 12441 257 4 4
ReadX 12441 261 28 28
ReadX 12441 289 2 2
ReadX 12441 291 2 2
ReadX 12441 293 2 2
Close 12441
ReadX 12437 2048 2048 2048
Close 12437
Close 12438
Close 12439
Close 12440
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12442
ReadX 12442 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12443
ReadX 12443 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12444
ReadX 12444 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12445
ReadX 12445 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12446
ReadX 12446 0 53 53
ReadX 12446 53 28 28
ReadX 12446 81 28 28
ReadX 12446 109 28 28
ReadX 12446 137 28 28
ReadX 12446 165 28 28
ReadX 12446 193 28 28
ReadX 12446 221 28 28
ReadX 12446 249 4 4
ReadX 12446 253 4 4
ReadX 12446 257 4 4
ReadX 12446 261 28 28
ReadX 12446 289 2 2
ReadX 12446 291 2 2
ReadX 12446 293 2 2
Close 12446
ReadX 12442 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12450
FIND_FIRST \clients\client1\~dmtmp\*
Close 12450
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12451
QUERY_FILE_INFORMATION 12451
WriteX 12451 2047 1 1
QUERY_FILE_INFORMATION 12451
WriteX 12451 0 2048 2048
Close 12451
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12452
ReadX 12452 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12452
Close 12442
Close 12443
Close 12444
Close 12445
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12453
ReadX 12453 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12454
Close 12454
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12455
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12455 0 511 511
ReadX 12455 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12456
ReadX 12456 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12457
ReadX 12457 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12458
ReadX 12458 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12459
ReadX 12459 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12460
ReadX 12460 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12461
ReadX 12461 0 53 53
ReadX 12461 53 2 2
ReadX 12461 55 2 2
ReadX 12461 57 184 184
ReadX 12461 241 298 298
Close 12461
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12462
ReadX 12462 0 41 41
ReadX 12455 2048 2048 2048
Close 12462
Close 12455
Close 12456
Close 12459
Close 12460
Close 12457
Close 12458
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12463
ReadX 12463 0 511 511
ReadX 12463 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12464
ReadX 12464 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12465
ReadX 12465 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12466
ReadX 12466 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12467
ReadX 12467 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12468
ReadX 12468 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12469
ReadX 12469 0 53 53
ReadX 12469 53 2 2
ReadX 12469 55 2 2
ReadX 12469 57 184 184
ReadX 12469 241 298 298
Close 12469
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12470
ReadX 12470 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12471
ReadX 12471 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12472
ReadX 12472 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12473
ReadX 12473 0 511 511
ReadX 12472 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12474
ReadX 12474 0 53 53
ReadX 12474 53 2 2
ReadX 12474 55 480 480
ReadX 12474 535 2 2
Close 12474
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12475
ReadX 12475 0 41 41
ReadX 12463 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12479
FIND_FIRST \clients\client1\~dmtmp\*
Close 12479
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12480
QUERY_FILE_INFORMATION 12480
WriteX 12480 2047 1 1
QUERY_FILE_INFORMATION 12480
WriteX 12480 0 2048 2048
Close 12480
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12481
ReadX 12481 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12481
Close 12470
Close 12471
Close 12472
Close 12473
Close 12475
Close 12463
Close 12464
Close 12467
Close 12468
Close 12465
Close 12466
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12482
ReadX 12482 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12435 4095 1 1
QUERY_FILE_INFORMATION 12435
WriteX 12435 2048 2048 2048
QUERY_FILE_INFORMATION 12435
Flush 12435
WriteX 12435 0 88 88
WriteX 12453 4095 1 1
QUERY_FILE_INFORMATION 12453
WriteX 12453 2048 2048 2048
QUERY_FILE_INFORMATION 12453
Flush 12453
WriteX 12453 0 88 88
WriteX 12482 4095 1 1
QUERY_FILE_INFORMATION 12482
WriteX 12482 2048 2048 2048
QUERY_FILE_INFORMATION 12482
Flush 12482
WriteX 12482 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12483
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12483 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12484
ReadX 12484 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12485
ReadX 12485 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12486
ReadX 12486 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12487
ReadX 12487 0 53 53
ReadX 12487 53 2 2
ReadX 12487 55 480 480
ReadX 12487 535 2 2
Close 12487
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12488
ReadX 12488 0 511 511
ReadX 12488 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12489
ReadX 12489 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12490
ReadX 12490 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12491
ReadX 12491 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12492
ReadX 12492 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12493
ReadX 12493 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12494
ReadX 12494 0 41 41
ReadX 12488 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12495
ReadX 12495 0 53 53
ReadX 12495 53 2 2
ReadX 12495 55 2 2
ReadX 12495 57 184 184
ReadX 12495 241 298 298
Close 12495
ReadX 12483 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12496
ReadX 12496 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12497
ReadX 12497 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12498
ReadX 12498 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12499
ReadX 12499 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12500
ReadX 12500 0 53 53
ReadX 12500 53 28 28
ReadX 12500 81 28 28
ReadX 12500 109 28 28
ReadX 12500 137 28 28
ReadX 12500 165 28 28
ReadX 12500 193 28 28
ReadX 12500 221 28 28
ReadX 12500 249 4 4
ReadX 12500 253 4 4
ReadX 12500 257 4 4
ReadX 12500 261 28 28
ReadX 12500 289 2 2
ReadX 12500 291 2 2
ReadX 12500 293 2 2
Close 12500
ReadX 12496 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12501
ReadX 12501 0 53 53
ReadX 12501 53 2 2
ReadX 12501 55 2 2
ReadX 12501 57 184 184
ReadX 12501 241 298 298
Close 12501
ReadX 12485 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12502
ReadX 12502 0 53 53
ReadX 12502 53 2 2
ReadX 12502 55 480 480
ReadX 12502 535 2 2
Close 12502
ReadX 12496 4096 16384 16384
ReadX 12496 1280 16384 16384
ReadX 12496 2304 6144 6144
ReadX 12496 2688 2048 2048
ReadX 12483 4096 16384 16384
ReadX 12483 1280 16384 16384
ReadX 12483 2304 16384 16384
ReadX 12483 3328 16384 16384
ReadX 12483 272 16384 16384
ReadX 12483 336 16384 16384
ReadX 12483 400 16384 16384
ReadX 12483 464 16384 16384
ReadX 12483 528 16384 16384
ReadX 12483 592 16384 16384
ReadX 12483 656 16384 16384
ReadX 12483 720 16384 16384
ReadX 12483 784 16384 16384
ReadX 12483 848 16384 16384
ReadX 12483 912 16384 16384
ReadX 12489 2048 2048 2048
ReadX 12488 760 2048 2048
ReadX 12488 1144 2048 2048
ReadX 12488 408 2048 2048
ReadX 12488 912 2048 2048
ReadX 12488 1096 2048 2048
ReadX 12488 776 2048 2048
ReadX 12488 560 2048 2048
ReadX 12488 376 2048 2048
ReadX 12488 320 2048 2048
ReadX 12488 3072 2048 2048
ReadX 12488 784 2048 2048
ReadX 12488 2176 2048 2048
ReadX 12488 792 2048 2048
ReadX 12488 576 2048 2048
ReadX 12488 600 2048 2048
ReadX 12488 728 2048 2048
ReadX 12488 1112 2048 2048
ReadX 12488 664 2048 2048
ReadX 12488 976 2048 2048
ReadX 12488 3840 2048 2048
ReadX 12488 296 2048 2048
ReadX 12488 480 2048 2048
ReadX 12488 680 2048 2048
ReadX 12488 696 2048 2048
ReadX 12488 832 2048 2048
ReadX 12488 1016 2048 2048
ReadX 12488 1104 2048 2048
ReadX 12488 3200 2048 2048
ReadX 12488 264 2048 2048
ReadX 12488 448 2048 2048
ReadX 12488 648 2048 2048
ReadX 12488 1136 2048 2048
ReadX 12488 288 2048 2048
ReadX 12488 352 2048 2048
ReadX 12488 536 2048 2048
ReadX 12488 800 2048 2048
ReadX 12488 736 2048 2048
ReadX 12488 392 2048 2048
ReadX 12488 752 2048 2048
ReadX 12488 880 2048 2048
ReadX 12488 1064 2048 2048
ReadX 12488 1128 2048 2048
ReadX 12488 1536 2048 2048
ReadX 12488 2432 2048 2048
ReadX 12488 688 2048 2048
ReadX 12488 872 2048 2048
ReadX 12488 1072 2048 2048
ReadX 12488 984 2048 2048
ReadX 12488 704 2048 2048
ReadX 12488 3328 2048 2048
ReadX 12488 888 2048 2048
ReadX 12488 496 2048 2048
ReadX 12488 624 2048 2048
ReadX 12488 808 2048 2048
ReadX 12488 1008 2048 2048
ReadX 12488 1152 2048 2048
ReadX 12488 416 2048 2048
ReadX 12488 584 2048 2048
ReadX 12488 384 2048 2048
ReadX 12488 568 2048 2048
ReadX 12488 512 2048 2048
ReadX 12488 1408 2048 2048
ReadX 12488 472 2048 2048
ReadX 12488 672 2048 2048
ReadX 12488 2560 2048 2048
ReadX 12488 544 2048 2048
ReadX 12488 920 2048 2048
ReadX 12488 1120 2048 2048
ReadX 12488 2304 2048 2048
ReadX 12488 1080 2048 2048
ReadX 12488 1664 2048 2048
ReadX 12488 608 2048 2048
ReadX 12488 2688 2048 2048
ReadX 12488 3712 2048 2048
ReadX 12488 616 2048 2048
ReadX 12488 632 2048 2048
ReadX 12488 944 2048 2048
ReadX 12488 856 2048 2048
ReadX 12488 768 2048 2048
ReadX 12488 720 2048 2048
ReadX 12488 640 2048 2048
ReadX 12488 1048 2048 2048
ReadX 12488 1040 2048 2048
ReadX 12488 1032 2048 2048
ReadX 12488 1000 2048 2048
ReadX 12488 992 2048 2048
ReadX 12488 968 2048 2048
ReadX 12488 952 2048 2048
ReadX 12488 1056 2048 2048
ReadX 12488 816 2048 2048
ReadX 12488 864 2048 2048
ReadX 12488 2816 2048 2048
ReadX 12488 640 2048 2048
ReadX 12488 1024 2048 2048
ReadX 12488 504 2048 2048
ReadX 12488 424 2048 2048
ReadX 12488 840 2048 2048
ReadX 12488 896 2048 2048
ReadX 12488 520 2048 2048
ReadX 12488 960 2048 2048
ReadX 12488 552 2048 2048
ReadX 12488 488 2048 2048
ReadX 12488 824 2048 2048
ReadX 12488 304 2048 2048
ReadX 12488 768 2048 2048
ReadX 12488 712 2048 2048
ReadX 12488 512 2048 2048
ReadX 12488 432 2048 2048
ReadX 12488 384 2048 2048
ReadX 12488 2944 2048 2048
ReadX 12488 1088 2048 2048
ReadX 12488 928 2048 2048
ReadX 12488 280 2048 2048
ReadX 12488 744 2048 2048
ReadX 12488 3968 2048 2048
ReadX 12488 336 2048 2048
ReadX 12488 592 2048 2048
ReadX 12488 312 2048 2048
ReadX 12488 400 2048 2048
ReadX 12488 904 2048 2048
ReadX 12488 464 2048 2048
ReadX 12488 3456 2048 2048
ReadX 12488 848 2048 2048
ReadX 12488 936 2048 2048
ReadX 12488 656 2048 2048
ReadX 12488 344 2048 2048
ReadX 12488 440 2048 2048
ReadX 12488 4096 2048 2048
ReadX 12488 528 2048 2048
ReadX 12488 2048 2048 2048
ReadX 12488 1024 2048 2048
ReadX 12488 456 2048 2048
ReadX 12488 1792 2048 2048
ReadX 12488 1152 2048 2048
ReadX 12488 3584 2048 2048
ReadX 12488 1920 2048 2048
ReadX 12488 1280 2048 2048
ReadX 12488 896 2048 2048
ReadX 12488 328 2048 2048
Close 12496
Close 12497
Close 12498
Close 12499
Close 12494
Close 12488
Close 12489
Close 12492
Close 12493
Close 12490
Close 12491
Close 12483
Close 12484
Close 12485
Close 12486
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12503
FIND_FIRST \clients\client1\~dmtmp\*
Close 12503
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12504
QUERY_FILE_INFORMATION 12504
WriteX 12504 0 2048 2048
WriteX 12504 18431 1 1
QUERY_FILE_INFORMATION 12504
WriteX 12504 2048 16384 16384
WriteX 12504 1152 16384 16384
WriteX 12504 2176 16384 16384
WriteX 12504 3200 16384 16384
WriteX 12504 264 16384 16384
WriteX 12504 328 16384 16384
WriteX 12504 392 16384 16384
WriteX 12504 456 16384 16384
WriteX 12504 520 16384 16384
WriteX 12504 584 16384 16384
WriteX 12504 648 16384 16384
WriteX 12504 712 16384 16384
WriteX 12504 776 16384 16384
WriteX 12504 840 16384 16384
WriteX 12504 904 16384 16384
WriteX 12504 968 16384 16384
WriteX 12504 1032 16384 16384
WriteX 12504 1096 16384 16384
WriteX 12504 1160 16384 16384
WriteX 12504 1224 16384 16384
WriteX 12504 1288 16384 16384
WriteX 12504 1352 16384 16384
WriteX 12504 1416 16384 16384
WriteX 12504 1480 16384 16384
WriteX 12504 1544 16384 16384
WriteX 12504 1608 16384 16384
WriteX 12504 1672 16384 16384
WriteX 12504 1736 16384 16384
WriteX 12504 1800 16384 16384
WriteX 12504 1864 16384 16384
WriteX 12504 1928 16384 16384
WriteX 12504 1992 16384 16384
WriteX 12504 2056 16384 16384
WriteX 12504 2120 16384 16384
WriteX 12504 2184 16384 16384
WriteX 12504 2248 16384 16384
WriteX 12504 2312 16384 16384
WriteX 12504 2376 16384 16384
WriteX 12504 2440 16384 16384
WriteX 12504 0 88 88
Close 12504
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12505
ReadX 12505 0 511 511
ReadX 12505 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12505
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12506
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12506 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12507
ReadX 12507 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12508
ReadX 12508 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12509
ReadX 12509 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12510
ReadX 12510 0 53 53
ReadX 12510 53 2 2
ReadX 12510 55 480 480
ReadX 12510 535 2 2
Close 12510
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12511
ReadX 12511 0 511 511
ReadX 12511 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12512
ReadX 12512 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12513
ReadX 12513 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12514
ReadX 12514 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12515
ReadX 12515 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12516
ReadX 12516 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12517
ReadX 12517 0 41 41
ReadX 12511 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12518
ReadX 12518 0 53 53
ReadX 12518 53 2 2
ReadX 12518 55 2 2
ReadX 12518 57 184 184
ReadX 12518 241 298 298
Close 12518
ReadX 12506 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12519
ReadX 12519 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12520
ReadX 12520 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12521
ReadX 12521 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12522
ReadX 12522 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12523
ReadX 12523 0 53 53
ReadX 12523 53 28 28
ReadX 12523 81 28 28
ReadX 12523 109 28 28
ReadX 12523 137 28 28
ReadX 12523 165 28 28
ReadX 12523 193 28 28
ReadX 12523 221 28 28
ReadX 12523 249 4 4
ReadX 12523 253 4 4
ReadX 12523 257 4 4
ReadX 12523 261 28 28
ReadX 12523 289 2 2
ReadX 12523 291 2 2
ReadX 12523 293 2 2
Close 12523
ReadX 12519 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12524
ReadX 12524 0 53 53
ReadX 12524 53 2 2
ReadX 12524 55 2 2
ReadX 12524 57 184 184
ReadX 12524 241 298 298
Close 12524
ReadX 12508 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12525
ReadX 12525 0 53 53
ReadX 12525 53 2 2
ReadX 12525 55 480 480
ReadX 12525 535 2 2
Close 12525
Close 12519
Close 12520
Close 12521
Close 12522
Close 12517
Close 12511
Close 12512
Close 12515
Close 12516
Close 12513
Close 12514
Close 12506
Close 12507
Close 12508
Close 12509
Close 12435
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12526
QUERY_FILE_INFORMATION 12526
Close 12526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12453
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12527
QUERY_FILE_INFORMATION 12527
Close 12527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12482
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12528
QUERY_FILE_INFORMATION 12528
Close 12528
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12529
Close 12529
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12530
ReadX 12530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12531
ReadX 12531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12532
ReadX 12532 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12533
ReadX 12533 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12534
ReadX 12534 0 53 53
ReadX 12534 53 28 28
ReadX 12534 81 28 28
ReadX 12534 109 28 28
ReadX 12534 137 28 28
ReadX 12534 165 28 28
ReadX 12534 193 28 28
ReadX 12534 221 28 28
ReadX 12534 249 4 4
ReadX 12534 253 4 4
ReadX 12534 257 4 4
ReadX 12534 261 28 28
ReadX 12534 289 2 2
ReadX 12534 291 2 2
ReadX 12534 293 2 2
Close 12534
ReadX 12530 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12530 384 2048 2048
ReadX 12530 768 16384 16384
ReadX 12530 1792 14336 14336
ReadX 12533 2048 2048 2048
ReadX 12532 2048 2048 2048
WriteX 12530 1152 2048 2048
WriteX 12533 2048 2048 2048
WriteX 12532 2048 2048 2048
WriteX 12530 0 88 88
WriteX 12531 0 88 88
WriteX 12532 0 88 88
WriteX 12533 0 88 88
Close 12530
Close 12531
Close 12532
Close 12533
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12535
Close 12535
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12536
ReadX 12536 0 511 511
ReadX 12536 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12537
ReadX 12537 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12538
ReadX 12538 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12539
ReadX 12539 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12540
ReadX 12540 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12541
ReadX 12541 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12542
ReadX 12542 0 53 53
ReadX 12542 53 2 2
ReadX 12542 55 2 2
ReadX 12542 57 184 184
ReadX 12542 241 298 298
Close 12542
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12543
ReadX 12543 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12544
ReadX 12544 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12545
ReadX 12545 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12546
ReadX 12546 0 511 511
ReadX 12545 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12547
ReadX 12547 0 53 53
ReadX 12547 53 2 2
ReadX 12547 55 480 480
ReadX 12547 535 2 2
Close 12547
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12548
ReadX 12548 0 41 41
ReadX 12536 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12549
QUERY_FILE_INFORMATION 12549
QUERY_FILE_INFORMATION 12549
ReadX 12549 0 8192 8192
Close 12549
ReadX 12536 1152 2048 2048
ReadX 12536 4096 16384 16384
Close 12543
Close 12544
Close 12545
Close 12546
Close 12548
Close 12536
Close 12537
Close 12540
Close 12541
Close 12538
Close 12539
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12550
Close 12550
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12551
QUERY_FILE_INFORMATION 12551
ReadX 12551 0 64 64
ReadX 12551 144 64 64
ReadX 12551 224 156 156
ReadX 12551 1193 128 128
ReadX 12551 1201 128 128
ReadX 12551 1072 4 4
ReadX 12551 1076 1925 1925
ReadX 12551 758 4 4
ReadX 12551 762 4557 4557
ReadX 12551 1052 4 4
ReadX 12551 1056 314 314
ReadX 12551 1056 11056 11056
Close 12551
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12552
ReadX 12552 0 511 511
ReadX 12552 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12553
ReadX 12553 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12554
ReadX 12554 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12555
ReadX 12555 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12556
ReadX 12556 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12557
ReadX 12557 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12558
ReadX 12558 0 53 53
ReadX 12558 53 2 2
ReadX 12558 55 2 2
ReadX 12558 57 184 184
ReadX 12558 241 298 298
Close 12558
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12559
ReadX 12559 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12560
ReadX 12560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12561
ReadX 12561 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12562
ReadX 12562 0 511 511
ReadX 12561 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12563
ReadX 12563 0 53 53
ReadX 12563 53 2 2
ReadX 12563 55 480 480
ReadX 12563 535 2 2
Close 12563
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12564
ReadX 12564 0 41 41
ReadX 12552 2048 2048 2048
ReadX 12553 2048 2048 2048
ReadX 12552 1144 2048 2048
ReadX 12552 1152 2048 2048
ReadX 12552 4096 16384 16384
WriteX 12552 2048 2048 2048
WriteX 12553 2048 2048 2048
WriteX 12552 0 88 88
WriteX 12553 0 88 88
Close 12559
Close 12560
Close 12561
Close 12562
Close 12564
Close 12552
Close 12553
Close 12556
Close 12557
Close 12554
Close 12555
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12565
Close 12565
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12566
QUERY_FILE_INFORMATION 12566
ReadX 12566 0 64 64
ReadX 12566 144 64 64
ReadX 12566 224 84 84
ReadX 12566 478 16 16
ReadX 12566 1056 6176 6176
Close 12566
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12567
ReadX 12567 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12568
ReadX 12568 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12569
ReadX 12569 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12570
ReadX 12570 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12571
ReadX 12571 0 53 53
ReadX 12571 53 28 28
ReadX 12571 81 28 28
ReadX 12571 109 28 28
ReadX 12571 137 28 28
ReadX 12571 165 28 28
ReadX 12571 193 28 28
ReadX 12571 221 28 28
ReadX 12571 249 4 4
ReadX 12571 253 4 4
ReadX 12571 257 4 4
ReadX 12571 261 28 28
ReadX 12571 289 2 2
ReadX 12571 291 2 2
ReadX 12571 293 2 2
Close 12571
ReadX 12567 2048 2048 2048
ReadX 12568 2048 2048 2048
ReadX 12567 1280 2048 2048
ReadX 12570 2048 2048 2048
ReadX 12569 2048 2048 2048
WriteX 12567 1280 2048 2048
WriteX 12570 2048 2048 2048
WriteX 12569 2048 2048 2048
WriteX 12568 2048 2048 2048
WriteX 12567 0 88 88
WriteX 12568 0 88 88
WriteX 12569 0 88 88
WriteX 12570 0 88 88
WriteX 12567 1280 2048 2048
WriteX 12570 2048 2048 2048
WriteX 12569 2048 2048 2048
WriteX 12568 2048 2048 2048
WriteX 12567 0 88 88
WriteX 12568 0 88 88
WriteX 12569 0 88 88
WriteX 12570 0 88 88
WriteX 12567 1280 2048 2048
WriteX 12570 2048 2048 2048
WriteX 12569 2048 2048 2048
WriteX 12568 2048 2048 2048
WriteX 12567 0 88 88
WriteX 12568 0 88 88
WriteX 12569 0 88 88
WriteX 12570 0 88 88
Close 12567
Close 12568
Close 12569
Close 12570
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12572
ReadX 12572 0 511 511
ReadX 12572 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12573
ReadX 12573 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12574
ReadX 12574 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12575
ReadX 12575 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12576
ReadX 12576 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12577
ReadX 12577 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12578
ReadX 12578 0 53 53
ReadX 12578 53 2 2
ReadX 12578 55 2 2
ReadX 12578 57 184 184
ReadX 12578 241 298 298
Close 12578
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12579
ReadX 12579 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12580
ReadX 12580 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12581
ReadX 12581 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12582
ReadX 12582 0 511 511
ReadX 12581 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12583
ReadX 12583 0 53 53
ReadX 12583 53 2 2
ReadX 12583 55 480 480
ReadX 12583 535 2 2
Close 12583
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12584
ReadX 12584 0 41 41
ReadX 12572 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12588
FIND_FIRST \clients\client1\~dmtmp\*
Close 12588
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12589
QUERY_FILE_INFORMATION 12589
WriteX 12589 2047 1 1
QUERY_FILE_INFORMATION 12589
WriteX 12589 0 2048 2048
Close 12589
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12590
ReadX 12590 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12590 4095 1 1
QUERY_FILE_INFORMATION 12590
WriteX 12590 2048 2048 2048
WriteX 12590 0 88 88
Close 12590
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12591
ReadX 12591 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12591 2048 2048 2048
Close 12579
Close 12580
Close 12581
Close 12582
Close 12584
Close 12572
Close 12573
Close 12576
Close 12577
Close 12574
Close 12575
WriteX 12591 2048 2048 2048
WriteX 12591 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12592
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12592 0 511 511
ReadX 12592 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12593
ReadX 12593 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12594
ReadX 12594 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12595
ReadX 12595 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12596
ReadX 12596 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12597
ReadX 12597 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12598
ReadX 12598 0 53 53
ReadX 12598 53 2 2
ReadX 12598 55 2 2
ReadX 12598 57 184 184
ReadX 12598 241 298 298
Close 12598
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12599
ReadX 12599 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12600
ReadX 12600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12601
ReadX 12601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12602
ReadX 12602 0 511 511
ReadX 12601 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12603
ReadX 12603 0 53 53
ReadX 12603 53 2 2
ReadX 12603 55 480 480
ReadX 12603 535 2 2
Close 12603
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12604
ReadX 12604 0 41 41
ReadX 12592 2048 2048 2048
ReadX 12592 1152 2048 2048
ReadX 12592 4096 16384 16384
ReadX 12592 1280 16384 16384
ReadX 12592 2304 16384 16384
ReadX 12592 3328 16384 16384
ReadX 12592 272 16384 16384
ReadX 12592 336 16384 16384
ReadX 12592 400 16384 16384
ReadX 12592 464 16384 16384
ReadX 12592 528 16384 16384
ReadX 12592 592 16384 16384
ReadX 12592 656 16384 16384
ReadX 12592 720 16384 16384
ReadX 12592 784 16384 16384
ReadX 12592 848 16384 16384
ReadX 12592 912 16384 16384
ReadX 12592 976 16384 16384
ReadX 12592 1040 16384 16384
ReadX 12592 1104 12288 12288
Close 12599
Close 12600
Close 12601
Close 12602
Close 12604
Close 12592
Close 12593
Close 12596
Close 12597
Close 12594
Close 12595
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12605
FIND_FIRST \clients\client1\~dmtmp\*
Close 12605
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12606
QUERY_FILE_INFORMATION 12606
WriteX 12606 0 2048 2048
WriteX 12606 2048 4096 4096
WriteX 12606 0 88 88
Close 12606
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12607
ReadX 12607 0 511 511
ReadX 12607 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12607
WriteX 12591 2048 2048 2048
WriteX 12591 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12608
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12608 0 511 511
ReadX 12608 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12609
ReadX 12609 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12610
ReadX 12610 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12611
ReadX 12611 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12612
ReadX 12612 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12613
ReadX 12613 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12614
ReadX 12614 0 53 53
ReadX 12614 53 2 2
ReadX 12614 55 2 2
ReadX 12614 57 184 184
ReadX 12614 241 298 298
Close 12614
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12615
ReadX 12615 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12616
ReadX 12616 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12617
ReadX 12617 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12618
ReadX 12618 0 511 511
ReadX 12617 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12619
ReadX 12619 0 53 53
ReadX 12619 53 2 2
ReadX 12619 55 480 480
ReadX 12619 535 2 2
Close 12619
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12620
ReadX 12620 0 41 41
ReadX 12608 2048 2048 2048
ReadX 12608 1152 2048 2048
ReadX 12608 4096 16384 16384
ReadX 12608 1280 16384 16384
ReadX 12608 2304 16384 16384
ReadX 12608 3328 16384 16384
ReadX 12608 272 16384 16384
ReadX 12608 336 16384 16384
ReadX 12608 400 16384 16384
ReadX 12608 464 16384 16384
ReadX 12608 528 16384 16384
ReadX 12608 592 16384 16384
ReadX 12608 656 16384 16384
ReadX 12608 720 16384 16384
ReadX 12608 784 16384 16384
ReadX 12608 848 16384 16384
ReadX 12608 912 16384 16384
ReadX 12608 976 16384 16384
ReadX 12608 1040 16384 16384
ReadX 12608 1104 12288 12288
Close 12615
Close 12616
Close 12617
Close 12618
Close 12620
Close 12608
Close 12609
Close 12612
Close 12613
Close 12610
Close 12611
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12621
FIND_FIRST \clients\client1\~dmtmp\*
Close 12621
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12622
QUERY_FILE_INFORMATION 12622
WriteX 12622 0 2048 2048
WriteX 12622 2048 4096 4096
WriteX 12622 0 88 88
Close 12622
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12623
ReadX 12623 0 511 511
ReadX 12623 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12623
Close 12591
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12624
QUERY_FILE_INFORMATION 12624
Close 12624
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12625
Close 12625
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12626
QUERY_FILE_INFORMATION 12626
ReadX 12626 0 64 64
ReadX 12626 144 64 64
ReadX 12626 224 156 156
ReadX 12626 1193 128 128
ReadX 12626 1201 128 128
ReadX 12626 1072 4 4
ReadX 12626 1076 1925 1925
ReadX 12626 758 4 4
ReadX 12626 762 4557 4557
ReadX 12626 1052 4 4
ReadX 12626 1056 314 314
ReadX 12626 1056 11056 11056
Close 12626
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12627
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12627 0 511 511
ReadX 12627 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12628
ReadX 12628 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12629
ReadX 12629 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12630
ReadX 12630 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12631
ReadX 12631 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12632
ReadX 12632 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12633
ReadX 12633 0 53 53
ReadX 12633 53 2 2
ReadX 12633 55 2 2
ReadX 12633 57 184 184
ReadX 12633 241 298 298
Close 12633
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12634
ReadX 12634 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12635
ReadX 12635 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12636
ReadX 12636 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12637
ReadX 12637 0 511 511
ReadX 12636 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12638
ReadX 12638 0 53 53
ReadX 12638 53 2 2
ReadX 12638 55 480 480
ReadX 12638 535 2 2
Close 12638
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12639
ReadX 12639 0 41 41
ReadX 12627 2048 2048 2048
ReadX 12627 1152 2048 2048
ReadX 12627 4096 16384 16384
Close 12634
Close 12635
Close 12636
Close 12637
Close 12639
Close 12627
Close 12628
Close 12631
Close 12632
Close 12629
Close 12630
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12640
ReadX 12640 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12641
ReadX 12641 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12642
ReadX 12642 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12643
ReadX 12643 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12644
ReadX 12644 0 53 53
ReadX 12644 53 2 2
ReadX 12644 55 480 480
ReadX 12644 535 2 2
Close 12644
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12645
ReadX 12645 0 511 511
ReadX 12645 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12646
ReadX 12646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12647
ReadX 12647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12648
ReadX 12648 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12649
ReadX 12649 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12650
ReadX 12650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12651
ReadX 12651 0 41 41
ReadX 12645 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12652
ReadX 12652 0 53 53
ReadX 12652 53 2 2
ReadX 12652 55 2 2
ReadX 12652 57 184 184
ReadX 12652 241 298 298
Close 12652
ReadX 12640 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12656
FIND_FIRST \clients\client1\~dmtmp\*
Close 12656
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12657
QUERY_FILE_INFORMATION 12657
WriteX 12657 2047 1 1
QUERY_FILE_INFORMATION 12657
WriteX 12657 0 2048 2048
Close 12657
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12658
ReadX 12658 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12658 4095 1 1
QUERY_FILE_INFORMATION 12658
WriteX 12658 2048 2048 2048
WriteX 12658 0 88 88
Close 12658
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12659
ReadX 12659 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12659 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12663
Close 12663
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12664
QUERY_FILE_INFORMATION 12664
WriteX 12664 2047 1 1
QUERY_FILE_INFORMATION 12664
WriteX 12664 0 2048 2048
Close 12664
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12665
ReadX 12665 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12665 4095 1 1
QUERY_FILE_INFORMATION 12665
WriteX 12665 2048 2048 2048
WriteX 12665 0 88 88
Close 12665
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12666
ReadX 12666 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12666 2048 2048 2048
Close 12651
Close 12645
Close 12646
Close 12649
Close 12650
Close 12647
Close 12648
Close 12640
Close 12641
Close 12642
Close 12643
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12667
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12667 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12668
ReadX 12668 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12669
ReadX 12669 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12670
ReadX 12670 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12671
ReadX 12671 0 53 53
ReadX 12671 53 2 2
ReadX 12671 55 480 480
ReadX 12671 535 2 2
Close 12671
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12672
ReadX 12672 0 511 511
ReadX 12672 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12673
ReadX 12673 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12674
ReadX 12674 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12675
ReadX 12675 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12676
ReadX 12676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12677
ReadX 12677 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12678
ReadX 12678 0 41 41
ReadX 12672 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12679
ReadX 12679 0 53 53
ReadX 12679 53 2 2
ReadX 12679 55 2 2
ReadX 12679 57 184 184
ReadX 12679 241 298 298
Close 12679
ReadX 12667 2048 2048 2048
ReadX 12667 384 16384 16384
ReadX 12667 1408 16384 16384
ReadX 12667 2560 16384 16384
ReadX 12667 3584 16384 16384
ReadX 12667 288 16384 16384
ReadX 12667 352 16384 16384
ReadX 12667 416 16384 16384
ReadX 12667 480 16384 16384
ReadX 12667 552 16384 16384
ReadX 12667 616 16384 16384
ReadX 12667 680 16384 16384
ReadX 12667 744 16384 16384
ReadX 12667 808 16384 16384
ReadX 12667 872 16384 16384
ReadX 12667 936 10240 10240
Close 12678
Close 12672
Close 12673
Close 12676
Close 12677
Close 12674
Close 12675
Close 12667
Close 12668
Close 12669
Close 12670
Close 12659
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12680
QUERY_FILE_INFORMATION 12680
Close 12680
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12666
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12681
QUERY_FILE_INFORMATION 12681
Close 12681
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12682
ReadX 12682 0 65471 65471
ReadX 12682 65471 63 63
ReadX 12682 65534 65471 65471
ReadX 12682 131005 63 63
ReadX 12682 131068 65471 65471
ReadX 12682 196539 63 63
ReadX 12682 196602 65471 65471
ReadX 12682 262073 63 63
ReadX 12682 262136 65471 65471
ReadX 12682 327607 63 63
ReadX 12682 327670 10 10
Close 12682
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12683
ReadX 12683 0 65471 65471
ReadX 12683 65471 63 63
ReadX 12683 65534 65471 65471
ReadX 12683 131005 63 63
ReadX 12683 131068 65471 65471
ReadX 12683 196539 63 63
ReadX 12683 196602 65471 65471
ReadX 12683 262073 63 63
ReadX 12683 262136 65471 65471
ReadX 12683 327607 63 63
ReadX 12683 327670 65471 65471
ReadX 12683 393141 63 63
ReadX 12683 393204 65471 65471
ReadX 12683 458675 63 63
ReadX 12683 458738 65471 65471
ReadX 12683 524209 63 63
ReadX 12683 524272 65471 65471
ReadX 12683 589743 63 63
ReadX 12683 589806 65471 65471
ReadX 12683 655277 63 63
ReadX 12683 655340 32 32
Close 12683
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12684
ReadX 12684 0 65471 65471
ReadX 12684 65471 63 63
ReadX 12684 65534 65471 65471
ReadX 12684 131005 63 63
ReadX 12684 131068 65471 65471
ReadX 12684 196539 63 63
ReadX 12684 196602 65471 65471
ReadX 12684 262073 63 63
ReadX 12684 262136 65471 65471
ReadX 12684 327607 63 63
ReadX 12684 327670 65471 65471
ReadX 12684 393141 63 63
ReadX 12684 393204 65471 65471
ReadX 12684 458675 63 63
ReadX 12684 458738 65471 65471
ReadX 12684 524209 63 63
ReadX 12684 524272 65471 65471
ReadX 12684 589743 63 63
ReadX 12684 589806 65471 65471
ReadX 12684 655277 63 63
ReadX 12684 655340 65471 65471
ReadX 12684 720811 63 63
ReadX 12684 720874 65471 65471
ReadX 12684 786345 63 63
ReadX 12684 786408 65471 65471
ReadX 12684 851879 63 63
ReadX 12684 851942 65471 65471
ReadX 12684 917413 63 63
ReadX 12684 917476 65471 65471
ReadX 12684 982947 63 63
ReadX 12684 983010 65471 65471
ReadX 12684 1048481 63 63
ReadX 12684 1048544 65471 65471
ReadX 12684 1114015 63 63
ReadX 12684 1114078 65471 65471
ReadX 12684 1179549 63 63
ReadX 12684 1179612 65471 65471
ReadX 12684 1245083 63 63
ReadX 12684 1245146 65471 65471
ReadX 12684 1310617 63 63
ReadX 12684 1310680 65471 65471
ReadX 12684 1376151 63 63
ReadX 12684 1376214 65471 65471
ReadX 12684 1441685 63 63
ReadX 12684 1441748 65471 65471
ReadX 12684 1507219 63 63
ReadX 12684 1507282 65471 65471
ReadX 12684 1572753 63 63
ReadX 12684 1572816 65471 65471
ReadX 12684 1638287 63 63
ReadX 12684 1638350 65471 65471
ReadX 12684 1703821 63 63
ReadX 12684 1703884 65471 65471
ReadX 12684 1769355 63 63
ReadX 12684 1769418 65471 65471
ReadX 12684 1834889 63 63
ReadX 12684 1834952 32824 32824
Close 12684
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12685
QUERY_FILE_INFORMATION 12685
ReadX 12685 0 512 512
ReadX 12685 512 512 512
ReadX 12685 1024 512 512
QUERY_FILE_INFORMATION 12685
QUERY_FILE_INFORMATION 12685
ReadX 12685 2560 2048 2048
ReadX 12685 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 12686
WriteX 12686 52 1 1
QUERY_FILE_INFORMATION 12686
WriteX 12686 0 53 53
Close 12686
ReadX 12685 2208 650 650
ReadX 12685 1920 2048 2048
ReadX 12685 2112 2048 2048
ReadX 12685 1856 2048 2048
ReadX 12685 1824 2048 2048
ReadX 12685 1536 512 512
ReadX 12685 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12687
Close 12687
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12685 1568 512 512
ReadX 12685 1536 512 512
ReadX 12685 2176 384 384
ReadX 12685 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12688
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12685 288 2048 2048
ReadX 12685 2336 2048 2048
ReadX 12685 4384 2048 2048
ReadX 12685 6432 2048 2048
ReadX 12685 8480 2048 2048
ReadX 12685 10528 2048 2048
ReadX 12685 12576 2048 2048
WriteX 12688 15359 1 1
QUERY_FILE_INFORMATION 12688
ReadX 12685 14624 2048 2048
ReadX 12685 16672 2048 2048
ReadX 12685 18720 2048 2048
ReadX 12685 1728 2048 2048
WriteX 12688 0 15360 15360
Close 12688
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 12689
QUERY_FILE_INFORMATION 12689
ReadX 12689 0 512 512
ReadX 12689 2048 512 512
ReadX 12689 2560 512 512
QUERY_FILE_INFORMATION 12689
QUERY_FILE_INFORMATION 12689
QUERY_FILE_INFORMATION 12689
QUERY_FILE_INFORMATION 12689
QUERY_FILE_INFORMATION 12689
WriteX 12689 2152 384 384
QUERY_FILE_INFORMATION 12689
WriteX 12689 2150 22 22
WriteX 12689 2144 106 106
QUERY_FILE_INFORMATION 12689
WriteX 12689 2176 496 496
ReadX 12689 2176 496 496
QUERY_FILE_INFORMATION 12689
WriteX 12689 2440 384 384
QUERY_FILE_INFORMATION 12689
WriteX 12689 2152 384 384
WriteX 12689 2432 112 112
QUERY_FILE_INFORMATION 12689
WriteX 12689 2439 16 16
QUERY_FILE_INFORMATION 12689
WriteX 12689 2208 220 220
ReadX 12689 2208 220 220
QUERY_FILE_INFORMATION 12689
QUERY_FILE_INFORMATION 12689
WriteX 12689 2440 220 220
QUERY_FILE_INFORMATION 12689
WriteX 12689 2453 36 36
WriteX 12689 2080 512 512
WriteX 12689 2176 512 512
WriteX 12689 2112 512 512
WriteX 12689 2048 512 512
WriteX 12689 0 512 512
QUERY_FILE_INFORMATION 12685
QUERY_FILE_INFORMATION 12685
WriteX 12689 2080 512 512
Close 12689
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 12690
Close 12690
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12691
QUERY_FILE_INFORMATION 12691
ReadX 12691 0 512 512
ReadX 12691 2048 512 512
ReadX 12691 2560 512 512
QUERY_FILE_INFORMATION 12691
QUERY_FILE_INFORMATION 12691
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 12692
Close 12692
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 12685
ReadX 12691 1408 512 512
ReadX 12691 2048 512 512
ReadX 12691 1536 512 512
ReadX 12691 2560 512 512
ReadX 12691 3072 512 512
ReadX 12691 3584 512 512
ReadX 12691 4096 512 512
ReadX 12691 4608 512 512
ReadX 12691 5120 512 512
ReadX 12691 5632 512 512
ReadX 12691 6144 512 512
ReadX 12691 6656 512 512
ReadX 12691 7168 512 512
ReadX 12691 7680 512 512
ReadX 12691 8192 512 512
ReadX 12691 8704 512 512
ReadX 12691 9216 512 512
ReadX 12691 9728 512 512
ReadX 12691 10240 512 512
ReadX 12691 10752 512 512
ReadX 12691 11264 512 512
ReadX 12691 11776 512 512
ReadX 12691 12288 512 512
ReadX 12691 12800 512 512
ReadX 12691 13312 512 512
ReadX 12691 13824 512 512
ReadX 12691 14336 512 512
ReadX 12691 14848 512 512
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 15360 512 0
ReadX 12691 2560 2048 2048
ReadX 12691 4608 2048 2048
ReadX 12691 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12693
QUERY_FILE_INFORMATION 12693
ReadX 12693 0 512 512
ReadX 12693 512 512 512
ReadX 12693 1024 512 512
QUERY_FILE_INFORMATION 12693
QUERY_FILE_INFORMATION 12693
ReadX 12693 352 2048 2048
ReadX 12693 608 1097 1097
ReadX 12693 576 1609 1609
ReadX 12693 4096 512 512
ReadX 12693 1536 512 512
ReadX 12693 3840 256 256
ReadX 12693 288 576 576
ReadX 12693 512 512 512
ReadX 12693 480 512 512
ReadX 12693 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12694
ReadX 12694 0 4096 4096
ReadX 12694 4096 4096 4096
ReadX 12694 8192 4096 4096
Close 12693
Close 12694
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12695
WriteX 12695 15359 1 1
QUERY_FILE_INFORMATION 12695
WriteX 12695 0 15360 15360
Close 12695
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 12696
QUERY_FILE_INFORMATION 12696
ReadX 12696 0 512 512
ReadX 12696 2048 512 512
ReadX 12696 2560 512 512
QUERY_FILE_INFORMATION 12696
QUERY_FILE_INFORMATION 12696
QUERY_FILE_INFORMATION 12696
QUERY_FILE_INFORMATION 12696
QUERY_FILE_INFORMATION 12696
WriteX 12696 2152 384 384
QUERY_FILE_INFORMATION 12696
WriteX 12696 2150 22 22
WriteX 12696 2144 106 106
QUERY_FILE_INFORMATION 12696
WriteX 12696 2176 476 476
ReadX 12696 2176 476 476
QUERY_FILE_INFORMATION 12696
WriteX 12696 2440 384 384
QUERY_FILE_INFORMATION 12696
WriteX 12696 2152 384 384
WriteX 12696 2432 92 92
QUERY_FILE_INFORMATION 12696
WriteX 12696 2437 36 36
QUERY_FILE_INFORMATION 12696
WriteX 12696 2208 220 220
ReadX 12696 2208 220 220
QUERY_FILE_INFORMATION 12696
QUERY_FILE_INFORMATION 12696
WriteX 12696 2440 220 220
QUERY_FILE_INFORMATION 12696
WriteX 12696 2453 36 36
WriteX 12696 2080 512 512
WriteX 12696 2176 512 512
WriteX 12696 2112 512 512
WriteX 12696 2048 512 512
WriteX 12696 0 512 512
QUERY_FILE_INFORMATION 12691
QUERY_FILE_INFORMATION 12691
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 12691
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12697
Close 12697
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12698
QUERY_FILE_INFORMATION 12698
ReadX 12698 0 512 512
ReadX 12698 2048 512 512
ReadX 12698 2560 512 512
QUERY_FILE_INFORMATION 12698
QUERY_FILE_INFORMATION 12698
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 12699
Close 12699
WriteX 12696 2080 512 512
Close 12696
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 12700
Close 12700
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12701
QUERY_FILE_INFORMATION 12701
ReadX 12701 0 512 512
ReadX 12701 2048 512 512
ReadX 12701 2560 512 512
QUERY_FILE_INFORMATION 12701
QUERY_FILE_INFORMATION 12701
ReadX 12701 1312 512 512
ReadX 12701 1536 512 512
ReadX 12701 2048 512 512
ReadX 12701 576 512 512
ReadX 12701 1088 512 512
ReadX 12701 1056 512 512
ReadX 12701 1120 512 512
ReadX 12701 1184 512 512
ReadX 12701 2560 2048 2048
ReadX 12701 4608 2048 2048
ReadX 12701 6656 2048 2048
ReadX 12701 8704 2048 2048
ReadX 12701 10752 2048 2048
ReadX 12701 12800 2048 2048
ReadX 12701 14848 2048 512
ReadX 12701 15360 1536 0
ReadX 12701 1088 2048 2048
ReadX 12701 3136 2048 2048
ReadX 12701 1665 5835 5835
ReadX 12701 1856 2048 2048
ReadX 12701 2112 512 512
ReadX 12701 2152 384 384
ReadX 12701 2432 92 92
ReadX 12701 2176 512 512
ReadX 12701 2440 220 220
QUERY_FILE_INFORMATION 12701
QUERY_FILE_INFORMATION 12701
ReadX 12701 2432 512 512
WriteX 12701 2272 512 512
ReadX 12701 2144 512 512
WriteX 12701 2304 512 512
WriteX 12701 2272 92 92
WriteX 12701 2208 512 512
WriteX 12701 2720 512 512
WriteX 12701 0 512 512
QUERY_FILE_INFORMATION 12701
QUERY_FILE_INFORMATION 12701
ReadX 12701 1312 4096 4096
ReadX 12701 5408 4096 4096
ReadX 12701 9504 3305 3305
ReadX 12701 512 4096 4096
QUERY_FILE_INFORMATION 12701
QUERY_FILE_INFORMATION 12701
QUERY_FILE_INFORMATION 12701
WriteX 12701 3132 50 50
WriteX 12701 3182 4096 4096
WriteX 12701 7278 4096 4096
WriteX 12701 15469 1 1
QUERY_FILE_INFORMATION 12701
WriteX 12701 11374 4096 4096
WriteX 12701 15470 3584 3584
WriteX 12701 2144 512 512
WriteX 12701 2336 4096 4096
WriteX 12701 6432 4096 4096
WriteX 12701 10528 4096 4096
WriteX 12701 14624 462 462
WriteX 12701 2048 512 512
WriteX 12701 2560 512 512
WriteX 12701 0 512 512
QUERY_FILE_INFORMATION 12701
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12702
QUERY_FILE_INFORMATION 12702
ReadX 12702 0 512 512
ReadX 12702 1152 512 512
ReadX 12702 1664 512 512
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
ReadX 12702 512 2048 2048
ReadX 12702 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 12703
WriteX 12703 52 1 1
QUERY_FILE_INFORMATION 12703
WriteX 12703 0 53 53
Close 12703
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
ReadX 12702 1120 504 504
ReadX 12702 896 2048 2048
ReadX 12702 1056 1528 1528
ReadX 12702 864 2048 2048
ReadX 12702 832 2048 2048
ReadX 12702 736 2048 2048
ReadX 12702 1216 512 512
ReadX 12702 1256 384 384
ReadX 12702 1536 140 140
ReadX 12702 1280 512 512
ReadX 12702 1548 252 252
ReadX 12701 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12704
Close 12704
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12705
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12702 2560 2048 2048
ReadX 12702 4608 2048 2048
ReadX 12702 6656 2048 2048
ReadX 12702 8704 2048 2048
ReadX 12702 10752 2048 2048
WriteX 12705 12005 1 1
QUERY_FILE_INFORMATION 12705
WriteX 12705 0 12006 12006
Close 12705
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 12706
QUERY_FILE_INFORMATION 12706
ReadX 12706 0 512 512
ReadX 12706 1152 512 512
ReadX 12706 1664 512 512
QUERY_FILE_INFORMATION 12706
QUERY_FILE_INFORMATION 12706
QUERY_FILE_INFORMATION 12706
QUERY_FILE_INFORMATION 12706
QUERY_FILE_INFORMATION 12706
QUERY_FILE_INFORMATION 12706
QUERY_FILE_INFORMATION 12706
WriteX 12706 1256 384 384
QUERY_FILE_INFORMATION 12706
WriteX 12706 1254 22 22
WriteX 12706 1248 106 106
QUERY_FILE_INFORMATION 12706
WriteX 12706 1280 508 508
ReadX 12706 1280 508 508
QUERY_FILE_INFORMATION 12706
WriteX 12706 1544 384 384
QUERY_FILE_INFORMATION 12706
WriteX 12706 1256 384 384
WriteX 12706 1536 124 124
QUERY_FILE_INFORMATION 12706
WriteX 12706 1543 4 4
QUERY_FILE_INFORMATION 12706
WriteX 12706 1312 252 252
ReadX 12706 1312 252 252
QUERY_FILE_INFORMATION 12706
QUERY_FILE_INFORMATION 12706
WriteX 12706 1544 252 252
QUERY_FILE_INFORMATION 12706
WriteX 12706 1559 4 4
WriteX 12706 1184 512 512
WriteX 12706 1280 512 512
WriteX 12706 1216 512 512
WriteX 12706 1152 512 512
WriteX 12706 0 512 512
QUERY_FILE_INFORMATION 12702
QUERY_FILE_INFORMATION 12702
WriteX 12706 1184 512 512
Close 12706
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 12707
Close 12707
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12708
QUERY_FILE_INFORMATION 12708
ReadX 12708 0 512 512
ReadX 12708 1152 512 512
ReadX 12708 1664 512 512
QUERY_FILE_INFORMATION 12708
QUERY_FILE_INFORMATION 12708
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 12709
Close 12709
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 12702
ReadX 12708 736 512 512
ReadX 12708 1536 2048 2048
ReadX 12708 3584 2048 2048
ReadX 12708 5632 2048 2048
ReadX 12708 7680 2048 2048
ReadX 12708 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12710
WriteX 12710 11990 1 1
QUERY_FILE_INFORMATION 12710
WriteX 12710 0 11991 11991
Close 12710
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 12711
QUERY_FILE_INFORMATION 12711
ReadX 12711 0 512 512
ReadX 12711 1184 512 512
ReadX 12711 1696 512 512
QUERY_FILE_INFORMATION 12711
QUERY_FILE_INFORMATION 12711
QUERY_FILE_INFORMATION 12711
QUERY_FILE_INFORMATION 12711
QUERY_FILE_INFORMATION 12711
QUERY_FILE_INFORMATION 12711
QUERY_FILE_INFORMATION 12711
WriteX 12711 1288 384 384
QUERY_FILE_INFORMATION 12711
WriteX 12711 1286 22 22
WriteX 12711 1280 106 106
QUERY_FILE_INFORMATION 12711
WriteX 12711 1312 508 508
ReadX 12711 1312 508 508
QUERY_FILE_INFORMATION 12711
WriteX 12711 1576 384 384
QUERY_FILE_INFORMATION 12711
WriteX 12711 1288 384 384
WriteX 12711 1568 124 124
QUERY_FILE_INFORMATION 12711
WriteX 12711 1575 4 4
QUERY_FILE_INFORMATION 12711
WriteX 12711 1344 252 252
ReadX 12711 1344 252 252
QUERY_FILE_INFORMATION 12711
QUERY_FILE_INFORMATION 12711
WriteX 12711 1576 252 252
QUERY_FILE_INFORMATION 12711
WriteX 12711 1591 4 4
WriteX 12711 1216 512 512
WriteX 12711 1312 512 512
WriteX 12711 1248 512 512
WriteX 12711 1184 512 512
WriteX 12711 0 512 512
QUERY_FILE_INFORMATION 12708
QUERY_FILE_INFORMATION 12708
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 12708
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12712
Close 12712
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12713
QUERY_FILE_INFORMATION 12713
ReadX 12713 0 512 512
ReadX 12713 1152 512 512
ReadX 12713 1664 512 512
QUERY_FILE_INFORMATION 12713
QUERY_FILE_INFORMATION 12713
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 12714
Close 12714
WriteX 12711 1216 512 512
Close 12711
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 12715
Close 12715
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12716
QUERY_FILE_INFORMATION 12716
ReadX 12716 0 512 512
ReadX 12716 1184 512 512
ReadX 12716 1696 512 512
QUERY_FILE_INFORMATION 12716
QUERY_FILE_INFORMATION 12716
ReadX 12716 1536 512 512
ReadX 12716 736 512 512
ReadX 12716 2048 512 512
ReadX 12716 2560 512 512
ReadX 12716 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12717
Close 12717
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 12716 914 3899 3899
ReadX 12716 1248 512 512
ReadX 12716 1288 384 384
ReadX 12716 1568 124 124
ReadX 12716 1312 512 512
ReadX 12716 1576 252 252
QUERY_FILE_INFORMATION 12716
QUERY_FILE_INFORMATION 12716
ReadX 12716 1568 512 512
WriteX 12716 1408 512 512
ReadX 12716 1280 512 512
WriteX 12716 1440 512 512
WriteX 12716 1408 124 124
WriteX 12716 1344 512 512
WriteX 12716 1856 512 512
WriteX 12716 0 512 512
QUERY_FILE_INFORMATION 12716
QUERY_FILE_INFORMATION 12716
ReadX 12716 544 4096 4096
ReadX 12716 4640 4096 4096
ReadX 12716 8736 1637 1637
ReadX 12716 512 4096 4096
QUERY_FILE_INFORMATION 12716
QUERY_FILE_INFORMATION 12716
WriteX 12716 1280 512 512
WriteX 12716 1472 3584 3584
WriteX 12716 5056 4096 4096
WriteX 12716 13247 1 1
QUERY_FILE_INFORMATION 12716
WriteX 12716 9152 4096 4096
WriteX 12716 13248 1736 1736
WriteX 12716 1184 512 512
WriteX 12716 1696 512 512
WriteX 12716 0 512 512
QUERY_FILE_INFORMATION 12716
ReadX 12716 1632 1024 1024
ReadX 12716 288 1024 1024
ReadX 12716 1312 2048 2048
ReadX 12716 3360 1024 1024
ReadX 12716 1696 1024 1024
ReadX 12716 2720 512 512
ReadX 12716 3232 512 512
ReadX 12716 3744 512 512
ReadX 12716 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12716 2066 3998 3998
ReadX 12716 1448 384 384
ReadX 12716 1408 124 124
ReadX 12716 1416 252 252
QUERY_FILE_INFORMATION 12716
QUERY_FILE_INFORMATION 12716
ReadX 12716 1408 512 512
WriteX 12716 1536 512 512
ReadX 12716 1440 512 512
WriteX 12716 2048 512 512
WriteX 12716 1536 124 124
WriteX 12716 512 512 512
WriteX 12716 1024 512 512
WriteX 12716 0 512 512
QUERY_FILE_INFORMATION 12716
ReadX 12716 1696 4096 4096
ReadX 12716 5792 4096 4096
ReadX 12716 9888 1736 1736
ReadX 12716 1280 512 512
ReadX 12716 1472 3584 3584
QUERY_FILE_INFORMATION 12716
QUERY_FILE_INFORMATION 12716
WriteX 12716 3940 156 156
WriteX 12716 4096 512 512
WriteX 12716 544 3584 3584
WriteX 12716 4128 4096 4096
WriteX 12716 8224 3584 3584
WriteX 12716 1344 512 512
WriteX 12716 1856 1536 1536
WriteX 12716 2336 512 512
WriteX 12716 3584 356 356
WriteX 12716 2560 512 512
WriteX 12716 3072 512 512
WriteX 12716 0 512 512
QUERY_FILE_INFORMATION 12716
Close 12698
Close 12701
Close 12716
Close 12713
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12718
Close 12718
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12719
Close 12719
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12720
WriteX 12720 0 65471 65471
WriteX 12720 65471 63 63
WriteX 12720 65534 65471 65471
WriteX 12720 131005 63 63
Close 12720
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12721
WriteX 12721 0 65471 65471
WriteX 12721 65471 63 63
WriteX 12721 65534 65471 65471
WriteX 12721 131005 63 63
WriteX 12721 131068 65471 65471
WriteX 12721 196539 63 63
WriteX 12721 196602 65471 65471
WriteX 12721 262073 63 63
Close 12721
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12722
WriteX 12722 0 65471 65471
WriteX 12722 65471 63 63
WriteX 12722 65534 65471 65471
WriteX 12722 131005 63 63
WriteX 12722 131068 65471 65471
WriteX 12722 196539 63 63
WriteX 12722 196602 65471 65471
WriteX 12722 262073 63 63
WriteX 12722 262136 65471 65471
WriteX 12722 327607 63 63
WriteX 12722 327670 65471 65471
WriteX 12722 393141 63 63
WriteX 12722 393204 65471 65471
WriteX 12722 458675 63 63
WriteX 12722 458738 65471 65471
WriteX 12722 524209 63 63
Close 12722
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12723
QUERY_FILE_INFORMATION 12723
QUERY_FILE_INFORMATION 12723
ReadX 12723 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 12724
Close 12724
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 12725
WriteX 12725 63 1 1
QUERY_FILE_INFORMATION 12725
WriteX 12725 0 64 64
ReadX 12723 992 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 344 2048 2048
ReadX 12723 1344 2048 2048
ReadX 12723 1352 2048 2048
ReadX 12723 1320 2048 2048
ReadX 12723 1360 2048 2048
ReadX 12723 1344 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2304 2048 2048
ReadX 12723 1472 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 1480 2048 2048
ReadX 12723 1488 2048 2048
ReadX 12723 1496 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 1504 2048 2048
ReadX 12723 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 1000 2048 2048
ReadX 12723 1416 2048 2048
ReadX 12723 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12723 360 2048 2048
ReadX 12723 368 2048 2048
ReadX 12723 360 2048 2048
ReadX 12723 376 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 1232 2048 2048
ReadX 12723 2432 6144 6144
ReadX 12723 2376 2048 2048
ReadX 12723 2360 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 2376 2048 2048
ReadX 12723 2384 2048 2048
ReadX 12723 2368 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 1296 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 12723 0 2048 2048
ReadX 12723 2688 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 2688 2048 2048
WriteX 12723 2688 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 2688 2048 2048
ReadX 12723 2688 2048 2048
ReadX 12723 2688 2048 2048
WriteX 12723 2688 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12723 2688 2048 2048
ReadX 12723 2688 2048 2048
WriteX 12723 2688 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 320 4096 4096
ReadX 12723 0 2048 2048
ReadX 12723 3584 2048 2048
ReadX 12723 3584 2048 2048
ReadX 12723 3584 2048 2048
ReadX 12723 0 2048 2048
WriteX 12723 3584 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2688 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 2688 2048 2048
ReadX 12723 2688 2048 2048
WriteX 12723 2688 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 3200 2048 2048
ReadX 12723 3200 2048 2048
ReadX 12723 3200 2048 2048
WriteX 12723 3200 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 3456 2048 2048
ReadX 12723 3456 2048 2048
ReadX 12723 3456 2048 2048
WriteX 12723 3456 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2496 2048 2048
ReadX 12723 2472 2048 2048
ReadX 12723 2456 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 2472 2048 2048
ReadX 12723 2480 2048 2048
ReadX 12723 2464 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 2488 2048 2048
ReadX 12723 2568 8192 8192
ReadX 12723 1000 2048 2048
ReadX 12723 328 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 2048 2048 2048
ReadX 12723 2560 2048 2048
ReadX 12723 920 2048 2048
WriteX 12723 2048 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 312 2048 2048
WriteX 12723 336 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 328 2048 2048
WriteX 12723 2560 2048 2048
WriteX 12723 3840 2048 2048
WriteX 12723 920 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2432 2048 2048
WriteX 12723 2432 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2456 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 328 2048 2048
ReadX 12723 2560 2048 2048
ReadX 12723 2048 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 336 2048 2048
ReadX 12723 920 2048 2048
WriteX 12723 1536 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 2048 2048 2048
WriteX 12723 2560 2048 2048
WriteX 12723 336 2048 2048
WriteX 12723 920 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2048 2048 2048
ReadX 12723 2432 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 2048 2048 2048
WriteX 12723 2432 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2456 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1536 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 336 2048 2048
ReadX 12723 920 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 1536 2048 2048
WriteX 12723 336 2048 2048
WriteX 12723 920 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2432 2048 2048
WriteX 12723 2432 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2456 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1536 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 336 2048 2048
ReadX 12723 920 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 1536 2048 2048
WriteX 12723 336 2048 2048
WriteX 12723 920 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2432 2048 2048
WriteX 12723 2432 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2456 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1536 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 336 2048 2048
ReadX 12723 920 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 1536 2048 2048
WriteX 12723 336 2048 2048
WriteX 12723 920 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2432 2048 2048
WriteX 12723 2432 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2456 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1536 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 336 2048 2048
ReadX 12723 920 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 1536 2048 2048
WriteX 12723 336 2048 2048
WriteX 12723 920 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2432 2048 2048
WriteX 12723 2432 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
Flush 12723
ReadX 12723 2456 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1536 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 336 2048 2048
ReadX 12723 920 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 1536 2048 2048
WriteX 12723 336 2048 2048
WriteX 12723 920 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2432 2048 2048
WriteX 12723 2432 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2624 6144 6144
ReadX 12723 2616 2048 2048
ReadX 12723 2688 2048 2048
ReadX 12723 2600 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 2616 2048 2048
ReadX 12723 2608 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 344 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 520 2048 2048
ReadX 12723 1392 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 400 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 536 2048 2048
ReadX 12723 824 2048 2048
ReadX 12723 832 2048 2048
ReadX 12723 384 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 408 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 552 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 824 2048 2048
ReadX 12723 840 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 768 2048 2048
ReadX 12723 2048 2048 2048
WriteX 12723 1415 1 1
WriteX 12723 352 2048 2048
WriteX 12723 1112 2048 2048
WriteX 12723 1400 2048 2048
WriteX 12723 1408 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 2048 2048 2048
WriteX 12723 768 2048 2048
WriteX 12723 344 2048 2048
WriteX 12723 1000 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 416 2048 2048
ReadX 12723 424 2048 2048
ReadX 12723 432 2048 2048
ReadX 12723 440 2048 2048
ReadX 12723 576 16384 16384
ReadX 12723 448 2048 2048
ReadX 12723 456 2048 2048
ReadX 12723 464 2048 2048
ReadX 12723 640 16384 16384
ReadX 12723 704 16384 16384
ReadX 12723 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 12723 848 2048 2048
ReadX 12723 560 2048 2048
ReadX 12723 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 2600 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 352 2048 2048
ReadX 12723 1928 8192 8192
ReadX 12723 528 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 824 2048 2048
ReadX 12723 0 2048 2048
Flush 12723
ReadX 12723 2600 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 352 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 824 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 856 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 392 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 472 2048 2048
ReadX 12723 480 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 488 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 928 2048 2048
ReadX 12723 936 2048 2048
ReadX 12723 976 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 392 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 952 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 528 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 528 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 816 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12723 1336 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 528 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 528 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1240 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2200 4096 4096
ReadX 12723 2152 2048 2048
ReadX 12723 2160 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1312 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 1928 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 824 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1416 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 352 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 824 2048 2048
ReadX 12723 384 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12723 352 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 768 2048 2048
ReadX 12723 2048 2048 2048
ReadX 12723 352 2048 2048
WriteX 12723 1551 1 1
WriteX 12723 1512 2048 2048
WriteX 12723 1520 2048 2048
WriteX 12723 1528 2048 2048
WriteX 12723 1544 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 2048 2048 2048
WriteX 12723 768 2048 2048
WriteX 12723 344 2048 2048
WriteX 12723 1000 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2048 2048 2048
WriteX 12723 2048 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 1000 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1240 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 344 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 384 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 768 2048 2048
WriteX 12723 1567 1 1
WriteX 12723 1552 2048 2048
WriteX 12723 1560 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 768 2048 2048
WriteX 12723 344 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 1328 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1240 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2200 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1240 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 344 2048 2048
ReadX 12723 384 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 2048 2048 2048
ReadX 12723 768 2048 2048
WriteX 12723 1583 1 1
WriteX 12723 1568 2048 2048
WriteX 12723 1576 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 2048 2048 2048
WriteX 12723 768 2048 2048
WriteX 12723 344 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 864 2048 2048
ReadX 12723 872 2048 2048
ReadX 12723 912 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 2688 2048 2048
ReadX 12723 1000 2048 2048
WriteX 12723 2688 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 2944 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 0 2048 2048
Flush 12723
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 2688 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 2688 2048 2048
WriteX 12723 2688 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 392 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 416 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 416 2048 2048
ReadX 12723 864 2048 2048
ReadX 12723 872 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 312 2048 2048
ReadX 12723 888 2048 2048
ReadX 12723 400 2048 2048
ReadX 12723 896 2048 2048
WriteX 12723 1584 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 400 2048 2048
WriteX 12723 416 2048 2048
WriteX 12723 864 2048 2048
WriteX 12723 872 2048 2048
WriteX 12723 888 2048 2048
WriteX 12723 896 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 584 2048 2048
ReadX 12723 392 2048 2048
WriteX 12723 392 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 1328 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 0 2048 2048
ReadX 12723 408 2048 2048
ReadX 12723 1328 2048 2048
ReadX 12723 864 2048 2048
ReadX 12723 912 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 3840 2048 2048
ReadX 12723 312 2048 2048
ReadX 12723 1584 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 408 2048 2048
WriteX 12723 912 2048 2048
WriteX 12723 1584 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 408 2048 2048
ReadX 12723 392 2048 2048
WriteX 12723 392 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 528 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 528 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 552 2048 2048
ReadX 12723 1336 2048 2048
WriteX 12723 552 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 0 2048 2048
ReadX 12723 552 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 2664 2048 2048
ReadX 12723 2648 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 2672 2048 2048
ReadX 12723 2656 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12723 528 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 1336 2048 2048
ReadX 12723 2680 2048 2048
ReadX 12723 2760 8192 8192
ReadX 12723 544 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 568 2048 2048
ReadX 12723 544 2048 2048
ReadX 12723 0 2048 2048
Flush 12723
ReadX 12723 2816 6144 6144
ReadX 12723 2760 2048 2048
ReadX 12723 2744 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 2752 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 528 2048 2048
ReadX 12723 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12727
Close 12727
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12729
WriteX 12729 4065 1 1
QUERY_FILE_INFORMATION 12729
WriteX 12729 0 62591 62591
Close 12729
ReadX 12723 0 2048 2048
ReadX 12723 2808 2048 2048
ReadX 12723 2792 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 2800 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 384 2048 2048
ReadX 12723 392 2048 2048
ReadX 12723 1384 2048 2048
ReadX 12723 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12731
Close 12731
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12733
WriteX 12733 4094 1 1
QUERY_FILE_INFORMATION 12733
WriteX 12733 0 10845 10845
Close 12733
ReadX 12723 1432 2048 2048
ReadX 12723 1304 2048 2048
ReadX 12723 1368 2048 2048
ReadX 12723 2304 2048 2048
ReadX 12723 1440 2048 2048
ReadX 12723 1424 2048 2048
ReadX 12723 1448 2048 2048
ReadX 12723 1456 2048 2048
ReadX 12723 2432 2048 2048
ReadX 12723 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12735
Close 12735
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12737
ReadX 12723 0 2048 2048
WriteX 12737 4081 1 1
QUERY_FILE_INFORMATION 12737
WriteX 12737 0 30118 30118
Close 12737
ReadX 12723 1344 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1152 2048 2048
ReadX 12723 1152 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 1000 2048 2048
ReadX 12723 768 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 344 2048 2048
WriteX 12723 1000 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 1416 2048 2048
ReadX 12723 1416 2048 2048
ReadX 12723 344 2048 2048
ReadX 12723 896 2048 2048
WriteX 12723 1538 2 2
WriteX 12723 344 2048 2048
WriteX 12723 1416 2048 2048
WriteX 12723 1538 2 2
ReadX 12723 2048 2048 2048
WriteX 12723 2048 2048 2048
WriteX 12723 1538 2 2
Close 12723
Close 12725
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12738
ReadX 12738 0 65471 65471
ReadX 12738 65471 63 63
ReadX 12738 65534 65471 65471
ReadX 12738 131005 63 63
ReadX 12738 131068 65471 65471
ReadX 12738 196539 63 63
ReadX 12738 196602 65471 65471
ReadX 12738 262073 63 63
ReadX 12738 262136 65471 65471
ReadX 12738 327607 63 63
ReadX 12738 327670 10 10
Close 12738
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12739
ReadX 12739 0 65471 65471
ReadX 12739 65471 63 63
ReadX 12739 65534 65471 65471
ReadX 12739 131005 63 63
ReadX 12739 131068 65471 65471
ReadX 12739 196539 63 63
ReadX 12739 196602 65471 65471
ReadX 12739 262073 63 63
ReadX 12739 262136 65471 65471
ReadX 12739 327607 63 63
ReadX 12739 327670 65471 65471
ReadX 12739 393141 63 63
ReadX 12739 393204 65471 65471
ReadX 12739 458675 63 63
ReadX 12739 458738 65471 65471
ReadX 12739 524209 63 63
ReadX 12739 524272 65471 65471
ReadX 12739 589743 63 63
ReadX 12739 589806 65471 65471
ReadX 12739 655277 63 63
ReadX 12739 655340 32 32
Close 12739
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12740
ReadX 12740 0 65471 65471
ReadX 12740 65471 63 63
ReadX 12740 65534 65471 65471
ReadX 12740 131005 63 63
ReadX 12740 131068 65471 65471
ReadX 12740 196539 63 63
ReadX 12740 196602 65471 65471
ReadX 12740 262073 63 63
ReadX 12740 262136 65471 65471
ReadX 12740 327607 63 63
ReadX 12740 327670 65471 65471
ReadX 12740 393141 63 63
ReadX 12740 393204 65471 65471
ReadX 12740 458675 63 63
ReadX 12740 458738 65471 65471
ReadX 12740 524209 63 63
ReadX 12740 524272 65471 65471
ReadX 12740 589743 63 63
ReadX 12740 589806 65471 65471
ReadX 12740 655277 63 63
ReadX 12740 655340 65471 65471
ReadX 12740 720811 63 63
ReadX 12740 720874 65471 65471
ReadX 12740 786345 63 63
ReadX 12740 786408 65471 65471
ReadX 12740 851879 63 63
ReadX 12740 851942 65471 65471
ReadX 12740 917413 63 63
ReadX 12740 917476 65471 65471
ReadX 12740 982947 63 63
ReadX 12740 983010 65471 65471
ReadX 12740 1048481 63 63
ReadX 12740 1048544 65471 65471
ReadX 12740 1114015 63 63
ReadX 12740 1114078 65471 65471
ReadX 12740 1179549 63 63
ReadX 12740 1179612 65471 65471
ReadX 12740 1245083 63 63
ReadX 12740 1245146 65471 65471
ReadX 12740 1310617 63 63
ReadX 12740 1310680 65471 65471
ReadX 12740 1376151 63 63
ReadX 12740 1376214 65471 65471
ReadX 12740 1441685 63 63
ReadX 12740 1441748 65471 65471
ReadX 12740 1507219 63 63
ReadX 12740 1507282 65471 65471
ReadX 12740 1572753 63 63
ReadX 12740 1572816 65471 65471
ReadX 12740 1638287 63 63
ReadX 12740 1638350 65471 65471
ReadX 12740 1703821 63 63
ReadX 12740 1703884 65471 65471
ReadX 12740 1769355 63 63
ReadX 12740 1769418 65471 65471
ReadX 12740 1834889 63 63
ReadX 12740 1834952 32824 32824
Close 12740
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12741
Close 12741
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12742
ReadX 12742 0 24 24
Close 12742
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12743
QUERY_FILE_INFORMATION 12743
ReadX 12743 0 512 512
ReadX 12743 464 512 512
ReadX 12743 498 512 512
ReadX 12743 472 512 512
ReadX 12743 466 512 512
ReadX 12743 978 512 512
ReadX 12743 497 57 57
Close 12743
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12744
QUERY_FILE_INFORMATION 12744
ReadX 12744 0 512 512
ReadX 12744 464 512 512
ReadX 12744 498 512 512
ReadX 12744 472 512 512
ReadX 12744 462 512 512
ReadX 12744 468 512 512
ReadX 12744 466 512 512
QUERY_FILE_INFORMATION 12744
WriteX 12744 482 60 60
WriteX 12744 482 4 4
QUERY_FILE_INFORMATION 12744
WriteX 12744 482 11 11
ReadX 12744 497 57 57
ReadX 12744 497 57 57
ReadX 12744 368 4096 4096
ReadX 12744 460 512 512
ReadX 12744 512 4096 4096
ReadX 12744 4608 4096 4096
ReadX 12744 8704 4096 4096
ReadX 12744 12800 4096 4096
ReadX 12744 16896 4096 4096
ReadX 12744 20992 4096 4096
ReadX 12744 25088 4096 4096
ReadX 12744 29184 4096 4096
ReadX 12744 33280 4096 4096
ReadX 12744 37376 4096 4096
ReadX 12744 41472 4096 4096
ReadX 12744 45568 4096 4096
ReadX 12744 49664 4096 4096
ReadX 12744 53760 4096 4096
ReadX 12744 57856 4096 4096
ReadX 12744 61952 4096 4096
ReadX 12744 66048 4096 4096
ReadX 12744 70144 4096 4096
ReadX 12744 497 20 20
ReadX 12744 496 103 103
ReadX 12744 500 448 448
ReadX 12744 470 512 512
ReadX 12744 486 2692 2692
ReadX 12744 290 4096 4096
ReadX 12744 4386 4096 4096
ReadX 12744 8482 4096 4096
ReadX 12744 500 20 20
ReadX 12744 483 108 108
ReadX 12744 482 292 292
ReadX 12744 338 4096 4096
ReadX 12744 4434 3103 3103
ReadX 12744 384 28 28
ReadX 12744 412 20 20
ReadX 12744 432 8 8
ReadX 12744 440 136 136
ReadX 12744 576 8 8
ReadX 12744 584 4 4
ReadX 12744 588 4 4
ReadX 12744 592 39 39
ReadX 12744 384 4 4
ReadX 12744 388 4 4
ReadX 12744 392 23 23
ReadX 12744 385 4 4
ReadX 12744 389 4 4
ReadX 12744 393 12 12
ReadX 12744 405 4 4
ReadX 12744 409 4 4
ReadX 12744 413 1 1
ReadX 12744 385 4 4
ReadX 12744 389 4 4
ReadX 12744 393 1 1
ReadX 12744 385 4 4
ReadX 12744 389 4 4
ReadX 12744 393 12 12
ReadX 12744 405 4 4
ReadX 12744 409 4 4
ReadX 12744 413 2 2
ReadX 12744 385 4 4
ReadX 12744 389 4 4
ReadX 12744 393 25 25
ReadX 12744 385 4 4
ReadX 12744 389 8 8
ReadX 12744 397 4 4
ReadX 12744 401 8 8
ReadX 12744 409 4 4
ReadX 12744 413 8 8
ReadX 12744 421 4 4
ReadX 12744 425 8 8
ReadX 12744 433 4 4
ReadX 12744 437 4 4
ReadX 12744 441 4 4
ReadX 12744 445 4 4
ReadX 12744 449 4 4
ReadX 12744 453 4 4
ReadX 12744 457 4 4
ReadX 12744 461 4 4
ReadX 12744 465 10670 10670
ReadX 12744 428 4096 4096
WriteX 12744 498 512 512
WriteX 12744 472 512 512
WriteX 12744 462 512 512
WriteX 12744 468 512 512
Close 12744
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12745
Close 12745
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12746
QUERY_FILE_INFORMATION 12746
ReadX 12746 0 512 512
ReadX 12746 464 512 512
ReadX 12746 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12747
Close 12747
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12746
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12749
WriteX 12749 4607 1 1
QUERY_FILE_INFORMATION 12749
WriteX 12749 0 65471 65471
WriteX 12749 65471 65 65
WriteX 12749 65536 19979 19979
Close 12749
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12750
QUERY_FILE_INFORMATION 12750
ReadX 12750 0 512 512
ReadX 12750 462 512 512
ReadX 12750 974 512 512
ReadX 12750 1486 512 512
ReadX 12750 460 512 512
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
WriteX 12750 470 448 448
QUERY_FILE_INFORMATION 12750
WriteX 12750 470 60 60
WriteX 12750 470 4 4
QUERY_FILE_INFORMATION 12750
WriteX 12750 470 11 11
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
WriteX 12750 464 512 512
WriteX 12750 976 512 512
WriteX 12750 1488 512 512
WriteX 12750 462 512 512
WriteX 12750 0 512 512
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
ReadX 12750 470 512 512
WriteX 12750 482 512 512
WriteX 12750 482 292 292
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
WriteX 12750 483 20 20
WriteX 12750 483 108 108
QUERY_FILE_INFORMATION 12750
WriteX 12750 484 448 448
QUERY_FILE_INFORMATION 12750
WriteX 12750 484 44 44
WriteX 12750 484 20 20
WriteX 12750 480 512 512
WriteX 12750 472 512 512
WriteX 12750 476 512 512
WriteX 12750 988 512 512
WriteX 12750 474 512 512
Flush 12750
WriteX 12750 0 512 512
Flush 12750
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
WriteX 12750 480 512 512
WriteX 12750 472 512 512
WriteX 12750 476 512 512
QUERY_FILE_INFORMATION 12750
WriteX 12750 496 320 320
QUERY_FILE_INFORMATION 12750
WriteX 12750 496 60 60
ReadX 12750 484 512 512
WriteX 12750 500 512 512
WriteX 12750 470 512 512
WriteX 12750 486 2692 2692
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
WriteX 12750 497 25 25
WriteX 12750 496 103 103
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
WriteX 12750 497 44 44
WriteX 12750 497 20 20
WriteX 12750 498 512 512
WriteX 12750 462 512 512
WriteX 12750 466 512 512
WriteX 12750 978 512 512
WriteX 12750 464 512 512
Flush 12750
WriteX 12750 0 512 512
Flush 12750
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
QUERY_FILE_INFORMATION 12750
WriteX 12750 497 7 7
WriteX 12750 497 57 57
WriteX 12750 498 512 512
WriteX 12750 472 512 512
WriteX 12750 462 512 512
WriteX 12750 466 512 512
WriteX 12750 978 512 512
Flush 12750
WriteX 12750 498 512 512
Flush 12750
Close 12750
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12751
QUERY_FILE_INFORMATION 12751
ReadX 12751 0 512 512
ReadX 12751 464 512 512
ReadX 12751 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 12752
ReadX 12752 0 20 20
ReadX 12752 14 40 40
ReadX 12752 54 64 64
ReadX 12752 118 1152 1152
Close 12752
Close 12751
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12753
Close 12753
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12754
ReadX 12754 0 24 24
Close 12754
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12755
QUERY_FILE_INFORMATION 12755
ReadX 12755 0 512 512
ReadX 12755 464 512 512
ReadX 12755 498 512 512
ReadX 12755 472 512 512
ReadX 12755 462 512 512
ReadX 12755 466 512 512
ReadX 12755 978 512 512
ReadX 12755 497 57 57
Close 12755
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12756
QUERY_FILE_INFORMATION 12756
ReadX 12756 0 512 512
ReadX 12756 464 512 512
ReadX 12756 498 512 512
ReadX 12756 472 512 512
ReadX 12756 468 512 512
ReadX 12756 462 512 512
ReadX 12756 466 512 512
QUERY_FILE_INFORMATION 12756
WriteX 12756 482 60 60
WriteX 12756 482 4 4
QUERY_FILE_INFORMATION 12756
WriteX 12756 482 11 11
WriteX 12756 498 512 512
WriteX 12756 472 512 512
WriteX 12756 462 512 512
WriteX 12756 466 512 512
WriteX 12756 978 512 512
Close 12756
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 12757
Close 12757
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12758
Close 12758
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12760
WriteX 12760 4607 1 1
QUERY_FILE_INFORMATION 12760
WriteX 12760 0 65471 65471
WriteX 12760 65471 65 65
WriteX 12760 65536 17654 17654
Close 12760
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12761
QUERY_FILE_INFORMATION 12761
ReadX 12761 0 512 512
ReadX 12761 474 512 512
ReadX 12761 986 512 512
ReadX 12761 1498 512 512
ReadX 12761 472 512 512
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
WriteX 12761 482 448 448
QUERY_FILE_INFORMATION 12761
WriteX 12761 482 60 60
WriteX 12761 482 4 4
QUERY_FILE_INFORMATION 12761
WriteX 12761 482 11 11
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
WriteX 12761 476 512 512
WriteX 12761 988 512 512
WriteX 12761 1500 512 512
WriteX 12761 474 512 512
WriteX 12761 0 512 512
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
ReadX 12761 482 512 512
WriteX 12761 494 512 512
WriteX 12761 494 292 292
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
WriteX 12761 495 20 20
WriteX 12761 495 108 108
QUERY_FILE_INFORMATION 12761
WriteX 12761 496 448 448
QUERY_FILE_INFORMATION 12761
WriteX 12761 496 44 44
WriteX 12761 496 20 20
WriteX 12761 492 512 512
WriteX 12761 484 512 512
WriteX 12761 488 512 512
WriteX 12761 1000 512 512
WriteX 12761 486 512 512
Flush 12761
WriteX 12761 0 512 512
Flush 12761
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
WriteX 12761 492 512 512
WriteX 12761 484 512 512
WriteX 12761 488 512 512
QUERY_FILE_INFORMATION 12761
WriteX 12761 508 320 320
QUERY_FILE_INFORMATION 12761
WriteX 12761 508 60 60
ReadX 12761 496 512 512
WriteX 12761 512 512 512
WriteX 12761 482 512 512
WriteX 12761 498 2692 2692
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
WriteX 12761 509 25 25
WriteX 12761 508 103 103
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
WriteX 12761 509 44 44
WriteX 12761 509 20 20
WriteX 12761 510 512 512
WriteX 12761 474 512 512
WriteX 12761 478 512 512
WriteX 12761 990 512 512
WriteX 12761 476 512 512
Flush 12761
WriteX 12761 0 512 512
Flush 12761
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
QUERY_FILE_INFORMATION 12761
WriteX 12761 509 7 7
WriteX 12761 509 57 57
WriteX 12761 510 512 512
WriteX 12761 484 512 512
WriteX 12761 474 512 512
WriteX 12761 478 512 512
WriteX 12761 990 512 512
Flush 12761
WriteX 12761 510 512 512
Flush 12761
Close 12761
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12762
Close 12762
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12763
QUERY_FILE_INFORMATION 12763
ReadX 12763 0 512 512
ReadX 12763 476 512 512
ReadX 12763 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 12764
Close 12764
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 12765
QUERY_FILE_INFORMATION 12765
ReadX 12765 0 512 512
ReadX 12765 512 512 512
ReadX 12765 770 512 512
ReadX 12765 1282 512 512
ReadX 12765 1794 512 512
ReadX 12765 2562 512 512
ReadX 12765 3586 512 512
ReadX 12765 3828 512 512
ReadX 12765 288 512 512
ReadX 12765 1024 512 512
ReadX 12765 954 512 512
ReadX 12765 295 512 512
ReadX 12765 320 512 512
ReadX 12765 322 512 512
ReadX 12765 834 512 512
ReadX 12765 1346 512 512
ReadX 12765 1858 512 512
ReadX 12765 323 512 512
ReadX 12765 835 512 512
ReadX 12765 1347 512 512
ReadX 12765 1859 512 512
ReadX 12765 2371 345 345
ReadX 12765 322 167 167
ReadX 12765 489 512 512
ReadX 12765 1001 512 512
ReadX 12765 1513 512 512
ReadX 12765 2025 512 512
ReadX 12765 2537 512 512
ReadX 12765 3049 512 512
ReadX 12765 3561 345 345
ReadX 12765 323 167 167
ReadX 12765 490 512 512
ReadX 12765 1002 512 512
ReadX 12765 1514 512 512
ReadX 12765 2026 512 512
ReadX 12765 2538 512 512
ReadX 12765 3050 512 512
ReadX 12765 3562 512 512
ReadX 12765 4074 512 512
ReadX 12765 4586 512 512
ReadX 12765 5098 512 512
ReadX 12765 5610 512 512
ReadX 12765 6122 512 512
ReadX 12765 6634 512 512
ReadX 12765 7146 512 512
ReadX 12765 7658 512 512
ReadX 12765 8170 512 512
ReadX 12765 8682 512 512
ReadX 12765 9194 512 512
ReadX 12765 9706 512 512
ReadX 12765 10218 512 512
ReadX 12765 10730 345 345
ReadX 12765 11075 512 512
ReadX 12765 11587 167 167
ReadX 12765 11754 512 512
ReadX 12765 12266 512 512
ReadX 12765 12778 512 512
ReadX 12765 13290 512 512
ReadX 12765 13802 512 512
ReadX 12765 14314 512 512
ReadX 12765 14826 512 512
ReadX 12765 15338 512 512
ReadX 12765 337 512 512
ReadX 12765 337 512 512
ReadX 12765 849 34 34
ReadX 12765 352 512 512
ReadX 12765 864 512 512
ReadX 12765 1376 512 512
ReadX 12765 1888 512 512
ReadX 12765 2400 512 512
ReadX 12765 2912 512 512
ReadX 12765 3424 512 512
ReadX 12765 3936 512 512
ReadX 12765 1632 512 512
ReadX 12765 2144 512 512
ReadX 12765 1682 512 512
ReadX 12765 258 512 512
ReadX 12765 360 144 144
ReadX 12765 2517 512 512
ReadX 12765 3029 512 512
ReadX 12765 1751 512 512
ReadX 12765 2263 512 512
ReadX 12765 2775 512 512
ReadX 12765 3287 512 512
ReadX 12765 3799 512 512
ReadX 12765 4311 512 512
ReadX 12765 4823 512 512
ReadX 12765 5335 512 512
ReadX 12765 5847 512 512
ReadX 12765 6359 512 512
ReadX 12765 6871 512 512
ReadX 12765 7383 512 512
ReadX 12765 7895 512 512
ReadX 12765 8407 512 512
ReadX 12765 8919 512 512
ReadX 12765 9431 512 512
ReadX 12765 9943 512 512
ReadX 12765 10455 512 512
ReadX 12765 10967 512 512
ReadX 12765 11479 512 512
ReadX 12765 2556 512 512
ReadX 12765 3068 512 512
ReadX 12765 3580 512 512
ReadX 12765 4092 512 512
ReadX 12765 4604 512 512
ReadX 12765 5116 512 512
ReadX 12765 5628 512 512
ReadX 12765 6140 512 512
ReadX 12765 6652 512 512
ReadX 12765 7164 512 512
ReadX 12765 7676 512 512
ReadX 12765 8188 512 512
ReadX 12765 8700 512 512
ReadX 12765 9212 512 512
ReadX 12765 9724 512 512
ReadX 12765 10236 512 512
ReadX 12765 10748 512 512
ReadX 12765 11260 512 512
ReadX 12765 11772 512 512
ReadX 12765 12284 512 512
ReadX 12765 12796 49 49
ReadX 12765 260 463 463
ReadX 12765 723 512 512
ReadX 12765 1235 512 512
ReadX 12765 1747 512 512
ReadX 12765 2259 512 512
ReadX 12765 2771 512 512
ReadX 12765 3283 512 512
ReadX 12765 3795 512 512
ReadX 12765 4307 512 512
ReadX 12765 4819 512 512
ReadX 12765 5331 512 512
ReadX 12765 5843 512 512
ReadX 12765 6355 512 512
ReadX 12765 6867 512 512
ReadX 12765 7379 512 512
ReadX 12765 7891 512 512
ReadX 12765 8403 512 512
ReadX 12765 8915 512 512
ReadX 12765 9427 512 512
ReadX 12765 9939 512 512
ReadX 12765 10451 512 512
ReadX 12765 10963 402 402
ReadX 12765 593 240 240
ReadX 12765 2048 272 272
ReadX 12765 2320 512 512
ReadX 12765 2832 512 512
ReadX 12765 3344 512 512
ReadX 12765 3856 512 512
ReadX 12765 4368 512 512
ReadX 12765 4880 512 512
ReadX 12765 5392 240 240
ReadX 12765 608 272 272
ReadX 12765 880 512 512
ReadX 12765 1392 512 512
ReadX 12765 1904 512 512
ReadX 12765 2416 512 512
ReadX 12765 2928 512 512
ReadX 12765 3440 512 512
ReadX 12765 3952 512 512
ReadX 12765 4464 512 512
ReadX 12765 4976 512 512
ReadX 12765 5488 512 512
ReadX 12765 6000 512 512
ReadX 12765 6512 512 512
ReadX 12765 7024 512 512
ReadX 12765 7536 512 512
ReadX 12765 8048 512 512
ReadX 12765 8560 512 512
ReadX 12765 9072 512 512
ReadX 12765 9584 512 512
ReadX 12765 10096 512 512
ReadX 12765 1683 512 512
ReadX 12765 514 512 512
ReadX 12765 620 512 512
ReadX 12765 770 512 512
ReadX 12765 1282 512 512
ReadX 12765 1794 512 512
ReadX 12765 2000 512 512
ReadX 12765 1434 512 512
ReadX 12765 2050 512 512
ReadX 12765 2118 512 512
ReadX 12765 1715 512 512
ReadX 12765 1024 512 512
ReadX 12765 954 512 512
ReadX 12765 1880 512 512
ReadX 12765 1286 512 512
ReadX 12765 1510 512 512
ReadX 12765 2562 512 512
ReadX 12765 2610 512 512
ReadX 12765 3586 512 512
ReadX 12765 3812 512 512
ReadX 12765 3828 512 512
ReadX 12765 4046 512 512
ReadX 12765 4066 512 512
ReadX 12765 1747 512 512
ReadX 12765 1026 512 512
ReadX 12765 1538 512 512
ReadX 12765 514 512 512
ReadX 12765 751 512 512
ReadX 12765 1263 512 512
ReadX 12765 620 512 512
ReadX 12765 1132 512 512
ReadX 12765 1644 512 512
ReadX 12765 2156 512 512
ReadX 12765 2668 512 512
ReadX 12765 3180 512 512
ReadX 12765 3692 512 512
ReadX 12765 4204 394 394
ReadX 12765 606 118 118
ReadX 12765 724 512 512
ReadX 12765 1236 512 512
ReadX 12765 1748 512 512
ReadX 12765 2260 512 512
ReadX 12765 2772 512 512
ReadX 12765 3284 512 512
ReadX 12765 3796 394 394
ReadX 12765 636 118 118
ReadX 12765 754 512 512
ReadX 12765 1266 512 512
ReadX 12765 1778 512 512
ReadX 12765 2290 512 512
ReadX 12765 2802 512 512
ReadX 12765 3314 512 512
ReadX 12765 3826 512 512
ReadX 12765 4338 512 512
ReadX 12765 4850 512 512
ReadX 12765 5362 512 512
ReadX 12765 5874 512 512
ReadX 12765 6386 512 512
ReadX 12765 6898 512 512
ReadX 12765 7410 512 512
ReadX 12765 7922 512 512
ReadX 12765 8434 512 512
ReadX 12765 8946 512 512
ReadX 12765 9458 512 512
ReadX 12765 9970 512 512
ReadX 12765 10482 512 512
ReadX 12765 723 512 512
ReadX 12765 1235 512 512
ReadX 12765 725 512 512
ReadX 12765 729 512 512
ReadX 12765 1241 512 512
ReadX 12765 1753 512 512
ReadX 12765 2265 512 512
ReadX 12765 2777 512 512
ReadX 12765 3289 512 512
ReadX 12765 3801 512 512
ReadX 12765 4313 512 512
ReadX 12765 4825 512 512
ReadX 12765 5337 512 512
ReadX 12765 5849 512 512
ReadX 12765 6361 512 512
ReadX 12765 755 512 512
ReadX 12765 1267 512 512
ReadX 12765 1779 512 512
ReadX 12765 2291 512 512
ReadX 12765 2803 512 512
ReadX 12765 3315 512 512
ReadX 12765 3827 512 512
ReadX 12765 4339 244 244
ReadX 12765 4583 512 512
ReadX 12765 5095 268 268
ReadX 12765 5363 512 512
ReadX 12765 5875 512 512
ReadX 12765 6387 512 512
ReadX 12765 6899 512 512
ReadX 12765 7411 512 512
ReadX 12765 7923 512 512
ReadX 12765 8435 512 512
ReadX 12765 8947 512 512
ReadX 12765 9459 512 512
ReadX 12765 9971 512 512
ReadX 12765 10483 512 512
ReadX 12765 10995 512 512
ReadX 12765 11507 512 512
ReadX 12765 12019 512 512
ReadX 12765 12531 512 512
ReadX 12765 13043 512 512
ReadX 12765 13555 512 512
ReadX 12765 14067 512 512
ReadX 12765 14579 512 512
ReadX 12765 15091 512 512
ReadX 12765 15603 342 342
ReadX 12765 725 512 512
ReadX 12765 2000 512 512
ReadX 12765 3918 512 512
ReadX 12765 727 512 512
ReadX 12765 258 512 512
ReadX 12765 376 512 512
ReadX 12765 1109 512 512
ReadX 12765 1028 512 512
ReadX 12765 1540 512 512
ReadX 12765 2052 512 512
ReadX 12765 2564 512 512
ReadX 12765 3076 512 512
ReadX 12765 3588 512 512
ReadX 12765 4100 512 512
ReadX 12765 4612 412 412
ReadX 12765 1012 100 100
ReadX 12765 1112 512 512
ReadX 12765 1624 512 512
ReadX 12765 2136 512 512
ReadX 12765 2648 512 512
ReadX 12765 3160 512 512
ReadX 12765 3672 512 512
ReadX 12765 4184 412 412
ReadX 12765 1044 100 100
ReadX 12765 1144 512 512
ReadX 12765 1656 512 512
ReadX 12765 2168 512 512
ReadX 12765 2680 512 512
ReadX 12765 3192 512 512
ReadX 12765 3704 512 512
ReadX 12765 4216 512 512
ReadX 12765 4728 512 512
ReadX 12765 5240 512 512
ReadX 12765 5752 512 512
ReadX 12765 6264 512 512
ReadX 12765 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 12765 7288 512 512
ReadX 12765 7800 512 512
ReadX 12765 8312 512 512
ReadX 12765 8824 512 512
ReadX 12765 9336 512 512
ReadX 12765 9848 512 512
ReadX 12765 10360 512 512
ReadX 12765 10872 512 512
ReadX 12765 11384 512 512
ReadX 12765 11896 512 512
ReadX 12765 12408 512 512
ReadX 12765 1088 512 512
ReadX 12765 1600 512 512
ReadX 12765 1090 512 512
ReadX 12765 1094 512 512
ReadX 12765 1606 512 512
ReadX 12765 2118 512 512
ReadX 12765 2630 512 512
ReadX 12765 3142 512 512
ReadX 12765 3654 512 512
ReadX 12765 4166 512 512
ReadX 12765 4678 512 512
ReadX 12765 1111 512 512
ReadX 12765 1623 512 512
ReadX 12765 2135 512 512
ReadX 12765 2647 512 512
ReadX 12765 3159 512 512
ReadX 12765 3671 512 512
ReadX 12765 4183 512 512
ReadX 12765 4695 512 512
ReadX 12765 5207 512 512
ReadX 12765 5719 512 512
ReadX 12765 6231 512 512
ReadX 12765 6743 512 512
ReadX 12765 7255 512 512
ReadX 12765 7767 512 512
ReadX 12765 8279 512 512
ReadX 12765 8791 512 512
ReadX 12765 9303 512 512
ReadX 12765 9815 512 512
ReadX 12765 10327 512 512
ReadX 12765 10839 512 512
ReadX 12765 11351 294 294
ReadX 12765 1091 512 512
ReadX 12765 970 512 512
ReadX 12765 1093 512 512
ReadX 12765 1434 512 512
ReadX 12765 2050 512 512
ReadX 12765 2158 512 512
ReadX 12765 2118 512 512
ReadX 12765 2630 512 512
ReadX 12765 3142 512 512
ReadX 12765 3654 512 512
ReadX 12765 4166 512 512
ReadX 12765 4678 512 512
ReadX 12765 5190 512 512
ReadX 12765 5702 382 382
ReadX 12765 2104 130 130
ReadX 12765 2234 512 512
ReadX 12765 2746 512 512
ReadX 12765 3258 512 512
ReadX 12765 3770 512 512
ReadX 12765 4282 512 512
ReadX 12765 4794 512 512
ReadX 12765 5306 382 382
ReadX 12765 2134 130 130
ReadX 12765 2264 512 512
ReadX 12765 2776 512 512
ReadX 12765 3288 512 512
ReadX 12765 3800 512 512
ReadX 12765 4312 512 512
ReadX 12765 4824 512 512
ReadX 12765 5336 512 512
ReadX 12765 2147 512 512
ReadX 12765 2149 512 512
ReadX 12765 2152 512 512
ReadX 12765 2664 512 512
ReadX 12765 3176 512 512
ReadX 12765 3688 512 512
ReadX 12765 2159 512 512
ReadX 12765 2671 512 512
ReadX 12765 3183 512 512
ReadX 12765 3695 512 512
ReadX 12765 4207 512 512
ReadX 12765 4719 512 512
ReadX 12765 5231 512 512
ReadX 12765 5743 512 512
ReadX 12765 6255 512 512
ReadX 12765 6767 512 512
ReadX 12765 7279 512 512
ReadX 12765 7791 512 512
ReadX 12765 8303 512 512
ReadX 12765 8815 512 512
ReadX 12765 9327 512 512
ReadX 12765 9839 512 512
ReadX 12765 10351 512 512
ReadX 12765 10863 512 512
ReadX 12765 11375 512 512
ReadX 12765 11887 512 512
ReadX 12765 12399 38 38
ReadX 12765 2149 512 512
ReadX 12765 1794 512 512
ReadX 12765 2016 512 512
ReadX 12765 2151 512 512
ReadX 12765 1918 512 512
ReadX 12765 1880 512 512
ReadX 12765 2392 512 512
ReadX 12765 2904 512 512
ReadX 12765 3416 512 512
ReadX 12765 3928 512 512
ReadX 12765 4440 512 512
ReadX 12765 4952 512 512
ReadX 12765 5464 416 416
ReadX 12765 1866 96 96
ReadX 12765 1962 512 512
ReadX 12765 2474 512 512
ReadX 12765 2986 512 512
ReadX 12765 3498 512 512
ReadX 12765 4010 512 512
ReadX 12765 4522 512 512
ReadX 12765 5034 416 416
ReadX 12765 1896 96 96
ReadX 12765 1992 512 512
ReadX 12765 2504 512 512
ReadX 12765 3016 512 512
ReadX 12765 3528 512 512
ReadX 12765 1903 512 512
ReadX 12765 1905 512 512
ReadX 12765 1908 512 512
ReadX 12765 2420 512 512
ReadX 12765 2932 512 512
ReadX 12765 3444 512 512
ReadX 12765 3956 512 512
ReadX 12765 1919 512 512
ReadX 12765 2431 512 512
ReadX 12765 2943 512 512
ReadX 12765 3455 512 512
ReadX 12765 3967 512 512
ReadX 12765 4479 512 512
ReadX 12765 4991 512 512
ReadX 12765 5503 512 512
ReadX 12765 6015 512 512
ReadX 12765 6527 512 512
ReadX 12765 7039 512 512
ReadX 12765 7551 512 512
ReadX 12765 8063 512 512
ReadX 12765 8575 512 512
ReadX 12765 9087 512 512
ReadX 12765 9599 512 512
ReadX 12765 10111 512 512
ReadX 12765 10623 512 512
ReadX 12765 11135 512 512
ReadX 12765 11647 512 512
ReadX 12765 12159 322 322
ReadX 12765 1905 512 512
ReadX 12765 1846 512 512
ReadX 12765 1907 512 512
ReadX 12765 1860 268 268
ReadX 12765 1832 244 244
ReadX 12765 1846 512 512
ReadX 12765 2358 512 512
ReadX 12765 2870 512 512
ReadX 12765 3382 512 512
ReadX 12765 3894 512 512
ReadX 12765 4406 512 512
ReadX 12765 4918 512 512
ReadX 12765 1858 512 512
ReadX 12765 1859 512 512
ReadX 12765 1860 488 488
ReadX 12765 1832 24 24
ReadX 12765 1861 228 228
ReadX 12765 1832 284 284
ReadX 12765 2116 512 512
ReadX 12765 2628 512 512
ReadX 12765 3140 512 512
ReadX 12765 3652 512 512
ReadX 12765 4164 512 512
ReadX 12765 4676 512 512
ReadX 12765 5188 228 228
ReadX 12765 1862 284 284
ReadX 12765 2146 512 512
ReadX 12765 2658 38 38
ReadX 12765 1859 512 512
ReadX 12765 2047 512 512
ReadX 12765 2016 512 512
ReadX 12765 2528 512 512
ReadX 12765 3040 512 512
ReadX 12765 3552 512 512
ReadX 12765 4064 512 512
ReadX 12765 4576 512 512
ReadX 12765 5088 512 512
ReadX 12765 5600 424 424
ReadX 12765 2002 88 88
ReadX 12765 2090 512 512
ReadX 12765 2602 512 512
ReadX 12765 3114 512 512
ReadX 12765 3626 512 512
ReadX 12765 4138 512 512
ReadX 12765 4650 512 512
ReadX 12765 5162 424 424
ReadX 12765 2032 88 88
ReadX 12765 2120 512 512
ReadX 12765 2632 512 512
ReadX 12765 3144 512 512
ReadX 12765 3656 512 512
ReadX 12765 4168 512 512
ReadX 12765 4680 512 512
ReadX 12765 5192 512 512
ReadX 12765 2044 512 512
ReadX 12765 2045 512 512
ReadX 12765 2046 512 512
ReadX 12765 2047 512 512
ReadX 12765 2559 110 110
ReadX 12765 2052 402 402
ReadX 12765 2454 512 512
ReadX 12765 2966 512 512
ReadX 12765 3478 512 512
ReadX 12765 3990 512 512
ReadX 12765 4502 512 512
ReadX 12765 5014 512 512
ReadX 12765 5526 512 512
ReadX 12765 6038 512 512
ReadX 12765 6550 512 512
ReadX 12765 7062 512 512
ReadX 12765 7574 512 512
ReadX 12765 8086 512 512
ReadX 12765 8598 512 512
ReadX 12765 9110 512 512
ReadX 12765 9622 512 512
ReadX 12765 10134 512 512
ReadX 12765 10646 512 512
ReadX 12765 11158 512 512
ReadX 12765 11670 512 512
ReadX 12765 12182 512 512
ReadX 12765 12694 118 118
ReadX 12765 2045 512 512
ReadX 12765 1282 512 512
ReadX 12765 1343 512 512
ReadX 12765 1286 512 512
ReadX 12765 1798 512 512
ReadX 12765 2310 512 512
ReadX 12765 2822 512 512
ReadX 12765 3334 512 512
ReadX 12765 3846 512 512
ReadX 12765 4358 512 512
ReadX 12765 4870 416 416
ReadX 12765 1270 96 96
ReadX 12765 1366 512 512
ReadX 12765 1878 512 512
ReadX 12765 2390 512 512
ReadX 12765 2902 512 512
ReadX 12765 3414 512 512
ReadX 12765 3926 416 416
ReadX 12765 1284 96 96
ReadX 12765 1380 416 416
ReadX 12765 1302 96 96
ReadX 12765 1398 512 512
ReadX 12765 1910 512 512
ReadX 12765 2422 512 512
ReadX 12765 2934 512 512
ReadX 12765 3446 512 512
ReadX 12765 3958 512 512
ReadX 12765 4470 512 512
ReadX 12765 4982 512 512
ReadX 12765 5494 512 512
ReadX 12765 6006 512 512
ReadX 12765 6518 512 512
ReadX 12765 7030 512 512
ReadX 12765 7542 512 512
ReadX 12765 1328 512 512
ReadX 12765 1330 512 512
ReadX 12765 1333 512 512
ReadX 12765 1845 512 512
ReadX 12765 2357 512 512
ReadX 12765 2869 512 512
ReadX 12765 3381 512 512
ReadX 12765 1344 512 512
ReadX 12765 1856 512 512
ReadX 12765 2368 512 512
ReadX 12765 2880 512 512
ReadX 12765 3392 512 512
ReadX 12765 3904 512 512
ReadX 12765 4416 512 512
ReadX 12765 4928 512 512
ReadX 12765 5440 512 512
ReadX 12765 5952 512 512
ReadX 12765 6464 512 512
ReadX 12765 6976 512 512
ReadX 12765 7488 512 512
ReadX 12765 8000 512 512
ReadX 12765 8512 512 512
ReadX 12765 9024 512 512
ReadX 12765 9536 512 512
ReadX 12765 10048 512 512
ReadX 12765 10560 512 512
ReadX 12765 11072 512 512
ReadX 12765 11584 426 426
ReadX 12765 1330 512 512
ReadX 12765 1842 512 512
ReadX 12765 1250 512 512
ReadX 12765 1264 268 268
ReadX 12765 1236 244 244
ReadX 12765 1250 512 512
ReadX 12765 1762 512 512
ReadX 12765 2274 512 512
ReadX 12765 2786 512 512
ReadX 12765 3298 512 512
ReadX 12765 3810 512 512
ReadX 12765 4322 512 512
ReadX 12765 1262 512 512
ReadX 12765 1263 512 512
ReadX 12765 1264 488 488
ReadX 12765 1236 24 24
ReadX 12765 1265 228 228
ReadX 12765 1236 284 284
ReadX 12765 1520 512 512
ReadX 12765 2032 512 512
ReadX 12765 2544 512 512
ReadX 12765 3056 512 512
ReadX 12765 3568 512 512
ReadX 12765 4080 512 512
ReadX 12765 4592 228 228
ReadX 12765 1266 284 284
ReadX 12765 1550 512 512
ReadX 12765 2062 42 42
ReadX 12765 1263 512 512
ReadX 12765 1538 512 512
ReadX 12765 1640 512 512
ReadX 12765 1510 512 512
ReadX 12765 2022 512 512
ReadX 12765 2534 512 512
ReadX 12765 3046 512 512
ReadX 12765 3558 512 512
ReadX 12765 4070 512 512
ReadX 12765 4582 512 512
ReadX 12765 5094 408 408
ReadX 12765 1496 104 104
ReadX 12765 1600 512 512
ReadX 12765 2112 512 512
ReadX 12765 2624 512 512
ReadX 12765 3136 512 512
ReadX 12765 3648 512 512
ReadX 12765 4160 512 512
ReadX 12765 4672 408 408
ReadX 12765 1526 104 104
ReadX 12765 1630 512 512
ReadX 12765 2142 512 512
ReadX 12765 2654 512 512
ReadX 12765 3166 512 512
ReadX 12765 3678 512 512
ReadX 12765 4190 408 408
ReadX 12765 1540 104 104
ReadX 12765 1644 512 512
ReadX 12765 2156 512 512
ReadX 12765 2668 512 512
ReadX 12765 3180 512 512
ReadX 12765 3692 512 512
ReadX 12765 4204 512 512
ReadX 12765 4716 512 512
ReadX 12765 5228 512 512
ReadX 12765 5740 512 512
ReadX 12765 6252 512 512
ReadX 12765 6764 512 512
ReadX 12765 7276 512 512
ReadX 12765 7788 512 512
ReadX 12765 8300 512 512
ReadX 12765 8812 512 512
ReadX 12765 9324 512 512
ReadX 12765 9836 512 512
ReadX 12765 10348 512 512
ReadX 12765 10860 512 512
ReadX 12765 11372 512 512
ReadX 12765 1615 512 512
ReadX 12765 2127 512 512
ReadX 12765 1617 512 512
ReadX 12765 1621 512 512
ReadX 12765 2133 512 512
ReadX 12765 2645 512 512
ReadX 12765 3157 512 512
ReadX 12765 3669 512 512
ReadX 12765 4181 512 512
ReadX 12765 4693 512 512
ReadX 12765 5205 512 512
ReadX 12765 5717 512 512
ReadX 12765 6229 512 512
ReadX 12765 1641 512 512
ReadX 12765 2153 512 512
ReadX 12765 2665 512 512
ReadX 12765 3177 512 512
ReadX 12765 3689 512 512
ReadX 12765 4201 512 512
ReadX 12765 4713 512 512
ReadX 12765 5225 512 512
ReadX 12765 5737 512 512
ReadX 12765 6249 512 512
ReadX 12765 6761 512 512
ReadX 12765 7273 512 512
ReadX 12765 7785 512 512
ReadX 12765 8297 512 512
ReadX 12765 8809 512 512
ReadX 12765 9321 512 512
ReadX 12765 9833 512 512
ReadX 12765 10345 512 512
ReadX 12765 10857 512 512
ReadX 12765 11369 512 512
ReadX 12765 11881 2 2
ReadX 12765 1796 510 510
ReadX 12765 2306 512 512
ReadX 12765 2818 512 512
ReadX 12765 3330 512 512
ReadX 12765 3842 512 512
ReadX 12765 4354 512 512
ReadX 12765 4866 512 512
ReadX 12765 5378 512 512
ReadX 12765 5890 512 512
ReadX 12765 6402 512 512
ReadX 12765 6914 512 512
ReadX 12765 7426 512 512
ReadX 12765 7938 512 512
ReadX 12765 8450 512 512
ReadX 12765 8962 512 512
ReadX 12765 9474 512 512
ReadX 12765 9986 512 512
ReadX 12765 10498 326 326
ReadX 12765 1617 512 512
ReadX 12765 2129 512 512
ReadX 12765 1450 512 512
ReadX 12765 1621 512 512
ReadX 12765 1446 512 512
ReadX 12765 1450 512 512
ReadX 12765 1962 512 512
ReadX 12765 2474 512 512
ReadX 12765 2986 512 512
ReadX 12765 3498 512 512
ReadX 12765 4010 512 512
ReadX 12765 4522 512 512
ReadX 12765 5034 424 424
ReadX 12765 1436 88 88
ReadX 12765 1524 512 512
ReadX 12765 2036 512 512
ReadX 12765 2548 512 512
ReadX 12765 3060 512 512
ReadX 12765 1442 512 512
ReadX 12765 1443 512 512
ReadX 12765 1444 512 512
ReadX 12765 1446 512 512
ReadX 12765 1958 386 386
ReadX 12765 1466 126 126
ReadX 12765 1592 512 512
ReadX 12765 2104 512 512
ReadX 12765 2616 512 512
ReadX 12765 3128 512 512
ReadX 12765 3640 512 512
ReadX 12765 4152 512 512
ReadX 12765 4664 512 512
ReadX 12765 5176 512 512
ReadX 12765 5688 512 512
ReadX 12765 6200 512 512
ReadX 12765 6712 512 512
ReadX 12765 7224 512 512
ReadX 12765 7736 512 512
ReadX 12765 8248 512 512
ReadX 12765 8760 294 294
ReadX 12765 1443 512 512
ReadX 12765 964 512 512
ReadX 12765 970 512 512
ReadX 12765 1482 512 512
ReadX 12765 1994 512 512
ReadX 12765 2506 512 512
ReadX 12765 3018 512 512
ReadX 12765 3530 512 512
ReadX 12765 4042 512 512
ReadX 12765 4554 424 424
ReadX 12765 956 88 88
ReadX 12765 1044 512 512
ReadX 12765 1556 512 512
ReadX 12765 2068 512 512
ReadX 12765 2580 512 512
ReadX 12765 962 512 512
ReadX 12765 963 512 512
ReadX 12765 964 512 512
ReadX 12765 965 512 512
ReadX 12765 1477 512 512
ReadX 12765 1989 228 228
ReadX 12765 986 284 284
ReadX 12765 1270 512 512
ReadX 12765 1782 512 512
ReadX 12765 2294 512 512
ReadX 12765 2806 512 512
ReadX 12765 3318 512 512
ReadX 12765 3830 512 512
ReadX 12765 4342 512 512
ReadX 12765 4854 512 512
ReadX 12765 5366 512 512
ReadX 12765 5878 512 512
ReadX 12765 6390 512 512
ReadX 12765 6902 512 512
ReadX 12765 7414 42 42
ReadX 12765 963 512 512
ReadX 12765 2610 512 512
ReadX 12765 3812 512 512
ReadX 12765 3828 512 512
ReadX 12765 3969 512 512
ReadX 12765 3918 512 512
ReadX 12765 4430 512 512
ReadX 12765 4942 512 512
ReadX 12765 5454 512 512
ReadX 12765 5966 512 512
ReadX 12765 6478 512 512
ReadX 12765 6990 512 512
ReadX 12765 7502 424 424
ReadX 12765 3904 88 88
ReadX 12765 3992 512 512
ReadX 12765 4504 512 512
ReadX 12765 5016 512 512
ReadX 12765 5528 512 512
ReadX 12765 6040 512 512
ReadX 12765 6552 512 512
ReadX 12765 7064 424 424
ReadX 12765 3934 88 88
ReadX 12765 4022 512 512
ReadX 12765 4534 512 512
ReadX 12765 5046 512 512
ReadX 12765 5558 512 512
ReadX 12765 6070 512 512
ReadX 12765 6582 512 512
ReadX 12765 7094 512 512
ReadX 12765 7606 512 512
ReadX 12765 8118 512 512
ReadX 12765 8630 512 512
ReadX 12765 3953 512 512
ReadX 12765 4465 512 512
ReadX 12765 3956 512 512
ReadX 12765 3964 512 512
ReadX 12765 4476 512 512
ReadX 12765 4988 512 512
ReadX 12765 3970 512 512
ReadX 12765 4482 512 512
ReadX 12765 4994 512 512
ReadX 12765 5506 512 512
ReadX 12765 6018 512 512
ReadX 12765 6530 512 512
ReadX 12765 7042 512 512
ReadX 12765 7554 512 512
ReadX 12765 8066 512 512
ReadX 12765 8578 512 512
ReadX 12765 9090 512 512
ReadX 12765 9602 512 512
ReadX 12765 10114 512 512
ReadX 12765 10626 512 512
ReadX 12765 11138 512 512
ReadX 12765 11650 512 512
ReadX 12765 12162 512 512
ReadX 12765 12674 512 512
ReadX 12765 13186 512 512
ReadX 12765 13698 512 512
ReadX 12765 14210 134 134
ReadX 12765 3956 512 512
ReadX 12765 4468 512 512
ReadX 12765 4980 512 512
ReadX 12765 5492 512 512
ReadX 12765 3074 512 512
ReadX 12765 3246 512 512
ReadX 12765 3964 512 512
ReadX 12765 3330 512 512
ReadX 12765 3465 512 512
ReadX 12765 3246 512 512
ReadX 12765 3758 512 512
ReadX 12765 4270 512 512
ReadX 12765 4782 512 512
ReadX 12765 5294 512 512
ReadX 12765 5806 512 512
ReadX 12765 6318 512 512
ReadX 12765 6830 368 368
ReadX 12765 3232 144 144
ReadX 12765 3376 512 512
ReadX 12765 3888 512 512
ReadX 12765 4400 512 512
ReadX 12765 4912 512 512
ReadX 12765 5424 512 512
ReadX 12765 5936 512 512
ReadX 12765 6448 368 368
ReadX 12765 3262 144 144
ReadX 12765 3406 512 512
ReadX 12765 3918 512 512
ReadX 12765 4430 512 512
ReadX 12765 4942 512 512
ReadX 12765 5454 512 512
ReadX 12765 5966 512 512
ReadX 12765 6478 512 512
ReadX 12765 6990 512 512
ReadX 12765 7502 512 512
ReadX 12765 8014 512 512
ReadX 12765 8526 512 512
ReadX 12765 9038 512 512
ReadX 12765 9550 512 512
ReadX 12765 10062 512 512
ReadX 12765 10574 512 512
ReadX 12765 11086 512 512
ReadX 12765 11598 512 512
ReadX 12765 12110 512 512
ReadX 12765 12622 512 512
ReadX 12765 13134 512 512
ReadX 12765 13646 368 368
ReadX 12765 3332 144 144
ReadX 12765 3476 512 512
ReadX 12765 3988 512 512
ReadX 12765 4500 512 512
ReadX 12765 5012 512 512
ReadX 12765 5524 512 512
ReadX 12765 6036 512 512
ReadX 12765 6548 512 512
ReadX 12765 7060 512 512
ReadX 12765 7572 512 512
ReadX 12765 8084 512 512
ReadX 12765 8596 512 512
ReadX 12765 9108 512 512
ReadX 12765 9620 512 512
ReadX 12765 10132 512 512
ReadX 12765 10644 512 512
ReadX 12765 11156 512 512
ReadX 12765 11668 512 512
ReadX 12765 12180 512 512
ReadX 12765 12692 512 512
ReadX 12765 13204 512 512
ReadX 12765 3430 512 512
ReadX 12765 3942 512 512
ReadX 12765 3434 512 512
ReadX 12765 3435 512 512
ReadX 12765 3947 512 512
ReadX 12765 4459 512 512
ReadX 12765 4971 512 512
ReadX 12765 5483 512 512
ReadX 12765 5995 512 512
ReadX 12765 6507 512 512
ReadX 12765 7019 512 512
ReadX 12765 7531 512 512
ReadX 12765 8043 512 512
ReadX 12765 8555 512 512
ReadX 12765 9067 512 512
ReadX 12765 9579 512 512
ReadX 12765 10091 512 512
ReadX 12765 10603 512 512
ReadX 12765 11115 512 512
ReadX 12765 3467 512 512
ReadX 12765 3979 512 512
ReadX 12765 4491 512 512
ReadX 12765 5003 512 512
ReadX 12765 5515 512 512
ReadX 12765 6027 512 512
ReadX 12765 6539 512 512
ReadX 12765 7051 512 512
ReadX 12765 7563 512 512
ReadX 12765 8075 512 512
ReadX 12765 8587 512 512
ReadX 12765 9099 512 512
ReadX 12765 9611 512 512
ReadX 12765 10123 512 512
ReadX 12765 10635 512 512
ReadX 12765 11147 512 512
ReadX 12765 11659 512 512
ReadX 12765 12171 512 512
ReadX 12765 12683 512 512
ReadX 12765 13195 512 512
ReadX 12765 13707 56 56
ReadX 12765 13763 512 512
ReadX 12765 14275 456 456
ReadX 12765 14731 512 512
ReadX 12765 15243 512 512
ReadX 12765 15755 512 512
ReadX 12765 16267 512 512
ReadX 12765 16779 512 512
ReadX 12765 17291 512 512
ReadX 12765 17803 512 512
ReadX 12765 18315 512 512
ReadX 12765 18827 512 512
ReadX 12765 19339 512 512
ReadX 12765 19851 512 512
ReadX 12765 20363 512 512
ReadX 12765 20875 512 512
ReadX 12765 21387 512 512
ReadX 12765 21899 512 512
ReadX 12765 22411 512 512
ReadX 12765 22923 512 512
ReadX 12765 23435 512 512
ReadX 12765 23947 512 512
ReadX 12765 24459 512 512
ReadX 12765 24971 282 282
ReadX 12765 3434 512 512
ReadX 12765 2818 512 512
ReadX 12765 2870 512 512
ReadX 12765 3026 512 512
ReadX 12765 3538 512 512
ReadX 12765 2870 512 512
ReadX 12765 3382 512 512
ReadX 12765 3894 512 512
ReadX 12765 4406 512 512
ReadX 12765 4918 512 512
ReadX 12765 5430 512 512
ReadX 12765 5942 512 512
ReadX 12765 6454 374 374
ReadX 12765 2856 138 138
ReadX 12765 2994 512 512
ReadX 12765 3506 512 512
ReadX 12765 4018 512 512
ReadX 12765 4530 512 512
ReadX 12765 5042 512 512
ReadX 12765 5554 512 512
ReadX 12765 6066 374 374
ReadX 12765 2886 138 138
ReadX 12765 3024 512 512
ReadX 12765 3536 512 512
ReadX 12765 4048 512 512
ReadX 12765 4560 512 512
ReadX 12765 5072 512 512
ReadX 12765 5584 512 512
ReadX 12765 6096 512 512
ReadX 12765 6608 512 512
ReadX 12765 7120 512 512
ReadX 12765 7632 512 512
ReadX 12765 8144 512 512
ReadX 12765 8656 512 512
ReadX 12765 9168 512 512
ReadX 12765 9680 512 512
ReadX 12765 10192 512 512
ReadX 12765 10704 512 512
ReadX 12765 11216 512 512
ReadX 12765 11728 512 512
ReadX 12765 12240 512 512
ReadX 12765 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 12765 13264 512 512
ReadX 12765 13776 512 512
ReadX 12765 14288 512 512
ReadX 12765 14800 512 512
ReadX 12765 15312 512 512
ReadX 12765 15824 512 512
ReadX 12765 16336 512 512
ReadX 12765 16848 512 512
ReadX 12765 17360 512 512
ReadX 12765 17872 512 512
ReadX 12765 18384 512 512
ReadX 12765 18896 512 512
ReadX 12765 19408 512 512
ReadX 12765 19920 512 512
ReadX 12765 20432 512 512
ReadX 12765 20944 512 512
ReadX 12765 21456 512 512
ReadX 12765 21968 512 512
ReadX 12765 22480 512 512
ReadX 12765 22992 512 512
ReadX 12765 2998 512 512
ReadX 12765 3510 512 512
ReadX 12765 3001 512 512
ReadX 12765 3003 512 512
ReadX 12765 3515 512 512
ReadX 12765 4027 512 512
ReadX 12765 4539 512 512
ReadX 12765 5051 512 512
ReadX 12765 5563 512 512
ReadX 12765 6075 512 512
ReadX 12765 6587 512 512
ReadX 12765 7099 512 512
ReadX 12765 7611 512 512
ReadX 12765 8123 512 512
ReadX 12765 8635 512 512
ReadX 12765 3029 512 512
ReadX 12765 3541 512 512
ReadX 12765 4053 512 512
ReadX 12765 4565 512 512
ReadX 12765 5077 512 512
ReadX 12765 5589 512 512
ReadX 12765 6101 512 512
ReadX 12765 6613 512 512
ReadX 12765 7125 512 512
ReadX 12765 7637 512 512
ReadX 12765 8149 512 512
ReadX 12765 8661 512 512
ReadX 12765 9173 512 512
ReadX 12765 9685 512 512
ReadX 12765 10197 512 512
ReadX 12765 10709 512 512
ReadX 12765 11221 512 512
ReadX 12765 11733 512 512
ReadX 12765 12245 512 512
ReadX 12765 12757 512 512
ReadX 12765 13269 40 40
ReadX 12765 3076 472 472
ReadX 12765 3548 512 512
ReadX 12765 4060 512 512
ReadX 12765 4572 512 512
ReadX 12765 5084 512 512
ReadX 12765 5596 512 512
ReadX 12765 6108 512 512
ReadX 12765 6620 512 512
ReadX 12765 7132 512 512
ReadX 12765 7644 512 512
ReadX 12765 8156 512 512
ReadX 12765 8668 512 512
ReadX 12765 9180 512 512
ReadX 12765 9692 512 512
ReadX 12765 10204 512 512
ReadX 12765 10716 512 512
ReadX 12765 11228 512 512
ReadX 12765 11740 512 512
ReadX 12765 12252 512 512
ReadX 12765 12764 512 512
ReadX 12765 13276 310 310
ReadX 12765 3001 512 512
ReadX 12765 2562 512 512
ReadX 12765 2626 512 512
ReadX 12765 3003 512 512
ReadX 12765 2721 512 512
ReadX 12765 2626 512 512
ReadX 12765 3138 512 512
ReadX 12765 3650 512 512
ReadX 12765 4162 512 512
ReadX 12765 4674 512 512
ReadX 12765 5186 512 512
ReadX 12765 5698 512 512
ReadX 12765 6210 424 424
ReadX 12765 2612 88 88
ReadX 12765 2700 512 512
ReadX 12765 3212 512 512
ReadX 12765 3724 512 512
ReadX 12765 4236 512 512
ReadX 12765 4748 512 512
ReadX 12765 5260 512 512
ReadX 12765 5772 424 424
ReadX 12765 2642 88 88
ReadX 12765 2730 512 512
ReadX 12765 3242 512 512
ReadX 12765 3754 512 512
ReadX 12765 4266 512 512
ReadX 12765 4778 512 512
ReadX 12765 5290 512 512
ReadX 12765 5802 512 512
ReadX 12765 6314 512 512
ReadX 12765 6826 512 512
ReadX 12765 7338 512 512
ReadX 12765 7850 512 512
ReadX 12765 8362 512 512
ReadX 12765 8874 512 512
ReadX 12765 9386 512 512
ReadX 12765 9898 512 512
ReadX 12765 10410 512 512
ReadX 12765 10922 512 512
ReadX 12765 11434 512 512
ReadX 12765 11946 512 512
ReadX 12765 12458 512 512
ReadX 12765 2716 512 512
ReadX 12765 2717 512 512
ReadX 12765 2718 512 512
ReadX 12765 3230 512 512
ReadX 12765 2721 512 512
ReadX 12765 3233 512 512
ReadX 12765 3745 512 512
ReadX 12765 4257 512 512
ReadX 12765 4769 512 512
ReadX 12765 5281 512 512
ReadX 12765 5793 512 512
ReadX 12765 6305 512 512
ReadX 12765 6817 512 512
ReadX 12765 7329 512 512
ReadX 12765 7841 512 512
ReadX 12765 8353 512 512
ReadX 12765 8865 512 512
ReadX 12765 9377 512 512
ReadX 12765 9889 512 512
ReadX 12765 10401 512 512
ReadX 12765 10913 512 512
ReadX 12765 11425 512 512
ReadX 12765 11937 512 512
ReadX 12765 12449 512 512
ReadX 12765 12961 512 512
ReadX 12765 13473 512 512
ReadX 12765 13985 106 106
ReadX 12765 2820 406 406
ReadX 12765 3226 512 512
ReadX 12765 3738 512 512
ReadX 12765 4250 512 512
ReadX 12765 4762 512 512
ReadX 12765 5274 512 512
ReadX 12765 5786 512 512
ReadX 12765 6298 512 512
ReadX 12765 6810 512 512
ReadX 12765 7322 512 512
ReadX 12765 7834 512 512
ReadX 12765 8346 512 512
ReadX 12765 8858 512 512
ReadX 12765 9370 512 512
ReadX 12765 9882 512 512
ReadX 12765 10394 512 512
ReadX 12765 10906 512 512
ReadX 12765 11418 182 182
ReadX 12765 2717 512 512
ReadX 12765 258 512 512
ReadX 12765 470 512 512
ReadX 12765 376 512 512
ReadX 12765 888 512 512
ReadX 12765 1400 512 512
ReadX 12765 1912 512 512
ReadX 12765 2424 512 512
ReadX 12765 2936 512 512
ReadX 12765 3448 512 512
ReadX 12765 3960 424 424
ReadX 12765 362 88 88
ReadX 12765 450 512 512
ReadX 12765 962 512 512
ReadX 12765 1474 512 512
ReadX 12765 1986 512 512
ReadX 12765 2498 512 512
ReadX 12765 3010 512 512
ReadX 12765 3522 424 424
ReadX 12765 392 88 88
ReadX 12765 480 512 512
ReadX 12765 992 512 512
ReadX 12765 1504 512 512
ReadX 12765 2016 512 512
ReadX 12765 2528 512 512
ReadX 12765 3040 512 512
ReadX 12765 3552 512 512
ReadX 12765 4064 512 512
ReadX 12765 4576 512 512
ReadX 12765 5088 512 512
ReadX 12765 5600 512 512
ReadX 12765 6112 512 512
ReadX 12765 6624 512 512
ReadX 12765 7136 512 512
ReadX 12765 7648 512 512
ReadX 12765 8160 512 512
ReadX 12765 8672 512 512
ReadX 12765 9184 512 512
ReadX 12765 9696 512 512
ReadX 12765 10208 512 512
ReadX 12765 464 512 512
ReadX 12765 465 512 512
ReadX 12765 466 512 512
ReadX 12765 978 512 512
ReadX 12765 470 512 512
ReadX 12765 982 512 512
ReadX 12765 1494 512 512
ReadX 12765 2006 512 512
ReadX 12765 2518 512 512
ReadX 12765 3030 512 512
ReadX 12765 3542 512 512
ReadX 12765 4054 512 512
ReadX 12765 4566 512 512
ReadX 12765 5078 512 512
ReadX 12765 5590 512 512
ReadX 12765 6102 512 512
ReadX 12765 6614 512 512
ReadX 12765 7126 512 512
ReadX 12765 7638 512 512
ReadX 12765 8150 512 512
ReadX 12765 8662 512 512
ReadX 12765 9174 512 512
ReadX 12765 9686 512 512
ReadX 12765 10198 512 512
ReadX 12765 10710 333 333
ReadX 12765 11043 512 512
ReadX 12765 11555 179 179
ReadX 12765 11734 512 512
ReadX 12765 12246 512 512
ReadX 12765 12758 512 512
ReadX 12765 13270 512 512
ReadX 12765 13782 512 512
ReadX 12765 14294 512 512
ReadX 12765 14806 512 512
ReadX 12765 15318 512 512
ReadX 12765 15830 512 512
ReadX 12765 16342 512 512
ReadX 12765 16854 512 512
ReadX 12765 17366 512 512
ReadX 12765 17878 512 512
ReadX 12765 18390 512 512
ReadX 12765 18902 512 512
ReadX 12765 19414 512 512
ReadX 12765 19926 512 512
ReadX 12765 20438 512 512
ReadX 12765 20950 512 512
ReadX 12765 21462 512 512
ReadX 12765 21974 350 350
ReadX 12765 465 512 512
ReadX 12765 3812 512 512
ReadX 12765 4046 512 512
ReadX 12765 3828 512 512
ReadX 12765 256 512 512
ReadX 12765 260 512 512
ReadX 12765 4066 512 512
ReadX 12765 4578 512 512
ReadX 12765 5090 512 512
ReadX 12765 5602 512 512
ReadX 12765 6114 512 512
ReadX 12765 6626 512 512
ReadX 12765 7138 512 512
ReadX 12765 7650 394 394
ReadX 12765 4052 118 118
ReadX 12765 4170 512 512
ReadX 12765 4682 512 512
ReadX 12765 5194 512 512
ReadX 12765 5706 512 512
ReadX 12765 6218 512 512
ReadX 12765 6730 512 512
ReadX 12765 7242 394 394
ReadX 12765 4082 118 118
ReadX 12765 4200 512 512
ReadX 12765 4712 512 512
ReadX 12765 5224 512 512
ReadX 12765 5736 512 512
ReadX 12765 6248 512 512
ReadX 12765 6760 512 512
ReadX 12765 7272 512 512
ReadX 12765 7784 394 394
ReadX 12765 256 118 118
ReadX 12765 374 512 512
ReadX 12765 886 512 512
ReadX 12765 1398 512 512
ReadX 12765 1910 512 512
ReadX 12765 2422 512 512
ReadX 12765 2934 512 512
ReadX 12765 3446 512 512
ReadX 12765 3958 512 512
ReadX 12765 4470 512 512
ReadX 12765 4982 512 512
ReadX 12765 5494 512 512
ReadX 12765 6006 512 512
ReadX 12765 6518 512 512
ReadX 12765 7030 512 512
ReadX 12765 7542 512 512
ReadX 12765 8054 512 512
ReadX 12765 8566 512 512
ReadX 12765 9078 512 512
ReadX 12765 9590 512 512
ReadX 12765 10102 512 512
ReadX 12765 259 512 512
ReadX 12765 771 512 512
ReadX 12765 259 512 512
ReadX 12765 259 512 512
ReadX 12765 771 512 512
ReadX 12765 1283 512 512
ReadX 12765 1795 512 512
ReadX 12765 2307 512 512
ReadX 12765 2819 512 512
ReadX 12765 3331 512 512
ReadX 12765 3843 512 512
ReadX 12765 4355 512 512
ReadX 12765 4867 512 512
ReadX 12765 260 512 512
ReadX 12765 772 512 512
ReadX 12765 1284 512 512
ReadX 12765 1796 512 512
ReadX 12765 2308 512 512
ReadX 12765 2820 512 512
ReadX 12765 3332 512 512
ReadX 12765 3844 512 512
ReadX 12765 4356 512 512
ReadX 12765 4868 512 512
ReadX 12765 5380 512 512
ReadX 12765 5892 512 512
ReadX 12765 6404 512 512
ReadX 12765 6916 512 512
ReadX 12765 7428 512 512
ReadX 12765 7940 512 512
ReadX 12765 8452 512 512
ReadX 12765 8964 512 512
ReadX 12765 9476 512 512
ReadX 12765 9988 512 512
ReadX 12765 10500 378 378
ReadX 12765 10878 512 512
ReadX 12765 11390 134 134
ReadX 12765 11524 512 512
ReadX 12765 12036 512 512
ReadX 12765 12548 512 512
ReadX 12765 13060 512 512
ReadX 12765 13572 138 138
ReadX 12765 259 512 512
ReadX 12765 273 512 512
ReadX 12765 276 512 512
ReadX 12765 295 512 512
ReadX 12765 288 512 512
ReadX 12765 296 512 512
ReadX 12765 259 512 512
ReadX 12765 273 512 512
ReadX 12765 273 512 512
ReadX 12765 785 512 512
ReadX 12765 1297 512 512
ReadX 12765 1809 512 512
ReadX 12765 2321 512 512
ReadX 12765 274 512 512
ReadX 12765 274 512 512
ReadX 12765 274 497 497
ReadX 12765 272 15 15
ReadX 12765 287 512 512
ReadX 12765 799 512 512
ReadX 12765 273 512 512
ReadX 12765 785 512 512
ReadX 12765 1297 512 512
ReadX 12765 1809 512 512
ReadX 12765 2321 512 512
ReadX 12765 2833 317 317
ReadX 12765 274 195 195
ReadX 12765 469 512 512
ReadX 12765 981 512 512
ReadX 12765 1493 512 512
ReadX 12765 2005 512 512
ReadX 12765 2517 512 512
ReadX 12765 3029 512 512
ReadX 12765 3541 512 512
ReadX 12765 4053 512 512
ReadX 12765 4565 250 250
ReadX 12765 274 512 512
ReadX 12765 283 512 512
ReadX 12765 795 512 512
ReadX 12765 276 512 512
ReadX 12765 788 512 512
ReadX 12765 1300 512 512
ReadX 12765 1812 512 512
ReadX 12765 2324 512 512
ReadX 12765 2836 512 512
ReadX 12765 3348 512 512
ReadX 12765 3860 420 420
ReadX 12765 275 92 92
ReadX 12765 367 512 512
ReadX 12765 879 512 512
ReadX 12765 1391 512 512
ReadX 12765 1903 512 512
ReadX 12765 2415 512 512
ReadX 12765 2927 512 512
ReadX 12765 3439 420 420
ReadX 12765 277 92 92
ReadX 12765 369 512 512
ReadX 12765 881 512 512
ReadX 12765 1393 512 512
ReadX 12765 1905 512 512
ReadX 12765 2417 512 512
ReadX 12765 2929 512 512
ReadX 12765 3441 512 512
ReadX 12765 3953 512 512
ReadX 12765 4465 512 512
ReadX 12765 4977 512 512
ReadX 12765 5489 512 512
ReadX 12765 6001 512 512
ReadX 12765 6513 512 512
ReadX 12765 7025 512 512
ReadX 12765 7537 512 512
ReadX 12765 8049 512 512
ReadX 12765 8561 512 512
ReadX 12765 9073 512 512
ReadX 12765 9585 512 512
ReadX 12765 10097 512 512
ReadX 12765 282 512 512
ReadX 12765 794 512 512
ReadX 12765 1306 512 512
ReadX 12765 1818 512 512
ReadX 12765 2330 512 512
ReadX 12765 2842 512 512
ReadX 12765 3354 512 512
ReadX 12765 3866 512 512
ReadX 12765 4378 512 512
ReadX 12765 284 512 512
ReadX 12765 796 512 512
ReadX 12765 1308 512 512
ReadX 12765 1820 512 512
ReadX 12765 2332 512 512
ReadX 12765 2844 512 512
ReadX 12765 3356 512 512
ReadX 12765 3868 512 512
ReadX 12765 4380 512 512
ReadX 12765 4892 512 512
ReadX 12765 5404 512 512
ReadX 12765 5916 512 512
ReadX 12765 6428 512 512
ReadX 12765 6940 512 512
ReadX 12765 7452 512 512
ReadX 12765 7964 512 512
ReadX 12765 8476 512 512
ReadX 12765 8988 512 512
ReadX 12765 9500 512 512
ReadX 12765 10012 512 512
ReadX 12765 10524 472 472
ReadX 12765 288 40 40
ReadX 12765 328 512 512
ReadX 12765 840 512 512
ReadX 12765 1352 512 512
ReadX 12765 1864 512 512
ReadX 12765 2376 512 512
ReadX 12765 2888 512 512
ReadX 12765 3400 512 512
ReadX 12765 3912 512 512
ReadX 12765 4424 512 512
ReadX 12765 4936 512 512
ReadX 12765 5448 512 512
ReadX 12765 5960 512 512
ReadX 12765 6472 512 512
ReadX 12765 6984 512 512
ReadX 12765 7496 512 512
ReadX 12765 8008 512 512
ReadX 12765 8520 512 512
ReadX 12765 9032 512 512
ReadX 12765 9544 512 512
ReadX 12765 10056 512 512
ReadX 12765 10568 506 506
ReadX 12765 282 512 512
ReadX 12765 794 512 512
ReadX 12765 301 512 512
ReadX 12765 296 512 512
ReadX 12765 808 512 512
ReadX 12765 1320 512 512
ReadX 12765 1832 512 512
ReadX 12765 2344 512 512
ReadX 12765 2856 512 512
ReadX 12765 3368 512 512
ReadX 12765 3880 424 424
ReadX 12765 295 88 88
ReadX 12765 383 512 512
ReadX 12765 895 512 512
ReadX 12765 1407 512 512
ReadX 12765 1919 512 512
ReadX 12765 2431 512 512
ReadX 12765 2943 512 512
ReadX 12765 3455 424 424
ReadX 12765 297 88 88
ReadX 12765 385 512 512
ReadX 12765 897 512 512
ReadX 12765 1409 512 512
ReadX 12765 1921 512 512
ReadX 12765 2433 512 512
ReadX 12765 2945 512 512
ReadX 12765 3457 512 512
ReadX 12765 3969 512 512
ReadX 12765 4481 512 512
ReadX 12765 4993 512 512
ReadX 12765 5505 512 512
ReadX 12765 6017 512 512
ReadX 12765 6529 512 512
ReadX 12765 7041 512 512
ReadX 12765 7553 512 512
ReadX 12765 8065 512 512
ReadX 12765 8577 512 512
ReadX 12765 9089 512 512
ReadX 12765 9601 512 512
ReadX 12765 10113 512 512
ReadX 12765 301 512 512
ReadX 12765 301 512 512
ReadX 12765 301 512 512
ReadX 12765 813 512 512
ReadX 12765 301 512 512
ReadX 12765 813 512 512
ReadX 12765 1325 512 512
ReadX 12765 1837 512 512
ReadX 12765 2349 512 512
ReadX 12765 2861 512 512
ReadX 12765 3373 512 512
ReadX 12765 3885 512 512
ReadX 12765 4397 512 512
ReadX 12765 4909 512 512
ReadX 12765 5421 512 512
ReadX 12765 5933 512 512
ReadX 12765 6445 512 512
ReadX 12765 6957 512 512
ReadX 12765 7469 512 512
ReadX 12765 7981 512 512
ReadX 12765 8493 512 512
ReadX 12765 9005 512 512
ReadX 12765 9517 463 463
ReadX 12765 9980 512 512
ReadX 12765 10492 49 49
ReadX 12765 10541 512 512
ReadX 12765 11053 512 512
ReadX 12765 11565 512 512
ReadX 12765 12077 512 512
ReadX 12765 12589 512 512
ReadX 12765 13101 512 512
ReadX 12765 13613 512 512
ReadX 12765 14125 512 512
ReadX 12765 14637 512 512
ReadX 12765 15149 512 512
ReadX 12765 15661 512 512
ReadX 12765 16173 512 512
ReadX 12765 16685 512 512
ReadX 12765 17197 512 512
ReadX 12765 17709 512 512
ReadX 12765 18221 512 512
ReadX 12765 18733 512 512
ReadX 12765 19245 512 512
ReadX 12765 19757 512 512
ReadX 12765 20269 512 512
ReadX 12765 20781 326 326
ReadX 12765 301 512 512
QUERY_FS_INFORMATION 259
Close 12763
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12766
Close 12766
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12767
ReadX 12767 0 24 24
Close 12767
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12768
QUERY_FILE_INFORMATION 12768
ReadX 12768 0 512 512
ReadX 12768 476 512 512
ReadX 12768 510 512 512
ReadX 12768 484 512 512
ReadX 12768 474 512 512
ReadX 12768 478 512 512
ReadX 12768 990 512 512
ReadX 12768 509 57 57
Close 12768
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12769
QUERY_FILE_INFORMATION 12769
ReadX 12769 0 512 512
ReadX 12769 476 512 512
ReadX 12769 510 512 512
ReadX 12769 484 512 512
ReadX 12769 480 512 512
ReadX 12769 474 512 512
ReadX 12769 478 512 512
QUERY_FILE_INFORMATION 12769
WriteX 12769 494 60 60
WriteX 12769 494 4 4
QUERY_FILE_INFORMATION 12769
WriteX 12769 494 11 11
WriteX 12769 510 512 512
WriteX 12769 484 512 512
WriteX 12769 474 512 512
WriteX 12769 478 512 512
WriteX 12769 990 512 512
Close 12769
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 12770
Close 12770
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12771
Close 12771
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12773
WriteX 12773 4607 1 1
QUERY_FILE_INFORMATION 12773
WriteX 12773 0 65471 65471
WriteX 12773 65471 65 65
WriteX 12773 65536 19490 19490
Close 12773
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12774
QUERY_FILE_INFORMATION 12774
ReadX 12774 0 512 512
ReadX 12774 482 512 512
ReadX 12774 994 512 512
ReadX 12774 1506 512 512
ReadX 12774 480 512 512
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 490 448 448
QUERY_FILE_INFORMATION 12774
WriteX 12774 490 60 60
WriteX 12774 490 4 4
QUERY_FILE_INFORMATION 12774
WriteX 12774 490 11 11
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 484 512 512
WriteX 12774 996 512 512
WriteX 12774 1508 512 512
WriteX 12774 482 512 512
WriteX 12774 0 512 512
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
ReadX 12774 490 512 512
WriteX 12774 502 512 512
WriteX 12774 502 292 292
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 503 20 20
WriteX 12774 503 108 108
QUERY_FILE_INFORMATION 12774
WriteX 12774 504 448 448
QUERY_FILE_INFORMATION 12774
WriteX 12774 504 44 44
WriteX 12774 504 20 20
WriteX 12774 500 512 512
WriteX 12774 492 512 512
WriteX 12774 496 512 512
WriteX 12774 1008 512 512
WriteX 12774 494 512 512
Flush 12774
WriteX 12774 0 512 512
Flush 12774
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 500 512 512
WriteX 12774 492 512 512
WriteX 12774 496 512 512
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 518 320 320
QUERY_FILE_INFORMATION 12774
WriteX 12774 518 60 60
ReadX 12774 504 512 512
WriteX 12774 522 512 512
WriteX 12774 506 3204 3204
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 519 25 25
WriteX 12774 518 103 103
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 519 44 44
WriteX 12774 519 20 20
WriteX 12774 520 512 512
WriteX 12774 482 512 512
WriteX 12774 486 512 512
WriteX 12774 998 512 512
WriteX 12774 484 512 512
WriteX 12774 490 512 512
Flush 12774
WriteX 12774 0 512 512
Flush 12774
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
QUERY_FILE_INFORMATION 12774
WriteX 12774 519 7 7
WriteX 12774 519 57 57
WriteX 12774 520 512 512
WriteX 12774 492 512 512
WriteX 12774 482 512 512
WriteX 12774 486 512 512
WriteX 12774 998 512 512
Flush 12774
WriteX 12774 520 512 512
Flush 12774
Close 12774
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12775
Close 12775
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12776
QUERY_FILE_INFORMATION 12776
ReadX 12776 0 512 512
ReadX 12776 490 512 512
ReadX 12776 484 512 512
ReadX 12776 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 12777
Close 12777
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12776
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12778
Close 12778
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12779
ReadX 12779 0 24 24
Close 12779
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12780
QUERY_FILE_INFORMATION 12780
ReadX 12780 0 512 512
ReadX 12780 366 512 512
ReadX 12780 878 512 512
ReadX 12780 1390 512 512
ReadX 12780 1902 512 512
ReadX 12780 374 57 57
Close 12780
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12781
QUERY_FILE_INFORMATION 12781
ReadX 12781 0 512 512
ReadX 12781 366 512 512
ReadX 12781 878 512 512
ReadX 12781 1390 512 512
ReadX 12781 1902 512 512
QUERY_FILE_INFORMATION 12781
WriteX 12781 374 60 60
WriteX 12781 374 4 4
QUERY_FILE_INFORMATION 12781
WriteX 12781 374 11 11
ReadX 12781 374 57 57
ReadX 12781 374 57 57
ReadX 12781 292 4096 4096
ReadX 12781 364 512 512
ReadX 12781 512 4096 4096
ReadX 12781 4608 4096 4096
ReadX 12781 8704 4096 4096
ReadX 12781 12800 4096 4096
ReadX 12781 16896 4096 4096
ReadX 12781 20992 4096 4096
ReadX 12781 25088 4096 4096
ReadX 12781 29184 4096 4096
ReadX 12781 33280 4096 4096
ReadX 12781 37376 4096 4096
ReadX 12781 41472 4096 4096
ReadX 12781 45568 4096 4096
ReadX 12781 49664 4096 4096
ReadX 12781 53760 4096 4096
ReadX 12781 57856 4096 4096
ReadX 12781 61952 4096 4096
ReadX 12781 66048 4096 4096
ReadX 12781 70144 4096 4096
ReadX 12781 74240 162 162
ReadX 12781 308 4096 4096
ReadX 12781 4404 4096 4096
WriteX 12781 368 512 512
WriteX 12781 880 512 512
WriteX 12781 1392 512 512
Close 12781
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12782
Close 12782
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12783
QUERY_FILE_INFORMATION 12783
ReadX 12783 0 512 512
ReadX 12783 366 512 512
ReadX 12783 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12784
Close 12784
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12783
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12786
WriteX 12786 4607 1 1
QUERY_FILE_INFORMATION 12786
WriteX 12786 0 65471 65471
WriteX 12786 65471 65 65
WriteX 12786 65536 8866 8866
Close 12786
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12787
QUERY_FILE_INFORMATION 12787
ReadX 12787 0 512 512
ReadX 12787 366 512 512
ReadX 12787 878 512 512
ReadX 12787 1390 512 512
ReadX 12787 364 512 512
QUERY_FILE_INFORMATION 12787
QUERY_FILE_INFORMATION 12787
QUERY_FILE_INFORMATION 12787
WriteX 12787 374 448 448
QUERY_FILE_INFORMATION 12787
WriteX 12787 374 60 60
WriteX 12787 374 4 4
QUERY_FILE_INFORMATION 12787
WriteX 12787 374 11 11
QUERY_FILE_INFORMATION 12787
QUERY_FILE_INFORMATION 12787
WriteX 12787 374 7 7
WriteX 12787 374 57 57
WriteX 12787 368 512 512
WriteX 12787 880 512 512
WriteX 12787 1392 512 512
WriteX 12787 366 512 512
WriteX 12787 0 512 512
Flush 12787
WriteX 12787 368 512 512
Flush 12787
Close 12787
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12788
QUERY_FILE_INFORMATION 12788
ReadX 12788 0 512 512
ReadX 12788 366 512 512
ReadX 12788 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12788
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12789
Close 12789
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12790
ReadX 12790 0 24 24
Close 12790
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12791
QUERY_FILE_INFORMATION 12791
ReadX 12791 0 512 512
ReadX 12791 366 512 512
ReadX 12791 878 512 512
ReadX 12791 1390 512 512
ReadX 12791 1902 512 512
ReadX 12791 374 57 57
Close 12791
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12792
QUERY_FILE_INFORMATION 12792
ReadX 12792 0 512 512
ReadX 12792 366 512 512
ReadX 12792 878 512 512
ReadX 12792 1390 512 512
ReadX 12792 1902 512 512
QUERY_FILE_INFORMATION 12792
WriteX 12792 374 60 60
WriteX 12792 374 4 4
QUERY_FILE_INFORMATION 12792
WriteX 12792 374 11 11
WriteX 12792 368 512 512
WriteX 12792 880 512 512
WriteX 12792 1392 512 512
Close 12792
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 12793
Close 12793
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12794
Close 12794
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12796
WriteX 12796 4607 1 1
QUERY_FILE_INFORMATION 12796
WriteX 12796 0 65471 65471
WriteX 12796 65471 65 65
WriteX 12796 65536 9298 9298
Close 12796
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12797
QUERY_FILE_INFORMATION 12797
ReadX 12797 0 512 512
ReadX 12797 368 512 512
ReadX 12797 880 512 512
ReadX 12797 1392 512 512
ReadX 12797 366 512 512
QUERY_FILE_INFORMATION 12797
QUERY_FILE_INFORMATION 12797
QUERY_FILE_INFORMATION 12797
WriteX 12797 376 448 448
QUERY_FILE_INFORMATION 12797
WriteX 12797 376 60 60
WriteX 12797 376 4 4
QUERY_FILE_INFORMATION 12797
WriteX 12797 376 11 11
QUERY_FILE_INFORMATION 12797
QUERY_FILE_INFORMATION 12797
WriteX 12797 376 7 7
WriteX 12797 376 57 57
WriteX 12797 370 512 512
WriteX 12797 882 512 512
WriteX 12797 1394 512 512
WriteX 12797 368 512 512
WriteX 12797 0 512 512
Flush 12797
WriteX 12797 370 512 512
Flush 12797
Close 12797
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12798
Close 12798
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12799
QUERY_FILE_INFORMATION 12799
ReadX 12799 0 512 512
ReadX 12799 368 512 512
ReadX 12799 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 12800
Close 12800
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12802
Close 12802
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12803
ReadX 12803 0 24 24
Close 12803
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12804
QUERY_FILE_INFORMATION 12804
ReadX 12804 0 512 512
ReadX 12804 512 512 512
ReadX 12804 1024 512 512
ReadX 12804 2016 512 512
ReadX 12804 1056 512 512
ReadX 12804 1096 57 57
Close 12804
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12805
QUERY_FILE_INFORMATION 12805
ReadX 12805 0 512 512
ReadX 12805 512 512 512
ReadX 12805 1024 512 512
ReadX 12805 2016 512 512
ReadX 12805 1056 512 512
ReadX 12805 1096 57 57
ReadX 12805 1096 57 57
ReadX 12805 1088 62 62
ReadX 12805 1536 4096 4096
ReadX 12805 5632 4096 4096
ReadX 12805 9728 4096 4096
ReadX 12805 13824 2859 2859
ReadX 12805 1120 28 28
ReadX 12805 1148 20 20
ReadX 12805 1168 8 8
ReadX 12805 1176 88 88
ReadX 12805 1264 8 8
ReadX 12805 1272 4 4
ReadX 12805 1276 4 4
ReadX 12805 1280 1 1
ReadX 12805 1130 4 4
ReadX 12805 1134 4 4
ReadX 12805 1138 1 1
ReadX 12805 1131 4 4
ReadX 12805 1135 4 4
ReadX 12805 1139 1 1
ReadX 12805 1131 4 4
ReadX 12805 1135 4 4
ReadX 12805 1139 2 2
ReadX 12805 1132 4 4
ReadX 12805 1136 4 4
ReadX 12805 1140 25 25
ReadX 12805 1134 4 4
ReadX 12805 1138 8 8
ReadX 12805 1146 4 4
ReadX 12805 1150 8 8
ReadX 12805 1158 4 4
ReadX 12805 1162 8 8
ReadX 12805 1170 4 4
ReadX 12805 1174 4 4
ReadX 12805 1178 4 4
ReadX 12805 1182 4 4
ReadX 12805 1186 4 4
ReadX 12805 1190 4 4
ReadX 12805 1194 13900 13900
ReadX 12805 2048 4096 4096
Close 12805
QUERY_FS_INFORMATION 259
Close 12799
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12806
Close 12806
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12807
ReadX 12807 0 24 24
Close 12807
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12808
QUERY_FILE_INFORMATION 12808
ReadX 12808 0 512 512
ReadX 12808 368 512 512
ReadX 12808 880 512 512
ReadX 12808 1392 512 512
ReadX 12808 1904 512 512
ReadX 12808 376 57 57
Close 12808
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12809
QUERY_FILE_INFORMATION 12809
ReadX 12809 0 512 512
ReadX 12809 368 512 512
ReadX 12809 880 512 512
ReadX 12809 1392 512 512
ReadX 12809 1904 512 512
QUERY_FILE_INFORMATION 12809
WriteX 12809 376 60 60
WriteX 12809 376 4 4
QUERY_FILE_INFORMATION 12809
WriteX 12809 376 11 11
WriteX 12809 370 512 512
WriteX 12809 882 512 512
WriteX 12809 1394 512 512
Close 12809
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 12810
Close 12810
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12811
Close 12811
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12813
WriteX 12813 4607 1 1
QUERY_FILE_INFORMATION 12813
WriteX 12813 0 65471 65471
WriteX 12813 65471 65 65
WriteX 12813 65536 11540 11540
Close 12813
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12814
QUERY_FILE_INFORMATION 12814
ReadX 12814 0 512 512
ReadX 12814 398 512 512
ReadX 12814 910 512 512
ReadX 12814 1422 512 512
ReadX 12814 396 512 512
QUERY_FILE_INFORMATION 12814
QUERY_FILE_INFORMATION 12814
QUERY_FILE_INFORMATION 12814
WriteX 12814 406 448 448
QUERY_FILE_INFORMATION 12814
WriteX 12814 406 60 60
WriteX 12814 406 4 4
QUERY_FILE_INFORMATION 12814
WriteX 12814 406 11 11
QUERY_FILE_INFORMATION 12814
QUERY_FILE_INFORMATION 12814
WriteX 12814 406 7 7
WriteX 12814 406 57 57
WriteX 12814 400 512 512
WriteX 12814 912 512 512
WriteX 12814 1424 512 512
WriteX 12814 398 512 512
WriteX 12814 0 512 512
Flush 12814
WriteX 12814 400 512 512
Flush 12814
Close 12814
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12815
Close 12815
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12816
QUERY_FILE_INFORMATION 12816
ReadX 12816 0 512 512
ReadX 12816 398 512 512
ReadX 12816 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 12817
Close 12817
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12816
ReadX 12765 1434 512 512
Close 12765
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12818
WriteX 12818 0 65471 65471
WriteX 12818 65471 63 63
WriteX 12818 65534 65471 65471
WriteX 12818 131005 63 63
Close 12818
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12819
WriteX 12819 0 65471 65471
WriteX 12819 65471 63 63
WriteX 12819 65534 65471 65471
WriteX 12819 131005 63 63
WriteX 12819 131068 65471 65471
WriteX 12819 196539 63 63
WriteX 12819 196602 65471 65471
WriteX 12819 262073 63 63
Close 12819
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12820
WriteX 12820 0 65471 65471
WriteX 12820 65471 63 63
WriteX 12820 65534 65471 65471
WriteX 12820 131005 63 63
WriteX 12820 131068 65471 65471
WriteX 12820 196539 63 63
WriteX 12820 196602 65471 65471
WriteX 12820 262073 63 63
WriteX 12820 262136 65471 65471
WriteX 12820 327607 63 63
WriteX 12820 327670 65471 65471
WriteX 12820 393141 63 63
WriteX 12820 393204 65471 65471
WriteX 12820 458675 63 63
WriteX 12820 458738 65471 65471
WriteX 12820 524209 63 63
Close 12820
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12821
Close 12821
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12822
ReadX 12822 0 512 512
ReadX 12822 512 511 511
ReadX 12822 1023 512 512
ReadX 12822 1535 512 512
Close 12822
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12823
ReadX 12823 0 512 512
ReadX 12823 512 510 510
ReadX 12823 1022 512 512
ReadX 12823 1534 510 510
ReadX 12823 2044 510 510
Close 12823
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 12824
ReadX 12824 0 512 512
ReadX 12824 512 512 512
ReadX 12824 1024 512 512
ReadX 12824 1536 512 512
ReadX 12824 2048 512 512
ReadX 12824 2560 512 512
ReadX 12824 3072 512 512
ReadX 12824 3584 512 512
ReadX 12824 4096 512 512
ReadX 12824 4608 512 512
ReadX 12824 5120 512 512
ReadX 12824 5632 512 512
ReadX 12824 6144 512 512
ReadX 12824 6656 512 512
ReadX 12824 7168 512 512
ReadX 12824 7680 512 512
ReadX 12824 8192 512 512
ReadX 12824 8704 512 512
Close 12824
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12825
Close 12825
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12826
QUERY_FILE_INFORMATION 12826
Close 12826
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12827
ReadX 12827 0 8192 8192
Close 12827
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12828
Close 12828
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12829
QUERY_FILE_INFORMATION 12829
Close 12829
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12830
ReadX 12830 0 8192 8192
Close 12830
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12831
Close 12831
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12832
QUERY_FILE_INFORMATION 12832
Close 12832
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12833
ReadX 12833 0 8192 8192
Close 12833
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 12834
ReadX 12834 0 8192 8192
ReadX 12834 8192 8192 8192
ReadX 12834 16384 8192 8192
ReadX 12834 24576 8192 8192
Close 12834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12836
Close 12836
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12838
WriteX 12838 8191 1 1
QUERY_FILE_INFORMATION 12838
WriteX 12838 0 10438 10438
Close 12838
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12839
Close 12839
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12840
QUERY_FILE_INFORMATION 12840
QUERY_FILE_INFORMATION 12840
Close 12840
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 12841
QUERY_FILE_INFORMATION 12841
QUERY_FILE_INFORMATION 12841
Close 12841
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12842
Close 12842
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12843
QUERY_FILE_INFORMATION 12843
QUERY_FILE_INFORMATION 12843
Close 12843
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 12844
QUERY_FILE_INFORMATION 12844
QUERY_FILE_INFORMATION 12844
Close 12844
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12845
Close 12845
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12846
QUERY_FILE_INFORMATION 12846
QUERY_FILE_INFORMATION 12846
Close 12846
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 12847
QUERY_FILE_INFORMATION 12847
QUERY_FILE_INFORMATION 12847
Close 12847
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12848
Close 12848
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12849
QUERY_FILE_INFORMATION 12849
QUERY_FILE_INFORMATION 12849
Close 12849
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12850
ReadX 12850 0 8 8
ReadX 12850 8 4 4
ReadX 12850 12 8 8
ReadX 12850 22 8 8
ReadX 12850 520 8 8
ReadX 12850 525 8 8
ReadX 12850 533 4 4
ReadX 12850 543 8 8
ReadX 12850 551 4 4
ReadX 12850 1058 8 8
ReadX 12850 1066 4 4
ReadX 12850 1081 8 8
ReadX 12850 1089 4 4
ReadX 12850 660 8 8
Close 12850
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12851
ReadX 12851 0 8192 8192
Close 12851
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 12852
ReadX 12852 0 8192 8192
ReadX 12852 520 8192 8192
ReadX 12852 8712 8192 8192
ReadX 12852 16904 8192 8192
ReadX 12852 25096 8192 8192
ReadX 12852 33288 8192 8192
ReadX 12852 41480 8192 8192
ReadX 12852 49672 8192 8192
ReadX 12852 57864 8192 8192
ReadX 12852 66056 8192 8192
ReadX 12852 74248 8192 8192
ReadX 12852 82440 8192 8192
ReadX 12852 90632 8192 8192
ReadX 12852 98824 8192 8192
ReadX 12852 107016 8192 8192
ReadX 12852 115208 8192 8192
ReadX 12852 123400 8192 8192
ReadX 12852 131592 8192 8192
ReadX 12852 139784 8192 8192
ReadX 12852 147976 8192 8192
ReadX 12852 156168 8192 8192
Close 12852
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 12853
QUERY_FILE_INFORMATION 12853
Close 12853
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 12854
Close 12854
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 12856
WriteX 12856 8191 1 1
QUERY_FILE_INFORMATION 12856
WriteX 12856 0 28489 28489
Close 12856
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12857
Close 12857
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12858
Close 12858
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12859
QUERY_FILE_INFORMATION 12859
Close 12859
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12860
ReadX 12860 0 8192 8192
Close 12860
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12861
Close 12861
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12862
QUERY_FILE_INFORMATION 12862
Close 12862
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 12863
ReadX 12863 0 8192 8192
Close 12863
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 12864
ReadX 12864 0 8192 8192
ReadX 12864 8192 8192 8192
ReadX 12864 16384 8192 8192
ReadX 12864 24576 8192 8192
ReadX 12864 32768 16384 16384
ReadX 12864 49152 8192 8192
ReadX 12864 57344 8192 8192
ReadX 12864 65536 8192 8192
Close 12864
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12866
Close 12866
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12868
WriteX 12868 8191 1 1
QUERY_FILE_INFORMATION 12868
WriteX 12868 0 29253 29253
Close 12868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12869
Close 12869
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12870
QUERY_FILE_INFORMATION 12870
QUERY_FILE_INFORMATION 12870
Close 12870
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 12871
QUERY_FILE_INFORMATION 12871
QUERY_FILE_INFORMATION 12871
Close 12871
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 12872
QUERY_FILE_INFORMATION 12872
Close 12872
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 12873
Close 12873
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 12875
WriteX 12875 8191 1 1
QUERY_FILE_INFORMATION 12875
WriteX 12875 0 30183 30183
Close 12875
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 12876
Close 12876
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 12877
WriteX 12877 0 510 510
WriteX 12877 510 512 512
WriteX 12877 1022 510 510
WriteX 12877 1532 510 510
WriteX 12877 2042 168 168
Close 12877
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 12878
Close 12878
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 12879
WriteX 12879 0 511 511
WriteX 12879 511 512 512
WriteX 12879 1023 512 512
WriteX 12879 1535 488 488
Close 12879
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12880
ReadX 12880 0 65471 65471
ReadX 12880 65471 63 63
ReadX 12880 65534 65471 65471
ReadX 12880 131005 63 63
ReadX 12880 131068 65471 65471
ReadX 12880 196539 63 63
ReadX 12880 196602 65471 65471
ReadX 12880 262073 63 63
ReadX 12880 262136 65471 65471
ReadX 12880 327607 63 63
ReadX 12880 327670 10 10
Close 12880
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12881
ReadX 12881 0 65471 65471
ReadX 12881 65471 63 63
ReadX 12881 65534 65471 65471
ReadX 12881 131005 63 63
ReadX 12881 131068 65471 65471
ReadX 12881 196539 63 63
ReadX 12881 196602 65471 65471
ReadX 12881 262073 63 63
ReadX 12881 262136 65471 65471
ReadX 12881 327607 63 63
ReadX 12881 327670 65471 65471
ReadX 12881 393141 63 63
ReadX 12881 393204 65471 65471
ReadX 12881 458675 63 63
ReadX 12881 458738 65471 65471
ReadX 12881 524209 63 63
ReadX 12881 524272 65471 65471
ReadX 12881 589743 63 63
ReadX 12881 589806 65471 65471
ReadX 12881 655277 63 63
ReadX 12881 655340 32 32
Close 12881
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12882
ReadX 12882 0 65471 65471
ReadX 12882 65471 63 63
ReadX 12882 65534 65471 65471
ReadX 12882 131005 63 63
ReadX 12882 131068 65471 65471
ReadX 12882 196539 63 63
ReadX 12882 196602 65471 65471
ReadX 12882 262073 63 63
ReadX 12882 262136 65471 65471
ReadX 12882 327607 63 63
ReadX 12882 327670 65471 65471
ReadX 12882 393141 63 63
ReadX 12882 393204 65471 65471
ReadX 12882 458675 63 63
ReadX 12882 458738 65471 65471
ReadX 12882 524209 63 63
ReadX 12882 524272 65471 65471
ReadX 12882 589743 63 63
ReadX 12882 589806 65471 65471
ReadX 12882 655277 63 63
ReadX 12882 655340 65471 65471
ReadX 12882 720811 63 63
ReadX 12882 720874 65471 65471
ReadX 12882 786345 63 63
ReadX 12882 786408 65471 65471
ReadX 12882 851879 63 63
ReadX 12882 851942 65471 65471
ReadX 12882 917413 63 63
ReadX 12882 917476 65471 65471
ReadX 12882 982947 63 63
ReadX 12882 983010 65471 65471
ReadX 12882 1048481 63 63
ReadX 12882 1048544 65471 65471
ReadX 12882 1114015 63 63
ReadX 12882 1114078 65471 65471
ReadX 12882 1179549 63 63
ReadX 12882 1179612 65471 65471
ReadX 12882 1245083 63 63
ReadX 12882 1245146 65471 65471
ReadX 12882 1310617 63 63
ReadX 12882 1310680 65471 65471
ReadX 12882 1376151 63 63
ReadX 12882 1376214 65471 65471
ReadX 12882 1441685 63 63
ReadX 12882 1441748 65471 65471
ReadX 12882 1507219 63 63
ReadX 12882 1507282 65471 65471
ReadX 12882 1572753 63 63
ReadX 12882 1572816 65471 65471
ReadX 12882 1638287 63 63
ReadX 12882 1638350 65471 65471
ReadX 12882 1703821 63 63
ReadX 12882 1703884 65471 65471
ReadX 12882 1769355 63 63
ReadX 12882 1769418 65471 65471
ReadX 12882 1834889 63 63
ReadX 12882 1834952 32824 32824
Close 12882
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12883
QUERY_FILE_INFORMATION 12883
ReadX 12883 0 512 512
ReadX 12883 512 512 512
ReadX 12883 1024 512 512
QUERY_FILE_INFORMATION 12883
QUERY_FILE_INFORMATION 12883
ReadX 12883 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 12883
QUERY_FILE_INFORMATION 12883
ReadX 12883 512 4096 4096
QUERY_FILE_INFORMATION 12883
QUERY_FILE_INFORMATION 12883
QUERY_FILE_INFORMATION 12883
WriteX 12883 512 4096 4096
WriteX 12883 1024 512 512
ReadX 12883 502 512 512
QUERY_FILE_INFORMATION 12883
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12883 2560 512 512
ReadX 12883 1536 512 512
ReadX 12883 2176 384 384
ReadX 12883 3072 128 128
ReadX 12883 3107 512 512
ReadX 12883 3619 512 512
ReadX 12883 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12883 286 123 123
ReadX 12883 292 24 24
ReadX 12883 512 2048 2048
ReadX 12883 512 2048 2048
ReadX 12883 2560 2048 2048
ReadX 12883 416 1536 1536
ReadX 12883 768 512 512
ReadX 12883 1280 2048 2048
ReadX 12883 3328 2048 2048
ReadX 12883 5376 2048 2048
ReadX 12883 7424 2048 2048
ReadX 12883 9472 2048 2048
ReadX 12883 11520 2048 2048
ReadX 12883 13568 2048 2048
ReadX 12883 15616 2048 2048
ReadX 12883 17664 2048 2048
ReadX 12883 19712 2048 2048
ReadX 12883 21760 2048 2048
ReadX 12883 23808 2048 2048
ReadX 12883 25856 2048 2048
ReadX 12883 27904 2048 2048
ReadX 12883 29952 2048 2048
ReadX 12883 32000 2048 2048
ReadX 12883 34048 2048 2048
ReadX 12883 36096 2048 2048
ReadX 12883 38144 2048 2048
ReadX 12883 40192 2048 2048
ReadX 12883 42240 512 512
ReadX 12883 42752 2048 2048
ReadX 12883 44800 2048 2048
ReadX 12883 46848 2048 2048
ReadX 12883 48896 2048 2048
ReadX 12883 50944 2048 2048
ReadX 12883 52992 2048 2048
ReadX 12883 55040 2048 2048
ReadX 12883 57088 2048 2048
ReadX 12883 316 2048 2048
ReadX 12883 2364 2048 2048
ReadX 12883 4412 2048 2048
ReadX 12883 6460 2048 2048
ReadX 12883 8508 2048 2048
ReadX 12883 10556 2048 2048
ReadX 12883 12604 2048 2048
ReadX 12883 14652 2048 2048
ReadX 12883 16700 2048 2048
ReadX 12883 18748 2048 2048
ReadX 12883 20796 2048 2048
ReadX 12883 22844 2048 2048
ReadX 12883 24892 2048 2048
ReadX 12883 26940 2048 2048
ReadX 12883 28988 2048 2048
ReadX 12883 31036 2048 2048
ReadX 12883 436 2048 2048
ReadX 12883 2484 2048 2048
ReadX 12883 4532 2048 2048
ReadX 12883 6580 2048 2048
ReadX 12883 8628 2048 2048
ReadX 12883 10676 2048 2048
ReadX 12883 476 2048 2048
ReadX 12883 476 2048 2048
ReadX 12883 476 2048 2048
ReadX 12883 2524 2048 2048
ReadX 12883 484 2048 2048
ReadX 12883 484 2048 2048
ReadX 12883 484 2048 2048
ReadX 12883 2532 665 665
ReadX 12883 492 665 665
ReadX 12883 492 665 665
ReadX 12883 492 665 665
ReadX 12883 296 512 512
ReadX 12883 318 512 512
ReadX 12883 300 512 512
ReadX 12883 312 512 512
ReadX 12883 320 512 512
ReadX 12883 832 354 354
ReadX 12883 504 4096 4096
ReadX 12883 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 12884
Close 12884
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 12885
WriteX 12885 1535 1 1
QUERY_FILE_INFORMATION 12885
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12883 296 1251 1251
ReadX 12883 2176 384 384
ReadX 12883 3072 1634 1634
QUERY_FILE_INFORMATION 12885
WriteX 12885 0 57088 57088
WriteX 12885 0 4096 4096
Flush 12885
Close 12883
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 12886
Close 12886
WriteX 12885 0 4096 4096
Close 12885
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 12887
Close 12887
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12888
QUERY_FILE_INFORMATION 12888
ReadX 12888 0 512 512
ReadX 12888 512 512 512
ReadX 12888 1024 512 512
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
ReadX 12888 512 2048 2048
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12888 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 12889
WriteX 12889 1535 1 1
QUERY_FILE_INFORMATION 12889
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12888 1536 512 512
ReadX 12888 288 1251 1251
ReadX 12888 2048 2018 2018
QUERY_FILE_INFORMATION 12889
WriteX 12889 0 51456 51456
WriteX 12889 0 4096 4096
Flush 12889
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
Close 12888
WriteX 12889 0 4096 4096
Close 12889
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 12890
Close 12890
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12891
QUERY_FILE_INFORMATION 12891
ReadX 12891 0 512 512
ReadX 12891 512 512 512
ReadX 12891 1024 512 512
QUERY_FILE_INFORMATION 12891
QUERY_FILE_INFORMATION 12891
ReadX 12891 512 2048 2048
QUERY_FILE_INFORMATION 12891
QUERY_FILE_INFORMATION 12891
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12891 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12893
Close 12893
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 12895
WriteX 12895 4045 1 1
QUERY_FILE_INFORMATION 12895
WriteX 12895 0 53077 53077
Close 12895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 12896
WriteX 12896 1535 1 1
QUERY_FILE_INFORMATION 12896
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12891 1536 512 512
ReadX 12891 288 1251 1251
ReadX 12891 2048 2018 2018
QUERY_FILE_INFORMATION 12896
WriteX 12896 0 65471 65471
WriteX 12896 65471 65 65
WriteX 12896 65536 1856 1856
WriteX 12896 0 4096 4096
Flush 12896
QUERY_FILE_INFORMATION 12891
QUERY_FILE_INFORMATION 12891
Close 12891
WriteX 12896 0 4096 4096
Close 12896
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 12897
Close 12897
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12898
QUERY_FILE_INFORMATION 12898
ReadX 12898 0 512 512
ReadX 12898 512 512 512
ReadX 12898 1024 512 512
QUERY_FILE_INFORMATION 12898
QUERY_FILE_INFORMATION 12898
ReadX 12898 576 2048 2048
QUERY_FILE_INFORMATION 12898
QUERY_FILE_INFORMATION 12898
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12900
Close 12900
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 12902
WriteX 12902 4076 1 1
QUERY_FILE_INFORMATION 12902
WriteX 12902 0 7983 7983
Close 12902
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12904
Close 12904
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 12906
WriteX 12906 4095 1 1
QUERY_FILE_INFORMATION 12906
WriteX 12906 0 65471 65471
WriteX 12906 65471 65 65
WriteX 12906 65536 65471 65471
WriteX 12906 131007 65 65
WriteX 12906 131072 65471 65471
WriteX 12906 196543 65 65
WriteX 12906 196608 65471 65471
WriteX 12906 262079 65 65
WriteX 12906 262144 65471 65471
WriteX 12906 327615 65 65
WriteX 12906 327680 65471 65471
WriteX 12906 393151 65 65
WriteX 12906 393216 65471 65471
WriteX 12906 458687 65 65
WriteX 12906 458752 46731 46731
Close 12906
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 12907
WriteX 12907 1535 1 1
QUERY_FILE_INFORMATION 12907
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12898 1536 512 512
ReadX 12898 2048 2018 2018
ReadX 12898 4096 512 512
ReadX 12898 4608 2197 2197
QUERY_FILE_INFORMATION 12907
WriteX 12907 0 65471 65471
WriteX 12907 65471 65 65
WriteX 12907 65536 22848 22848
WriteX 12907 0 4096 4096
Flush 12907
QUERY_FILE_INFORMATION 12898
QUERY_FILE_INFORMATION 12898
Close 12898
WriteX 12907 0 4096 4096
Close 12907
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 12908
Close 12908
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 12909
QUERY_FILE_INFORMATION 12909
ReadX 12909 0 512 512
ReadX 12909 512 512 512
ReadX 12909 1024 512 512
QUERY_FILE_INFORMATION 12909
QUERY_FILE_INFORMATION 12909
ReadX 12909 576 2048 2048
QUERY_FILE_INFORMATION 12909
QUERY_FILE_INFORMATION 12909
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 4096 512 512
Close 12909
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12910
QUERY_FILE_INFORMATION 12910
ReadX 12910 0 512 512
ReadX 12910 512 512 512
ReadX 12910 1024 512 512
QUERY_FILE_INFORMATION 12910
QUERY_FILE_INFORMATION 12910
ReadX 12910 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 12910
QUERY_FILE_INFORMATION 12910
ReadX 12910 288 4096 4096
QUERY_FILE_INFORMATION 12910
QUERY_FILE_INFORMATION 12910
QUERY_FILE_INFORMATION 12910
WriteX 12910 288 4096 4096
WriteX 12910 1024 512 512
ReadX 12910 1536 512 512
QUERY_FILE_INFORMATION 12910
ReadX 12910 288 2048 2048
ReadX 12910 2336 2048 2048
ReadX 12910 3072 1536 1536
ReadX 12910 544 512 512
ReadX 12910 1056 2048 2048
ReadX 12910 3104 2048 2048
ReadX 12910 5152 2048 2048
ReadX 12910 7200 2048 2048
ReadX 12910 9248 2048 2048
ReadX 12910 11296 2048 2048
ReadX 12910 13344 2048 2048
ReadX 12910 15392 2048 2048
ReadX 12910 17440 2048 2048
ReadX 12910 19488 2048 2048
ReadX 12910 21536 2048 2048
ReadX 12910 23584 2048 2048
ReadX 12910 25632 2048 2048
ReadX 12910 27680 2048 2048
ReadX 12910 29728 2048 2048
ReadX 12910 31776 2048 2048
ReadX 12910 33824 2048 2048
ReadX 12910 35872 2048 2048
ReadX 12910 37920 2048 2048
ReadX 12910 39968 2048 2048
ReadX 12910 42016 512 512
ReadX 12910 42528 512 512
ReadX 12910 43040 1536 1536
ReadX 12910 44576 2048 2048
ReadX 12910 46624 2048 2048
ReadX 12910 48672 2048 2048
ReadX 12910 50720 2048 2048
ReadX 12910 52768 2048 2048
ReadX 12910 54816 2048 2048
ReadX 12910 56864 2048 2048
ReadX 12910 58912 2048 2048
ReadX 12910 60960 2048 2048
ReadX 12910 63008 2048 2048
ReadX 12910 65056 2048 2048
ReadX 12910 67104 2048 2048
ReadX 12910 69152 2048 2048
ReadX 12910 71200 2048 2048
ReadX 12910 73248 2048 2048
ReadX 12910 75296 2048 2048
ReadX 12910 77344 2048 2048
ReadX 12910 79392 2048 2048
ReadX 12910 81440 2048 2048
ReadX 12910 83488 2048 2048
ReadX 12910 85536 512 512
ReadX 12910 86048 512 512
ReadX 12910 86560 1536 1536
ReadX 12910 88096 2048 2048
ReadX 12910 90144 2048 2048
ReadX 12910 92192 2048 2048
ReadX 12910 94240 2048 2048
ReadX 12910 96288 2048 2048
ReadX 12910 552 2048 2048
ReadX 12910 2600 2048 2048
ReadX 12910 4648 2048 2048
ReadX 12910 6696 2048 2048
ReadX 12910 8744 2048 2048
ReadX 12910 10792 2048 2048
ReadX 12910 12840 2048 2048
ReadX 12910 14888 2048 2048
ReadX 12910 16936 2048 2048
ReadX 12910 18984 2048 2048
ReadX 12910 21032 2048 2048
ReadX 12910 23080 2048 2048
ReadX 12910 25128 2048 2048
ReadX 12910 27176 2048 2048
ReadX 12910 29224 2048 2048
ReadX 12910 31272 2048 2048
ReadX 12910 33320 2048 2048
ReadX 12910 35368 2048 2048
ReadX 12910 37416 2048 2048
ReadX 12910 39464 2048 2048
ReadX 12910 41512 512 512
ReadX 12910 42024 512 512
ReadX 12910 42536 1536 1536
ReadX 12910 44072 2048 2048
ReadX 12910 46120 2048 2048
ReadX 12910 48168 2048 2048
ReadX 12910 50216 2048 2048
ReadX 12910 52264 2048 2048
ReadX 12910 54312 2048 2048
ReadX 12910 56360 2048 2048
ReadX 12910 58408 2048 2048
ReadX 12910 60456 2048 2048
ReadX 12910 62504 2048 2048
ReadX 12910 64552 2048 2048
ReadX 12910 66600 2048 2048
ReadX 12910 68648 2048 2048
ReadX 12910 70696 2048 2048
ReadX 12910 72744 2048 2048
ReadX 12910 74792 2048 2048
ReadX 12910 76840 2048 2048
ReadX 12910 78888 2048 2048
ReadX 12910 80936 2048 2048
ReadX 12910 82984 2048 2048
ReadX 12910 85032 512 512
ReadX 12910 85544 2048 2048
ReadX 12910 87592 2048 2048
ReadX 12910 89640 2048 2048
ReadX 12910 91688 2048 2048
ReadX 12910 93736 2048 2048
ReadX 12910 95784 2048 2048
ReadX 12910 97832 2048 2048
ReadX 12910 99880 2048 2048
ReadX 12910 101928 2048 2048
ReadX 12910 103976 2048 2048
ReadX 12910 106024 2048 2048
ReadX 12910 108072 2048 2048
ReadX 12910 110120 2048 2048
ReadX 12910 112168 2048 2048
ReadX 12910 114216 2048 2048
ReadX 12910 116264 2048 2048
ReadX 12910 118312 2048 2048
ReadX 12910 120360 2048 2048
ReadX 12910 122408 2048 2048
ReadX 12910 124456 512 512
ReadX 12910 124968 512 512
ReadX 12910 125480 1536 1536
ReadX 12910 127016 2048 2048
ReadX 12910 129064 2048 2048
ReadX 12910 131112 2048 2048
ReadX 12910 133160 2048 2048
ReadX 12910 135208 2048 2048
ReadX 12910 137256 2048 2048
ReadX 12910 139304 2048 2048
ReadX 12910 141352 2048 2048
ReadX 12910 143400 2048 2048
ReadX 12910 145448 2048 2048
ReadX 12910 147496 2048 2048
ReadX 12910 149544 2048 2048
ReadX 12910 151592 2048 2048
ReadX 12910 153640 2048 2048
ReadX 12910 155688 2048 2048
ReadX 12910 157736 2048 2048
ReadX 12910 159784 2048 2048
ReadX 12910 161832 2048 2048
ReadX 12910 163880 2048 2048
ReadX 12910 165928 2048 2048
ReadX 12910 167976 2048 2048
ReadX 12910 170024 512 512
ReadX 12910 1538 1536 1536
ReadX 12910 3074 2048 2048
ReadX 12910 5122 2048 2048
ReadX 12910 7170 2048 2048
ReadX 12910 9218 2048 2048
ReadX 12910 11266 2048 2048
ReadX 12910 13314 2048 2048
ReadX 12910 15362 2048 2048
ReadX 12910 17410 2048 2048
ReadX 12910 19458 2048 2048
ReadX 12910 21506 2048 2048
ReadX 12910 23554 2048 2048
ReadX 12910 25602 2048 2048
ReadX 12910 27650 2048 2048
ReadX 12910 29698 2048 2048
ReadX 12910 31746 2048 2048
ReadX 12910 33794 2048 2048
ReadX 12910 35842 2048 2048
ReadX 12910 37890 2048 2048
ReadX 12910 39938 2048 2048
ReadX 12910 41986 2048 2048
ReadX 12910 44034 875 875
ReadX 12910 1730 4096 4096
ReadX 12910 1724 1536 1536
ReadX 12910 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 12911
Close 12911
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 12912
WriteX 12912 2047 1 1
QUERY_FILE_INFORMATION 12912
Close 12910
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 12913
Close 12913
WriteX 12912 0 42388 42388
Close 12912
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 12914
Close 12914
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12915
QUERY_FILE_INFORMATION 12915
ReadX 12915 0 512 512
ReadX 12915 1756 512 512
ReadX 12915 2268 512 512
QUERY_FILE_INFORMATION 12915
QUERY_FILE_INFORMATION 12915
ReadX 12915 1744 512 512
ReadX 12915 2256 512 512
ReadX 12915 2768 512 512
ReadX 12915 3280 512 512
ReadX 12915 3792 512 512
ReadX 12915 4304 512 512
ReadX 12915 512 2048 2048
QUERY_FILE_INFORMATION 12915
QUERY_FILE_INFORMATION 12915
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 12916
WriteX 12916 2047 1 1
QUERY_FILE_INFORMATION 12916
QUERY_FILE_INFORMATION 12915
QUERY_FILE_INFORMATION 12915
Close 12915
WriteX 12916 0 42652 42652
Close 12916
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 12917
Close 12917
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 12918
QUERY_FILE_INFORMATION 12918
ReadX 12918 0 512 512
ReadX 12918 1762 512 512
ReadX 12918 2274 512 512
QUERY_FILE_INFORMATION 12918
QUERY_FILE_INFORMATION 12918
ReadX 12918 1750 512 512
ReadX 12918 2262 512 512
ReadX 12918 2774 512 512
ReadX 12918 3286 512 512
ReadX 12918 3798 512 512
ReadX 12918 4310 512 512
ReadX 12918 512 2048 2048
QUERY_FILE_INFORMATION 12918
QUERY_FILE_INFORMATION 12918
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12920
Close 12920
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 12922
WriteX 12922 4080 1 1
QUERY_FILE_INFORMATION 12922
WriteX 12922 0 65471 65471
WriteX 12922 65471 65 65
WriteX 12922 65536 49 49
Close 12922
Close 12918
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12923
WriteX 12923 0 65471 65471
WriteX 12923 65471 63 63
WriteX 12923 65534 65471 65471
WriteX 12923 131005 63 63
Close 12923
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12924
WriteX 12924 0 65471 65471
WriteX 12924 65471 63 63
WriteX 12924 65534 65471 65471
WriteX 12924 131005 63 63
WriteX 12924 131068 65471 65471
WriteX 12924 196539 63 63
WriteX 12924 196602 65471 65471
WriteX 12924 262073 63 63
Close 12924
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12925
WriteX 12925 0 65471 65471
WriteX 12925 65471 63 63
WriteX 12925 65534 65471 65471
WriteX 12925 131005 63 63
WriteX 12925 131068 65471 65471
WriteX 12925 196539 63 63
WriteX 12925 196602 65471 65471
WriteX 12925 262073 63 63
WriteX 12925 262136 65471 65471
WriteX 12925 327607 63 63
WriteX 12925 327670 65471 65471
WriteX 12925 393141 63 63
WriteX 12925 393204 65471 65471
WriteX 12925 458675 63 63
WriteX 12925 458738 65471 65471
WriteX 12925 524209 63 63
Close 12925
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12926
Close 12926
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 12927
Close 12927
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 12930
Close 12930
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 12932
Close 12932
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 12933
Close 12933
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12936
Close 12936
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12938
Close 12938
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12939
Close 12939
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12942
Close 12942
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12946
Close 12946
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12950
Close 12950
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12954
Close 12954
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12958
Close 12958
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12962
Close 12962
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12966
Close 12966
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12970
Close 12970
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12972
Close 12972
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12974
Close 12974
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12976
WriteX 12976 4095 1 1
QUERY_FILE_INFORMATION 12976
QUERY_FS_INFORMATION 259
WriteX 12976 0 65471 65471
WriteX 12976 65471 65 65
WriteX 12976 65536 65471 65471
WriteX 12976 131007 65 65
WriteX 12976 131072 65471 65471
WriteX 12976 196543 65 65
WriteX 12976 196608 65471 65471
WriteX 12976 262079 65 65
WriteX 12976 262144 26634 26634
Close 12976
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
Close 12981
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12982
Close 12982
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12983
Close 12983
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12984
QUERY_FILE_INFORMATION 12984
ReadX 12984 0 512 512
ReadX 12984 288 512 512
ReadX 12984 800 512 512
Close 12984
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12985
ReadX 12985 0 24 24
Close 12985
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12986
ReadX 12986 0 24 24
Close 12986
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12987
QUERY_FILE_INFORMATION 12987
ReadX 12987 0 512 512
ReadX 12987 288 512 512
ReadX 12987 800 512 512
ReadX 12987 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12987 1759 2849 2849
Close 12987
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12988
Close 12988
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12991
Close 12991
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12993
Close 12993
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12994
Close 12994
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12997
Close 12997
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12999
Close 12999
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13000
Close 13000
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13003
Close 13003
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13007
Close 13007
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13011
Close 13011
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13015
Close 13015
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13019
Close 13019
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13023
Close 13023
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13026
Close 13026
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13030
Close 13030
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13034
Close 13034
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13036
Close 13036
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13037
Close 13037
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13046
QUERY_FILE_INFORMATION 13046
QUERY_FILE_INFORMATION 13046
Close 13046
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13047
Close 13047
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13048
Close 13048
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13049
QUERY_FILE_INFORMATION 13049
ReadX 13049 0 512 512
ReadX 13049 288 512 512
ReadX 13049 800 512 512
Close 13049
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13050
ReadX 13050 0 24 24
Close 13050
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13051
QUERY_FILE_INFORMATION 13051
ReadX 13051 0 512 512
ReadX 13051 288 512 512
ReadX 13051 800 512 512
ReadX 13051 512 36 36
Close 13051
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13052
QUERY_FILE_INFORMATION 13052
ReadX 13052 0 512 512
ReadX 13052 288 512 512
ReadX 13052 800 512 512
ReadX 13052 512 682 682
ReadX 13052 3584 106 106
ReadX 13052 3712 10 10
ReadX 13052 3722 10 10
ReadX 13052 512 2048 2048
ReadX 13052 3072 512 512
ReadX 13052 276 84 84
ReadX 13052 273 49 49
ReadX 13052 2560 512 512
Close 13052
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13062
QUERY_FILE_INFORMATION 13062
QUERY_FILE_INFORMATION 13062
Close 13062
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13063
Close 13063
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13064
Close 13064
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13065
QUERY_FILE_INFORMATION 13065
ReadX 13065 0 512 512
ReadX 13065 288 512 512
ReadX 13065 800 512 512
Close 13065
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13066
ReadX 13066 0 24 24
Close 13066
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13067
QUERY_FILE_INFORMATION 13067
ReadX 13067 0 512 512
ReadX 13067 288 512 512
ReadX 13067 800 512 512
ReadX 13067 512 36 36
Close 13067
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13068
QUERY_FILE_INFORMATION 13068
ReadX 13068 0 512 512
ReadX 13068 288 512 512
ReadX 13068 800 512 512
ReadX 13068 512 682 682
ReadX 13068 3072 106 106
ReadX 13068 3200 10 10
ReadX 13068 3210 10 10
ReadX 13068 512 2048 2048
ReadX 13068 2560 512 512
ReadX 13068 3887 84 84
ReadX 13068 3838 49 49
ReadX 13068 2048 512 512
Close 13068
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13069
Close 13069
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13070
QUERY_FILE_INFORMATION 13070
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 13070
QUERY_FILE_INFORMATION 13070
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13071
QUERY_FILE_INFORMATION 13071
QUERY_FILE_INFORMATION 13071
QUERY_FILE_INFORMATION 13071
ReadX 13071 2156 24 24
ReadX 13071 2139 276 276
ReadX 13071 2136 14 14
ReadX 13071 2136 7 7
ReadX 13071 2138 12 12
ReadX 13071 2137 8 8
ReadX 13071 2135 15 15
ReadX 13071 0 16 16
ReadX 13071 16 2048 2048
ReadX 13071 2064 2048 2048
ReadX 13071 257 2048 2048
ReadX 13071 385 2048 2048
ReadX 13071 513 2048 2048
ReadX 13071 641 2048 2048
ReadX 13071 769 2048 2048
ReadX 13071 897 2048 2048
ReadX 13071 1025 2048 2048
ReadX 13071 1153 2048 2048
ReadX 13071 1281 2048 2048
ReadX 13071 1409 2048 2048
ReadX 13071 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13073
Close 13073
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13075
WriteX 13075 15 1 1
QUERY_FILE_INFORMATION 13075
WriteX 13075 0 10575 10575
Flush 13075
Close 13075
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13076
Close 13076
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13077
QUERY_FILE_INFORMATION 13077
QUERY_FILE_INFORMATION 13077
QUERY_FILE_INFORMATION 13077
ReadX 13077 2157 24 24
ReadX 13077 2139 276 276
ReadX 13077 2137 14 14
ReadX 13077 2137 7 7
ReadX 13077 2139 12 12
ReadX 13077 2138 8 8
ReadX 13077 2136 15 15
Close 13071
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13078
Close 13078
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13079
QUERY_FILE_INFORMATION 13079
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13080
QUERY_FILE_INFORMATION 13080
ReadX 13080 0 512 512
ReadX 13080 512 512 512
ReadX 13080 1024 512 512
QUERY_FILE_INFORMATION 13080
QUERY_FILE_INFORMATION 13080
Close 13080
QUERY_FILE_INFORMATION 13079
ReadX 13079 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13081
QUERY_FILE_INFORMATION 13081
ReadX 13081 0 512 512
ReadX 13081 512 512 512
ReadX 13081 1024 512 512
ReadX 13081 288 20 20
ReadX 13081 308 2084 2084
ReadX 13081 388 2084 2084
ReadX 13081 388 2084 2084
ReadX 13070 2157 1386 1386
ReadX 13081 2472 399 399
ReadX 13081 3072 1536 1536
ReadX 13081 544 149 149
ReadX 13081 693 485 485
Close 13081
ReadX 13070 2157 4096 4096
ReadX 13070 6253 4096 4096
ReadX 13070 10349 4096 4096
ReadX 13070 14445 4096 4096
ReadX 13070 18541 4096 4096
ReadX 13070 22637 256 256
ReadX 13070 22893 4096 4096
ReadX 13070 26989 4096 4096
ReadX 13070 31085 4096 4096
ReadX 13070 35181 4096 4096
ReadX 13070 39277 4096 4096
ReadX 13070 43373 4096 4096
ReadX 13070 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13070 2157 1024 1024
ReadX 13070 1667 4688 4688
ReadX 13070 6355 3516 3516
ReadX 13070 9871 16384 16384
ReadX 13070 26255 3771 3771
ReadX 13070 30026 2048 2048
ReadX 13070 32074 1024 1024
ReadX 13070 33098 6652 6652
ReadX 13070 39750 16384 16384
ReadX 13070 56134 10496 10496
ReadX 13070 66630 1784 1784
ReadX 13070 68414 90 90
ReadX 13070 68504 273 273
ReadX 13070 68777 1600 1600
ReadX 13070 70377 640 640
ReadX 13070 71017 1280 1280
ReadX 13070 72297 8464 8464
ReadX 13070 80761 158 158
ReadX 13070 80919 912 912
ReadX 13070 81831 1980 1980
ReadX 13070 83811 2256 2256
ReadX 13070 86067 400 400
ReadX 13070 86467 252 252
ReadX 13070 86719 42 42
ReadX 13070 86761 725 725
ReadX 13070 2009 512 512
ReadX 13070 3895 9 9
ReadX 13070 3781 46 46
ReadX 13070 4059 92 92
ReadX 13070 3781 92 92
ReadX 13070 3986 184 184
ReadX 13070 3987 16384 16384
ReadX 13070 3902 16384 16384
ReadX 13070 3781 10240 10240
ReadX 13070 3821 16384 16384
ReadX 13070 3891 935 935
ReadX 13070 4060 10240 10240
ReadX 13070 4059 184 184
ReadX 13070 256 184 184
ReadX 13070 256 1026 1026
ReadX 13070 3901 326 326
ReadX 13070 3899 652 652
ReadX 13070 256 2 2
ReadX 13070 258 4948 4948
Close 13070
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13083
Close 13083
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13085
WriteX 13085 4055 1 1
QUERY_FILE_INFORMATION 13085
WriteX 13085 0 65471 65471
WriteX 13085 65471 65 65
WriteX 13085 65536 65471 65471
WriteX 13085 131007 65 65
WriteX 13085 131072 65471 65471
WriteX 13085 196543 65 65
WriteX 13085 196608 65471 65471
WriteX 13085 262079 65 65
WriteX 13085 262144 65471 65471
WriteX 13085 327615 65 65
WriteX 13085 327680 65471 65471
WriteX 13085 393151 65 65
WriteX 13085 393216 65471 65471
WriteX 13085 458687 65 65
WriteX 13085 458752 65471 65471
WriteX 13085 524223 65 65
WriteX 13085 524288 65471 65471
WriteX 13085 589759 65 65
WriteX 13085 589824 35257 35257
Close 13085
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13087
Close 13087
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13089
WriteX 13089 4055 1 1
QUERY_FILE_INFORMATION 13089
WriteX 13089 0 65471 65471
WriteX 13089 65471 65 65
WriteX 13089 65536 65471 65471
WriteX 13089 131007 65 65
WriteX 13089 131072 65471 65471
WriteX 13089 196543 65 65
WriteX 13089 196608 65471 65471
WriteX 13089 262079 65 65
WriteX 13089 262144 65471 65471
WriteX 13089 327615 65 65
WriteX 13089 327680 65471 65471
WriteX 13089 393151 65 65
WriteX 13089 393216 65471 65471
WriteX 13089 458687 65 65
WriteX 13089 458752 65471 65471
WriteX 13089 524223 65 65
WriteX 13089 524288 65471 65471
WriteX 13089 589759 65 65
WriteX 13089 589824 57598 57598
Close 13089
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13091
WriteX 13091 15 1 1
QUERY_FILE_INFORMATION 13091
WriteX 13091 0 12543 12543
Flush 13091
Close 13091
Close 13077
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13092
Close 13092
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13093
QUERY_FILE_INFORMATION 13093
QUERY_FILE_INFORMATION 13093
QUERY_FILE_INFORMATION 13093
ReadX 13093 288 24 24
ReadX 13093 287 276 276
ReadX 13093 286 14 14
ReadX 13093 286 7 7
ReadX 13093 287 12 12
ReadX 13093 287 8 8
ReadX 13093 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13094
Close 13094
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13095
QUERY_FILE_INFORMATION 13095
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 13095
QUERY_FILE_INFORMATION 13095
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13096
QUERY_FILE_INFORMATION 13096
QUERY_FILE_INFORMATION 13096
QUERY_FILE_INFORMATION 13096
ReadX 13096 1938 24 24
ReadX 13096 1920 276 276
ReadX 13096 1918 14 14
ReadX 13096 1918 7 7
ReadX 13096 1919 12 12
ReadX 13096 1919 8 8
ReadX 13096 1917 15 15
ReadX 13096 0 16 16
ReadX 13096 16 2048 2048
ReadX 13096 2064 2048 2048
ReadX 13096 257 2048 2048
ReadX 13096 385 2048 2048
ReadX 13096 513 2048 2048
ReadX 13096 641 2048 2048
ReadX 13096 769 2048 2048
ReadX 13096 897 2048 2048
ReadX 13096 1025 2048 2048
ReadX 13096 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13098
Close 13098
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13100
WriteX 13100 15 1 1
QUERY_FILE_INFORMATION 13100
WriteX 13100 0 11588 11588
Flush 13100
Close 13100
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13101
Close 13101
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13102
QUERY_FILE_INFORMATION 13102
QUERY_FILE_INFORMATION 13102
QUERY_FILE_INFORMATION 13102
ReadX 13102 1909 24 24
ReadX 13102 1892 276 276
ReadX 13102 1889 14 14
ReadX 13102 1889 7 7
ReadX 13102 1891 12 12
ReadX 13102 1890 8 8
ReadX 13102 1888 15 15
Close 13096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13104
WriteX 13104 15 1 1
QUERY_FILE_INFORMATION 13104
WriteX 13104 0 11615 11615
Flush 13104
Close 13104
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13102
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13105
Close 13105
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13106
QUERY_FILE_INFORMATION 13106
QUERY_FILE_INFORMATION 13106
QUERY_FILE_INFORMATION 13106
ReadX 13106 1947 24 24
ReadX 13106 1929 276 276
ReadX 13106 1927 14 14
ReadX 13106 1927 7 7
ReadX 13106 1929 12 12
ReadX 13106 1928 8 8
ReadX 13106 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13108
Close 13108
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13110
WriteX 13110 4088 1 1
QUERY_FILE_INFORMATION 13110
WriteX 13110 0 65471 65471
WriteX 13110 65471 65 65
WriteX 13110 65536 16050 16050
Close 13110
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13095 1939 64 64
ReadX 13095 128 248 248
ReadX 13095 128 568 568
ReadX 13095 3872 1536 1536
ReadX 13095 3456 2560 2560
ReadX 13095 3136 512 512
ReadX 13095 2880 4096 4096
ReadX 13095 3264 3072 3072
ReadX 13095 320 4096 4096
ReadX 13095 1024 4096 4096
ReadX 13095 3616 4096 4096
ReadX 13095 1939 64 64
ReadX 13095 128 248 248
ReadX 13095 128 608 608
ReadX 13095 2858 1024 1024
ReadX 13095 2810 4096 4096
ReadX 13095 2826 4096 4096
ReadX 13095 2580 2048 2048
ReadX 13095 2800 2560 2560
ReadX 13095 2100 4096 4096
ReadX 13095 2084 4096 4096
ReadX 13095 868 4096 4096
ReadX 13095 2324 4096 4096
ReadX 13095 884 4096 4096
ReadX 13095 2604 1024 1024
ReadX 13095 580 4096 4096
ReadX 13095 596 4096 4096
ReadX 13095 2752 4096 4096
ReadX 13095 2842 1024 1024
ReadX 13095 660 4096 4096
ReadX 13095 2720 4096 4096
ReadX 13095 2736 4096 4096
ReadX 13095 628 4096 4096
ReadX 13095 2704 4096 4096
ReadX 13095 1556 4096 4096
ReadX 13095 576 4096 4096
ReadX 13095 3168 1536 1536
ReadX 13095 832 4096 4096
ReadX 13095 1088 4096 4096
ReadX 13095 1344 4096 4096
ReadX 13095 1600 4096 4096
ReadX 13095 1856 4096 4096
ReadX 13095 2112 4096 4096
ReadX 13095 1892 4096 4096
ReadX 13095 820 4096 4096
ReadX 13095 788 4096 4096
ReadX 13095 1604 4096 4096
ReadX 13095 3648 4096 4096
ReadX 13095 2608 4096 4096
ReadX 13095 548 4096 4096
ReadX 13095 740 4096 4096
ReadX 13095 1344 4096 4096
ReadX 13095 3392 4096 4096
ReadX 13095 3904 4096 4096
ReadX 13095 644 4096 4096
ReadX 13095 676 4096 4096
ReadX 13095 2688 4096 4096
ReadX 13095 320 4096 4096
ReadX 13095 900 4096 4096
ReadX 13095 1908 4096 4096
ReadX 13095 852 4096 4096
ReadX 13095 724 4096 4096
ReadX 13095 2292 4096 4096
ReadX 13095 612 4096 4096
ReadX 13095 388 4096 4096
ReadX 13095 2368 4096 4096
ReadX 13095 2624 4096 4096
ReadX 13095 500 4096 4096
ReadX 13095 356 4096 4096
ReadX 13095 1024 4096 4096
ReadX 13095 576 4096 4096
ReadX 13095 340 4096 4096
ReadX 13095 420 4096 4096
ReadX 13095 1600 4096 4096
ReadX 13095 404 4096 4096
ReadX 13095 1428 4096 4096
ReadX 13095 2656 4096 4096
ReadX 13095 2624 4096 4096
ReadX 13095 452 4096 4096
ReadX 13095 692 4096 4096
ReadX 13095 564 4096 4096
ReadX 13095 372 4096 4096
ReadX 13095 468 4096 4096
ReadX 13095 484 4096 4096
ReadX 13095 1088 4096 4096
ReadX 13095 1924 4096 4096
ReadX 13095 2768 4096 4096
ReadX 13095 832 4096 4096
ReadX 13095 836 4096 4096
ReadX 13095 1856 4096 4096
ReadX 13095 2640 4096 4096
ReadX 13095 436 4096 4096
ReadX 13095 1828 4096 4096
ReadX 13095 804 4096 4096
ReadX 13095 1860 4096 4096
ReadX 13095 1812 4096 4096
ReadX 13095 756 4096 4096
ReadX 13095 1636 4096 4096
ReadX 13095 772 4096 4096
ReadX 13095 2036 4096 4096
ReadX 13095 1220 4096 4096
ReadX 13095 1652 4096 4096
ReadX 13095 2588 4096 4096
ReadX 13095 916 4096 4096
ReadX 13095 260 4096 4096
ReadX 13095 932 4096 4096
ReadX 13095 2624 4096 4096
ReadX 13095 308 4096 4096
ReadX 13095 292 4096 4096
ReadX 13095 1140 4096 4096
ReadX 13095 276 4096 4096
ReadX 13095 2020 4096 4096
ReadX 13095 2880 4096 4096
ReadX 13095 516 4096 4096
ReadX 13095 1844 4096 4096
ReadX 13095 1124 4096 4096
ReadX 13095 3136 4096 4096
ReadX 13095 324 4096 4096
ReadX 13095 1156 4096 4096
ReadX 13095 1172 4096 4096
ReadX 13095 2112 4096 4096
ReadX 13095 2368 4096 4096
ReadX 13095 964 4096 4096
ReadX 13095 980 4096 4096
ReadX 13095 1012 4096 4096
ReadX 13095 532 4096 4096
ReadX 13095 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13095 1620 4096 4096
ReadX 13095 1604 4096 4096
ReadX 13095 2116 4096 4096
ReadX 13095 2132 4096 4096
ReadX 13095 2148 4096 4096
ReadX 13095 2276 4096 4096
ReadX 13095 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13112
Close 13112
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13114
QUERY_FILE_INFORMATION 13079
WriteX 13114 4088 1 1
QUERY_FILE_INFORMATION 13114
QUERY_FILE_INFORMATION 13079
Close 13079
WriteX 13114 0 65471 65471
WriteX 13114 65471 65 65
WriteX 13114 65536 64850 64850
Close 13114
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13116
WriteX 13116 15 1 1
QUERY_FILE_INFORMATION 13116
ReadX 13095 2068 4096 4096
ReadX 13095 1588 4096 4096
ReadX 13095 1572 4096 4096
WriteX 13116 0 18630 18630
Flush 13116
Close 13116
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13106
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13117
Close 13117
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13118
QUERY_FILE_INFORMATION 13118
QUERY_FILE_INFORMATION 13118
QUERY_FILE_INFORMATION 13118
ReadX 13118 661 24 24
ReadX 13118 659 356 356
ReadX 13118 659 14 14
ReadX 13118 659 7 7
ReadX 13118 659 12 12
ReadX 13118 659 8 8
ReadX 13118 659 15 15
ReadX 13118 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13095 612 4096 4096
ReadX 13095 564 4096 4096
ReadX 13095 1876 4096 4096
ReadX 13095 628 4096 4096
ReadX 13095 740 4096 4096
ReadX 13095 724 4096 4096
ReadX 13095 644 4096 4096
ReadX 13095 2324 4096 4096
ReadX 13095 660 4096 4096
ReadX 13095 852 4096 4096
ReadX 13095 868 4096 4096
Close 13118
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 13093
ReadX 13095 2368 4096 4096
ReadX 13095 1024 4096 4096
ReadX 13095 320 4096 4096
ReadX 13095 580 4096 4096
ReadX 13095 3136 512 512
ReadX 13095 2880 4096 4096
Close 13095
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13119
WriteX 13119 0 65471 65471
WriteX 13119 65471 63 63
WriteX 13119 65534 65471 65471
WriteX 13119 131005 63 63
Close 13119
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13120
WriteX 13120 0 65471 65471
WriteX 13120 65471 63 63
WriteX 13120 65534 65471 65471
WriteX 13120 131005 63 63
WriteX 13120 131068 65471 65471
WriteX 13120 196539 63 63
WriteX 13120 196602 65471 65471
WriteX 13120 262073 63 63
Close 13120
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13121
WriteX 13121 0 65471 65471
WriteX 13121 65471 63 63
WriteX 13121 65534 65471 65471
WriteX 13121 131005 63 63
WriteX 13121 131068 65471 65471
WriteX 13121 196539 63 63
WriteX 13121 196602 65471 65471
WriteX 13121 262073 63 63
WriteX 13121 262136 65471 65471
WriteX 13121 327607 63 63
WriteX 13121 327670 65471 65471
WriteX 13121 393141 63 63
WriteX 13121 393204 65471 65471
WriteX 13121 458675 63 63
WriteX 13121 458738 65471 65471
WriteX 13121 524209 63 63
Close 13121
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13122
Close 13122
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13123
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13123 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13124
ReadX 13124 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13125
ReadX 13125 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13126
ReadX 13126 0 511 511
ReadX 13123 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13123
Close 13124
Close 13125
Close 13126
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13127
ReadX 13127 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13128
ReadX 13128 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13129
ReadX 13129 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13130
ReadX 13130 0 511 511
ReadX 13127 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13131
FIND_FIRST \clients\client1\~dmtmp\*
Close 13131
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13132
QUERY_FILE_INFORMATION 13132
WriteX 13132 2047 1 1
QUERY_FILE_INFORMATION 13132
WriteX 13132 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13133
Close 13133
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13134
WriteX 13134 52 1 1
QUERY_FILE_INFORMATION 13134
WriteX 13134 0 53 53
WriteX 13134 53 28 28
WriteX 13134 81 4 4
WriteX 13134 85 28 28
WriteX 13134 113 38 38
WriteX 13134 151 28 28
WriteX 13134 179 2 2
WriteX 13134 181 28 28
WriteX 13134 209 3 3
WriteX 13134 212 279 279
WriteX 13134 9 4 4
Close 13134
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13135
ReadX 13135 0 53 53
ReadX 13135 53 28 28
ReadX 13135 81 4 4
ReadX 13135 85 28 28
ReadX 13135 113 38 38
ReadX 13135 151 28 28
ReadX 13135 179 2 2
ReadX 13135 181 28 28
ReadX 13135 209 3 3
Close 13135
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13127
Close 13128
Close 13129
Close 13130
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13136
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13136 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13137
ReadX 13137 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13138
ReadX 13138 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13139
ReadX 13139 0 511 511
ReadX 13136 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13141
Close 13141
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13142
WriteX 13142 52 1 1
QUERY_FILE_INFORMATION 13142
WriteX 13142 0 53 53
WriteX 13142 53 28 28
WriteX 13142 81 28 28
WriteX 13142 109 28 28
WriteX 13142 137 28 28
WriteX 13142 165 28 28
WriteX 13142 193 28 28
WriteX 13142 221 28 28
WriteX 13142 249 4 4
WriteX 13142 253 4 4
WriteX 13142 257 4 4
WriteX 13142 261 28 28
WriteX 13142 289 2 2
WriteX 13142 291 2 2
WriteX 13142 293 2 2
WriteX 13142 295 248 248
WriteX 13142 9 4 4
Close 13142
Close 13136
Close 13137
Close 13138
Close 13139
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13143
ReadX 13143 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13144
ReadX 13144 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13145
ReadX 13145 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13146
ReadX 13146 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13147
ReadX 13147 0 53 53
ReadX 13147 53 28 28
ReadX 13147 81 28 28
ReadX 13147 109 28 28
ReadX 13147 137 28 28
ReadX 13147 165 28 28
ReadX 13147 193 28 28
ReadX 13147 221 28 28
ReadX 13147 249 4 4
ReadX 13147 253 4 4
ReadX 13147 257 4 4
ReadX 13147 261 28 28
ReadX 13147 289 2 2
ReadX 13147 291 2 2
ReadX 13147 293 2 2
Close 13147
ReadX 13143 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13143
Close 13144
Close 13145
Close 13146
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13132
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13148
Close 13148
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13149
ReadX 13149 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13150
ReadX 13150 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13151
ReadX 13151 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13152
ReadX 13152 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13153
ReadX 13153 0 53 53
ReadX 13153 53 28 28
ReadX 13153 81 28 28
ReadX 13153 109 28 28
ReadX 13153 137 28 28
ReadX 13153 165 28 28
ReadX 13153 193 28 28
ReadX 13153 221 28 28
ReadX 13153 249 4 4
ReadX 13153 253 4 4
ReadX 13153 257 4 4
ReadX 13153 261 28 28
ReadX 13153 289 2 2
ReadX 13153 291 2 2
ReadX 13153 293 2 2
Close 13153
ReadX 13149 2048 2048 2048
Close 13149
Close 13150
Close 13151
Close 13152
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13154
ReadX 13154 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13155
ReadX 13155 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13156
ReadX 13156 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13157
ReadX 13157 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13158
ReadX 13158 0 53 53
ReadX 13158 53 28 28
ReadX 13158 81 28 28
ReadX 13158 109 28 28
ReadX 13158 137 28 28
ReadX 13158 165 28 28
ReadX 13158 193 28 28
ReadX 13158 221 28 28
ReadX 13158 249 4 4
ReadX 13158 253 4 4
ReadX 13158 257 4 4
ReadX 13158 261 28 28
ReadX 13158 289 2 2
ReadX 13158 291 2 2
ReadX 13158 293 2 2
Close 13158
ReadX 13154 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13162
FIND_FIRST \clients\client1\~dmtmp\*
Close 13162
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13163
QUERY_FILE_INFORMATION 13163
WriteX 13163 2047 1 1
QUERY_FILE_INFORMATION 13163
WriteX 13163 0 2048 2048
Close 13163
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13164
ReadX 13164 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13164
Close 13154
Close 13155
Close 13156
Close 13157
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13165
ReadX 13165 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13165 4095 1 1
QUERY_FILE_INFORMATION 13165
WriteX 13165 2048 2048 2048
QUERY_FILE_INFORMATION 13165
Flush 13165
WriteX 13165 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13166
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13166 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13167
ReadX 13167 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13168
ReadX 13168 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13169
ReadX 13169 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13170
ReadX 13170 0 53 53
ReadX 13170 53 28 28
ReadX 13170 81 28 28
ReadX 13170 109 28 28
ReadX 13170 137 28 28
ReadX 13170 165 28 28
ReadX 13170 193 28 28
ReadX 13170 221 28 28
ReadX 13170 249 4 4
ReadX 13170 253 4 4
ReadX 13170 257 4 4
ReadX 13170 261 28 28
ReadX 13170 289 2 2
ReadX 13170 291 2 2
ReadX 13170 293 2 2
Close 13170
ReadX 13166 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13174
FIND_FIRST \clients\client1\~dmtmp\*
Close 13174
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13175
QUERY_FILE_INFORMATION 13175
WriteX 13175 2047 1 1
QUERY_FILE_INFORMATION 13175
WriteX 13175 0 2048 2048
Close 13175
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13176
ReadX 13176 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13180
Close 13180
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13181
QUERY_FILE_INFORMATION 13181
WriteX 13181 2047 1 1
QUERY_FILE_INFORMATION 13181
WriteX 13181 0 2048 2048
Close 13181
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13182
ReadX 13182 0 511 511
ReadX 13166 384 2048 2048
ReadX 13166 768 16384 16384
ReadX 13166 1792 14336 14336
Close 13182
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13183
ReadX 13183 0 511 511
Close 13183
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13185
Close 13185
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13176 4095 1 1
QUERY_FILE_INFORMATION 13176
WriteX 13176 2048 2048 2048
WriteX 13176 0 88 88
Close 13176
WriteX 13166 1152 2048 2048
WriteX 13166 1408 6144 6144
WriteX 13166 1920 2048 2048
WriteX 13166 0 88 88
Close 13166
WriteX 13167 0 88 88
Close 13167
WriteX 13168 0 88 88
Close 13168
Close 13169
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13186
ReadX 13186 0 511 511
ReadX 13186 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13186
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13187
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13187 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13188
ReadX 13188 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13189
ReadX 13189 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13190
ReadX 13190 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13191
ReadX 13191 0 53 53
ReadX 13191 53 28 28
ReadX 13191 81 28 28
ReadX 13191 109 28 28
ReadX 13191 137 28 28
ReadX 13191 165 28 28
ReadX 13191 193 28 28
ReadX 13191 221 28 28
ReadX 13191 249 4 4
ReadX 13191 253 4 4
ReadX 13191 257 4 4
ReadX 13191 261 28 28
ReadX 13191 289 2 2
ReadX 13191 291 2 2
ReadX 13191 293 2 2
Close 13191
ReadX 13187 2048 2048 2048
Close 13187
Close 13188
Close 13189
Close 13190
Close 13165
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13192
QUERY_FILE_INFORMATION 13192
Close 13192
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13193
Close 13193
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13194
ReadX 13194 0 511 511
ReadX 13194 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13195
ReadX 13195 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13196
ReadX 13196 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13197
ReadX 13197 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13198
ReadX 13198 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13199
ReadX 13199 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13200
ReadX 13200 0 53 53
ReadX 13200 53 2 2
ReadX 13200 55 2 2
ReadX 13200 57 184 184
ReadX 13200 241 298 298
Close 13200
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13201
ReadX 13201 0 41 41
ReadX 13194 2048 2048 2048
Close 13201
Close 13194
Close 13195
Close 13198
Close 13199
Close 13196
Close 13197
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13202
ReadX 13202 0 511 511
ReadX 13202 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13203
ReadX 13203 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13204
ReadX 13204 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13205
ReadX 13205 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13206
ReadX 13206 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13207
ReadX 13207 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13208
ReadX 13208 0 53 53
ReadX 13208 53 2 2
ReadX 13208 55 2 2
ReadX 13208 57 184 184
ReadX 13208 241 298 298
Close 13208
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13209
ReadX 13209 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13210
ReadX 13210 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13211
ReadX 13211 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13212
ReadX 13212 0 511 511
ReadX 13211 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13213
ReadX 13213 0 53 53
ReadX 13213 53 2 2
ReadX 13213 55 480 480
ReadX 13213 535 2 2
Close 13213
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13214
ReadX 13214 0 41 41
ReadX 13202 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13218
FIND_FIRST \clients\client1\~dmtmp\*
Close 13218
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13219
QUERY_FILE_INFORMATION 13219
WriteX 13219 2047 1 1
QUERY_FILE_INFORMATION 13219
WriteX 13219 0 2048 2048
Close 13219
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13220
ReadX 13220 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13220
Close 13209
Close 13210
Close 13211
Close 13212
Close 13214
Close 13202
Close 13203
Close 13206
Close 13207
Close 13204
Close 13205
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13221
ReadX 13221 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13222
Close 13222
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13223
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13223 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13224
ReadX 13224 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13225
ReadX 13225 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13226
ReadX 13226 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13227
ReadX 13227 0 53 53
ReadX 13227 53 2 2
ReadX 13227 55 480 480
ReadX 13227 535 2 2
Close 13227
ReadX 13223 2048 2048 2048
Close 13223
Close 13224
Close 13225
Close 13226
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13228
ReadX 13228 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13229
ReadX 13229 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13230
ReadX 13230 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13231
ReadX 13231 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13232
ReadX 13232 0 53 53
ReadX 13232 53 2 2
ReadX 13232 55 480 480
ReadX 13232 535 2 2
Close 13232
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13233
ReadX 13233 0 511 511
ReadX 13233 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13234
ReadX 13234 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13235
ReadX 13235 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13236
ReadX 13236 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13237
ReadX 13237 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13238
ReadX 13238 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13239
ReadX 13239 0 41 41
ReadX 13233 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13240
ReadX 13240 0 53 53
ReadX 13240 53 2 2
ReadX 13240 55 2 2
ReadX 13240 57 184 184
ReadX 13240 241 298 298
Close 13240
ReadX 13228 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13244
FIND_FIRST \clients\client1\~dmtmp\*
Close 13244
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13245
QUERY_FILE_INFORMATION 13245
WriteX 13245 2047 1 1
QUERY_FILE_INFORMATION 13245
WriteX 13245 0 2048 2048
Close 13245
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13246
ReadX 13246 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13246
Close 13239
Close 13233
Close 13234
Close 13237
Close 13238
Close 13235
Close 13236
Close 13228
Close 13229
Close 13230
Close 13231
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13247
ReadX 13247 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13221 4095 1 1
QUERY_FILE_INFORMATION 13221
WriteX 13221 2048 2048 2048
QUERY_FILE_INFORMATION 13221
Flush 13221
WriteX 13221 0 88 88
WriteX 13247 4095 1 1
QUERY_FILE_INFORMATION 13247
WriteX 13247 2048 2048 2048
QUERY_FILE_INFORMATION 13247
Flush 13247
WriteX 13247 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13248
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13248 0 511 511
ReadX 13248 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13249
ReadX 13249 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13250
ReadX 13250 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13251
ReadX 13251 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13252
ReadX 13252 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13253
ReadX 13253 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13254
ReadX 13254 0 53 53
ReadX 13254 53 2 2
ReadX 13254 55 2 2
ReadX 13254 57 184 184
ReadX 13254 241 298 298
Close 13254
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13255
ReadX 13255 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13256
ReadX 13256 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13257
ReadX 13257 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13258
ReadX 13258 0 511 511
ReadX 13257 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13259
ReadX 13259 0 53 53
ReadX 13259 53 2 2
ReadX 13259 55 480 480
ReadX 13259 535 2 2
Close 13259
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13260
ReadX 13260 0 41 41
ReadX 13248 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13261
ReadX 13261 0 53 53
ReadX 13261 53 2 2
ReadX 13261 55 480 480
ReadX 13261 535 2 2
Close 13261
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13262
ReadX 13262 0 53 53
ReadX 13262 53 2 2
ReadX 13262 55 2 2
ReadX 13262 57 184 184
ReadX 13262 241 298 298
Close 13262
ReadX 13255 2048 2048 2048
ReadX 13256 2048 2048 2048
ReadX 13255 320 16384 16384
ReadX 13255 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13263
FIND_FIRST \clients\client1\~dmtmp\*
Close 13263
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13264
QUERY_FILE_INFORMATION 13264
WriteX 13264 4095 1 1
QUERY_FILE_INFORMATION 13264
WriteX 13264 0 4096 4096
Close 13264
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13265
ReadX 13265 0 41 41
Close 13255
Close 13256
Close 13257
Close 13258
Close 13260
Close 13248
Close 13249
Close 13252
Close 13253
Close 13250
Close 13251
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13266
Close 13266
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13267
QUERY_FILE_INFORMATION 13267
WriteX 13267 4095 1 1
QUERY_FILE_INFORMATION 13267
WriteX 13267 0 4096 4096
Close 13267
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13268
ReadX 13268 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 13265
ReadX 13265 0 4096 4096
WriteX 13268 0 4096 4096
Close 13268
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13270
ReadX 13270 0 41 41
Close 13265
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13270
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13271
Close 13271
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13272
ReadX 13272 0 41 41
Close 13272
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13273
Close 13273
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13274
QUERY_FILE_INFORMATION 13274
WriteX 13274 2047 1 1
QUERY_FILE_INFORMATION 13274
WriteX 13274 0 2048 2048
Close 13274
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13275
ReadX 13275 0 511 511
ReadX 13275 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13276
ReadX 13276 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13276
Close 13275
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13277
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13277 0 511 511
ReadX 13277 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13278
ReadX 13278 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13279
ReadX 13279 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13280
ReadX 13280 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13281
ReadX 13281 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13282
ReadX 13282 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13283
ReadX 13283 0 53 53
ReadX 13283 53 2 2
ReadX 13283 55 2 2
ReadX 13283 57 184 184
ReadX 13283 241 298 298
Close 13283
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13284
ReadX 13284 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13285
ReadX 13285 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13286
ReadX 13286 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13287
ReadX 13287 0 511 511
ReadX 13286 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13288
ReadX 13288 0 53 53
ReadX 13288 53 2 2
ReadX 13288 55 480 480
ReadX 13288 535 2 2
Close 13288
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13289
ReadX 13289 0 41 41
ReadX 13277 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13290
ReadX 13290 0 53 53
ReadX 13290 53 2 2
ReadX 13290 55 480 480
ReadX 13290 535 2 2
Close 13290
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13291
ReadX 13291 0 53 53
ReadX 13291 53 2 2
ReadX 13291 55 2 2
ReadX 13291 57 184 184
ReadX 13291 241 298 298
Close 13291
ReadX 13284 2048 2048 2048
Close 13284
Close 13285
Close 13286
Close 13287
Close 13289
Close 13277
Close 13278
Close 13281
Close 13282
Close 13279
Close 13280
Close 13221
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13292
QUERY_FILE_INFORMATION 13292
Close 13292
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13247
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13293
QUERY_FILE_INFORMATION 13293
Close 13293
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13294
Close 13294
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13295
ReadX 13295 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13296
ReadX 13296 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13297
ReadX 13297 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13298
ReadX 13298 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13299
ReadX 13299 0 53 53
ReadX 13299 53 2 2
ReadX 13299 55 480 480
ReadX 13299 535 2 2
Close 13299
ReadX 13295 2048 2048 2048
Close 13295
Close 13296
Close 13297
Close 13298
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13300
ReadX 13300 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13301
ReadX 13301 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13302
ReadX 13302 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13303
ReadX 13303 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13304
ReadX 13304 0 53 53
ReadX 13304 53 2 2
ReadX 13304 55 480 480
ReadX 13304 535 2 2
Close 13304
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13305
ReadX 13305 0 511 511
ReadX 13305 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13306
ReadX 13306 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13307
ReadX 13307 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13308
ReadX 13308 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13309
ReadX 13309 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13310
ReadX 13310 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13311
ReadX 13311 0 41 41
ReadX 13305 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13312
ReadX 13312 0 53 53
ReadX 13312 53 2 2
ReadX 13312 55 2 2
ReadX 13312 57 184 184
ReadX 13312 241 298 298
Close 13312
ReadX 13300 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13316
FIND_FIRST \clients\client1\~dmtmp\*
Close 13316
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13317
QUERY_FILE_INFORMATION 13317
WriteX 13317 2047 1 1
QUERY_FILE_INFORMATION 13317
WriteX 13317 0 2048 2048
Close 13317
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13318
ReadX 13318 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13318
Close 13311
Close 13305
Close 13306
Close 13309
Close 13310
Close 13307
Close 13308
Close 13300
Close 13301
Close 13302
Close 13303
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13319
ReadX 13319 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13320
Close 13320
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13321
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13321 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13322
ReadX 13322 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13323
ReadX 13323 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13324
ReadX 13324 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13325
ReadX 13325 0 53 53
ReadX 13325 53 28 28
ReadX 13325 81 28 28
ReadX 13325 109 28 28
ReadX 13325 137 28 28
ReadX 13325 165 28 28
ReadX 13325 193 28 28
ReadX 13325 221 28 28
ReadX 13325 249 4 4
ReadX 13325 253 4 4
ReadX 13325 257 4 4
ReadX 13325 261 28 28
ReadX 13325 289 2 2
ReadX 13325 291 2 2
ReadX 13325 293 2 2
Close 13325
ReadX 13321 2048 2048 2048
Close 13321
Close 13322
Close 13323
Close 13324
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13326
ReadX 13326 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13327
ReadX 13327 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13328
ReadX 13328 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13329
ReadX 13329 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13330
ReadX 13330 0 53 53
ReadX 13330 53 28 28
ReadX 13330 81 28 28
ReadX 13330 109 28 28
ReadX 13330 137 28 28
ReadX 13330 165 28 28
ReadX 13330 193 28 28
ReadX 13330 221 28 28
ReadX 13330 249 4 4
ReadX 13330 253 4 4
ReadX 13330 257 4 4
ReadX 13330 261 28 28
ReadX 13330 289 2 2
ReadX 13330 291 2 2
ReadX 13330 293 2 2
Close 13330
ReadX 13326 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13334
FIND_FIRST \clients\client1\~dmtmp\*
Close 13334
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13335
QUERY_FILE_INFORMATION 13335
WriteX 13335 2047 1 1
QUERY_FILE_INFORMATION 13335
WriteX 13335 0 2048 2048
Close 13335
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13336
ReadX 13336 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13336
Close 13326
Close 13327
Close 13328
Close 13329
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13337
ReadX 13337 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13338
Close 13338
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13339
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13339 0 511 511
ReadX 13339 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13340
ReadX 13340 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13341
ReadX 13341 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13342
ReadX 13342 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13343
ReadX 13343 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13344
ReadX 13344 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13345
ReadX 13345 0 53 53
ReadX 13345 53 2 2
ReadX 13345 55 2 2
ReadX 13345 57 184 184
ReadX 13345 241 298 298
Close 13345
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13346
ReadX 13346 0 41 41
ReadX 13339 2048 2048 2048
Close 13346
Close 13339
Close 13340
Close 13343
Close 13344
Close 13341
Close 13342
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13347
ReadX 13347 0 511 511
ReadX 13347 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13348
ReadX 13348 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13349
ReadX 13349 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13350
ReadX 13350 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13351
ReadX 13351 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13352
ReadX 13352 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13353
ReadX 13353 0 53 53
ReadX 13353 53 2 2
ReadX 13353 55 2 2
ReadX 13353 57 184 184
ReadX 13353 241 298 298
Close 13353
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13354
ReadX 13354 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13355
ReadX 13355 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13356
ReadX 13356 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13357
ReadX 13357 0 511 511
ReadX 13356 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13358
ReadX 13358 0 53 53
ReadX 13358 53 2 2
ReadX 13358 55 480 480
ReadX 13358 535 2 2
Close 13358
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13359
ReadX 13359 0 41 41
ReadX 13347 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13363
FIND_FIRST \clients\client1\~dmtmp\*
Close 13363
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13364
QUERY_FILE_INFORMATION 13364
WriteX 13364 2047 1 1
QUERY_FILE_INFORMATION 13364
WriteX 13364 0 2048 2048
Close 13364
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13365
ReadX 13365 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13365
Close 13354
Close 13355
Close 13356
Close 13357
Close 13359
Close 13347
Close 13348
Close 13351
Close 13352
Close 13349
Close 13350
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13366
ReadX 13366 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13319 4095 1 1
QUERY_FILE_INFORMATION 13319
WriteX 13319 2048 2048 2048
QUERY_FILE_INFORMATION 13319
Flush 13319
WriteX 13319 0 88 88
WriteX 13337 4095 1 1
QUERY_FILE_INFORMATION 13337
WriteX 13337 2048 2048 2048
QUERY_FILE_INFORMATION 13337
Flush 13337
WriteX 13337 0 88 88
WriteX 13366 4095 1 1
QUERY_FILE_INFORMATION 13366
WriteX 13366 2048 2048 2048
QUERY_FILE_INFORMATION 13366
Flush 13366
WriteX 13366 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13367
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13367 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13368
ReadX 13368 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13369
ReadX 13369 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13370
ReadX 13370 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13371
ReadX 13371 0 53 53
ReadX 13371 53 2 2
ReadX 13371 55 480 480
ReadX 13371 535 2 2
Close 13371
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13372
ReadX 13372 0 511 511
ReadX 13372 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13373
ReadX 13373 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13374
ReadX 13374 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13375
ReadX 13375 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13376
ReadX 13376 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13377
ReadX 13377 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13378
ReadX 13378 0 41 41
ReadX 13372 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13379
ReadX 13379 0 53 53
ReadX 13379 53 2 2
ReadX 13379 55 2 2
ReadX 13379 57 184 184
ReadX 13379 241 298 298
Close 13379
ReadX 13367 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13380
ReadX 13380 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13381
ReadX 13381 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13382
ReadX 13382 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13383
ReadX 13383 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13384
ReadX 13384 0 53 53
ReadX 13384 53 28 28
ReadX 13384 81 28 28
ReadX 13384 109 28 28
ReadX 13384 137 28 28
ReadX 13384 165 28 28
ReadX 13384 193 28 28
ReadX 13384 221 28 28
ReadX 13384 249 4 4
ReadX 13384 253 4 4
ReadX 13384 257 4 4
ReadX 13384 261 28 28
ReadX 13384 289 2 2
ReadX 13384 291 2 2
ReadX 13384 293 2 2
Close 13384
ReadX 13380 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13385
ReadX 13385 0 53 53
ReadX 13385 53 2 2
ReadX 13385 55 2 2
ReadX 13385 57 184 184
ReadX 13385 241 298 298
Close 13385
ReadX 13369 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13386
ReadX 13386 0 53 53
ReadX 13386 53 2 2
ReadX 13386 55 480 480
ReadX 13386 535 2 2
Close 13386
ReadX 13380 4096 16384 16384
ReadX 13380 1280 16384 16384
ReadX 13380 2304 6144 6144
ReadX 13380 2688 2048 2048
ReadX 13367 4096 16384 16384
ReadX 13367 1280 16384 16384
ReadX 13367 2304 16384 16384
ReadX 13367 3328 16384 16384
ReadX 13367 272 16384 16384
ReadX 13367 336 16384 16384
ReadX 13367 400 16384 16384
ReadX 13367 464 16384 16384
ReadX 13367 528 16384 16384
ReadX 13367 592 16384 16384
ReadX 13367 656 16384 16384
ReadX 13367 720 16384 16384
ReadX 13367 784 16384 16384
ReadX 13367 848 16384 16384
ReadX 13367 912 16384 16384
ReadX 13373 2048 2048 2048
ReadX 13372 760 2048 2048
ReadX 13372 1144 2048 2048
ReadX 13372 408 2048 2048
ReadX 13372 912 2048 2048
ReadX 13372 1096 2048 2048
ReadX 13372 776 2048 2048
ReadX 13372 560 2048 2048
ReadX 13372 376 2048 2048
ReadX 13372 320 2048 2048
ReadX 13372 3072 2048 2048
ReadX 13372 784 2048 2048
ReadX 13372 2176 2048 2048
ReadX 13372 792 2048 2048
ReadX 13372 576 2048 2048
ReadX 13372 600 2048 2048
ReadX 13372 728 2048 2048
ReadX 13372 1112 2048 2048
ReadX 13372 664 2048 2048
ReadX 13372 976 2048 2048
ReadX 13372 3840 2048 2048
ReadX 13372 296 2048 2048
ReadX 13372 480 2048 2048
ReadX 13372 680 2048 2048
ReadX 13372 696 2048 2048
ReadX 13372 832 2048 2048
ReadX 13372 1016 2048 2048
ReadX 13372 1104 2048 2048
ReadX 13372 3200 2048 2048
ReadX 13372 264 2048 2048
ReadX 13372 448 2048 2048
ReadX 13372 648 2048 2048
ReadX 13372 1136 2048 2048
ReadX 13372 288 2048 2048
ReadX 13372 352 2048 2048
ReadX 13372 536 2048 2048
ReadX 13372 800 2048 2048
ReadX 13372 736 2048 2048
ReadX 13372 392 2048 2048
ReadX 13372 752 2048 2048
ReadX 13372 880 2048 2048
ReadX 13372 1064 2048 2048
ReadX 13372 1128 2048 2048
ReadX 13372 1536 2048 2048
ReadX 13372 2432 2048 2048
ReadX 13372 688 2048 2048
ReadX 13372 872 2048 2048
ReadX 13372 1072 2048 2048
ReadX 13372 984 2048 2048
ReadX 13372 704 2048 2048
ReadX 13372 3328 2048 2048
ReadX 13372 888 2048 2048
ReadX 13372 496 2048 2048
ReadX 13372 624 2048 2048
ReadX 13372 808 2048 2048
ReadX 13372 1008 2048 2048
ReadX 13372 1152 2048 2048
ReadX 13372 416 2048 2048
ReadX 13372 584 2048 2048
ReadX 13372 384 2048 2048
ReadX 13372 568 2048 2048
ReadX 13372 512 2048 2048
ReadX 13372 1408 2048 2048
ReadX 13372 472 2048 2048
ReadX 13372 672 2048 2048
ReadX 13372 2560 2048 2048
ReadX 13372 544 2048 2048
ReadX 13372 920 2048 2048
ReadX 13372 1120 2048 2048
ReadX 13372 2304 2048 2048
ReadX 13372 1080 2048 2048
ReadX 13372 1664 2048 2048
ReadX 13372 608 2048 2048
ReadX 13372 2688 2048 2048
ReadX 13372 3712 2048 2048
ReadX 13372 616 2048 2048
ReadX 13372 632 2048 2048
ReadX 13372 944 2048 2048
ReadX 13372 856 2048 2048
ReadX 13372 768 2048 2048
ReadX 13372 720 2048 2048
ReadX 13372 640 2048 2048
ReadX 13372 1048 2048 2048
ReadX 13372 1040 2048 2048
ReadX 13372 1032 2048 2048
ReadX 13372 1000 2048 2048
ReadX 13372 992 2048 2048
ReadX 13372 968 2048 2048
ReadX 13372 952 2048 2048
ReadX 13372 1056 2048 2048
ReadX 13372 816 2048 2048
ReadX 13372 864 2048 2048
ReadX 13372 2816 2048 2048
ReadX 13372 640 2048 2048
ReadX 13372 1024 2048 2048
ReadX 13372 504 2048 2048
ReadX 13372 424 2048 2048
ReadX 13372 840 2048 2048
ReadX 13372 896 2048 2048
ReadX 13372 520 2048 2048
ReadX 13372 960 2048 2048
ReadX 13372 552 2048 2048
ReadX 13372 488 2048 2048
ReadX 13372 824 2048 2048
ReadX 13372 304 2048 2048
ReadX 13372 768 2048 2048
ReadX 13372 712 2048 2048
ReadX 13372 512 2048 2048
ReadX 13372 432 2048 2048
ReadX 13372 384 2048 2048
ReadX 13372 2944 2048 2048
ReadX 13372 1088 2048 2048
ReadX 13372 928 2048 2048
ReadX 13372 280 2048 2048
ReadX 13372 744 2048 2048
ReadX 13372 3968 2048 2048
ReadX 13372 336 2048 2048
ReadX 13372 592 2048 2048
ReadX 13372 312 2048 2048
ReadX 13372 400 2048 2048
ReadX 13372 904 2048 2048
ReadX 13372 464 2048 2048
ReadX 13372 3456 2048 2048
ReadX 13372 848 2048 2048
ReadX 13372 936 2048 2048
ReadX 13372 656 2048 2048
ReadX 13372 344 2048 2048
ReadX 13372 440 2048 2048
ReadX 13372 4096 2048 2048
ReadX 13372 528 2048 2048
ReadX 13372 2048 2048 2048
ReadX 13372 1024 2048 2048
ReadX 13372 456 2048 2048
ReadX 13372 1792 2048 2048
ReadX 13372 1152 2048 2048
ReadX 13372 3584 2048 2048
ReadX 13372 1920 2048 2048
ReadX 13372 1280 2048 2048
ReadX 13372 896 2048 2048
ReadX 13372 328 2048 2048
Close 13380
Close 13381
Close 13382
Close 13383
Close 13378
Close 13372
Close 13373
Close 13376
Close 13377
Close 13374
Close 13375
Close 13367
Close 13368
Close 13369
Close 13370
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13387
FIND_FIRST \clients\client1\~dmtmp\*
Close 13387
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13388
QUERY_FILE_INFORMATION 13388
WriteX 13388 0 2048 2048
WriteX 13388 18431 1 1
QUERY_FILE_INFORMATION 13388
WriteX 13388 2048 16384 16384
WriteX 13388 1152 16384 16384
WriteX 13388 2176 16384 16384
WriteX 13388 3200 16384 16384
WriteX 13388 264 16384 16384
WriteX 13388 328 16384 16384
WriteX 13388 392 16384 16384
WriteX 13388 456 16384 16384
WriteX 13388 520 16384 16384
WriteX 13388 584 16384 16384
WriteX 13388 648 16384 16384
WriteX 13388 712 16384 16384
WriteX 13388 776 16384 16384
WriteX 13388 840 16384 16384
WriteX 13388 904 16384 16384
WriteX 13388 968 16384 16384
WriteX 13388 1032 16384 16384
WriteX 13388 1096 16384 16384
WriteX 13388 1160 16384 16384
WriteX 13388 1224 16384 16384
WriteX 13388 1288 16384 16384
WriteX 13388 1352 16384 16384
WriteX 13388 1416 16384 16384
WriteX 13388 1480 16384 16384
WriteX 13388 1544 16384 16384
WriteX 13388 1608 16384 16384
WriteX 13388 1672 16384 16384
WriteX 13388 1736 16384 16384
WriteX 13388 1800 16384 16384
WriteX 13388 1864 16384 16384
WriteX 13388 1928 16384 16384
WriteX 13388 1992 16384 16384
WriteX 13388 2056 16384 16384
WriteX 13388 2120 16384 16384
WriteX 13388 2184 16384 16384
WriteX 13388 2248 16384 16384
WriteX 13388 2312 16384 16384
WriteX 13388 2376 16384 16384
WriteX 13388 2440 16384 16384
WriteX 13388 0 88 88
Close 13388
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13389
ReadX 13389 0 511 511
ReadX 13389 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13389
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13390
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13390 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13391
ReadX 13391 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13392
ReadX 13392 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13393
ReadX 13393 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13394
ReadX 13394 0 53 53
ReadX 13394 53 2 2
ReadX 13394 55 480 480
ReadX 13394 535 2 2
Close 13394
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13395
ReadX 13395 0 511 511
ReadX 13395 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13396
ReadX 13396 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13397
ReadX 13397 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13398
ReadX 13398 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13399
ReadX 13399 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13400
ReadX 13400 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13401
ReadX 13401 0 41 41
ReadX 13395 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13402
ReadX 13402 0 53 53
ReadX 13402 53 2 2
ReadX 13402 55 2 2
ReadX 13402 57 184 184
ReadX 13402 241 298 298
Close 13402
ReadX 13390 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13403
ReadX 13403 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13404
ReadX 13404 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13405
ReadX 13405 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13406
ReadX 13406 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13407
ReadX 13407 0 53 53
ReadX 13407 53 28 28
ReadX 13407 81 28 28
ReadX 13407 109 28 28
ReadX 13407 137 28 28
ReadX 13407 165 28 28
ReadX 13407 193 28 28
ReadX 13407 221 28 28
ReadX 13407 249 4 4
ReadX 13407 253 4 4
ReadX 13407 257 4 4
ReadX 13407 261 28 28
ReadX 13407 289 2 2
ReadX 13407 291 2 2
ReadX 13407 293 2 2
Close 13407
ReadX 13403 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13408
ReadX 13408 0 53 53
ReadX 13408 53 2 2
ReadX 13408 55 2 2
ReadX 13408 57 184 184
ReadX 13408 241 298 298
Close 13408
ReadX 13392 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13409
ReadX 13409 0 53 53
ReadX 13409 53 2 2
ReadX 13409 55 480 480
ReadX 13409 535 2 2
Close 13409
Close 13403
Close 13404
Close 13405
Close 13406
Close 13401
Close 13395
Close 13396
Close 13399
Close 13400
Close 13397
Close 13398
Close 13390
Close 13391
Close 13392
Close 13393
Close 13319
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13410
QUERY_FILE_INFORMATION 13410
Close 13410
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13337
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13411
QUERY_FILE_INFORMATION 13411
Close 13411
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13366
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13412
QUERY_FILE_INFORMATION 13412
Close 13412
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13413
Close 13413
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13414
ReadX 13414 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13415
ReadX 13415 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13416
ReadX 13416 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13417
ReadX 13417 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13418
ReadX 13418 0 53 53
ReadX 13418 53 28 28
ReadX 13418 81 28 28
ReadX 13418 109 28 28
ReadX 13418 137 28 28
ReadX 13418 165 28 28
ReadX 13418 193 28 28
ReadX 13418 221 28 28
ReadX 13418 249 4 4
ReadX 13418 253 4 4
ReadX 13418 257 4 4
ReadX 13418 261 28 28
ReadX 13418 289 2 2
ReadX 13418 291 2 2
ReadX 13418 293 2 2
Close 13418
ReadX 13414 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13414 384 2048 2048
ReadX 13414 768 16384 16384
ReadX 13414 1792 14336 14336
ReadX 13417 2048 2048 2048
ReadX 13416 2048 2048 2048
WriteX 13414 1152 2048 2048
WriteX 13417 2048 2048 2048
WriteX 13416 2048 2048 2048
WriteX 13414 0 88 88
WriteX 13415 0 88 88
WriteX 13416 0 88 88
WriteX 13417 0 88 88
Close 13414
Close 13415
Close 13416
Close 13417
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13419
Close 13419
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13420
ReadX 13420 0 511 511
ReadX 13420 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13421
ReadX 13421 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13422
ReadX 13422 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13423
ReadX 13423 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13424
ReadX 13424 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13425
ReadX 13425 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13426
ReadX 13426 0 53 53
ReadX 13426 53 2 2
ReadX 13426 55 2 2
ReadX 13426 57 184 184
ReadX 13426 241 298 298
Close 13426
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13427
ReadX 13427 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13428
ReadX 13428 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13429
ReadX 13429 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13430
ReadX 13430 0 511 511
ReadX 13429 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13431
ReadX 13431 0 53 53
ReadX 13431 53 2 2
ReadX 13431 55 480 480
ReadX 13431 535 2 2
Close 13431
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13432
ReadX 13432 0 41 41
ReadX 13420 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13433
QUERY_FILE_INFORMATION 13433
QUERY_FILE_INFORMATION 13433
ReadX 13433 0 8192 8192
Close 13433
ReadX 13420 1152 2048 2048
ReadX 13420 4096 16384 16384
Close 13427
Close 13428
Close 13429
Close 13430
Close 13432
Close 13420
Close 13421
Close 13424
Close 13425
Close 13422
Close 13423
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13434
Close 13434
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13435
QUERY_FILE_INFORMATION 13435
ReadX 13435 0 64 64
ReadX 13435 144 64 64
ReadX 13435 224 156 156
ReadX 13435 1193 128 128
ReadX 13435 1201 128 128
ReadX 13435 1072 4 4
ReadX 13435 1076 1925 1925
ReadX 13435 758 4 4
ReadX 13435 762 4557 4557
ReadX 13435 1052 4 4
ReadX 13435 1056 314 314
ReadX 13435 1056 11056 11056
Close 13435
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13436
ReadX 13436 0 511 511
ReadX 13436 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13437
ReadX 13437 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13438
ReadX 13438 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13439
ReadX 13439 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13440
ReadX 13440 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13441
ReadX 13441 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13442
ReadX 13442 0 53 53
ReadX 13442 53 2 2
ReadX 13442 55 2 2
ReadX 13442 57 184 184
ReadX 13442 241 298 298
Close 13442
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13443
ReadX 13443 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13444
ReadX 13444 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13445
ReadX 13445 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13446
ReadX 13446 0 511 511
ReadX 13445 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13447
ReadX 13447 0 53 53
ReadX 13447 53 2 2
ReadX 13447 55 480 480
ReadX 13447 535 2 2
Close 13447
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13448
ReadX 13448 0 41 41
ReadX 13436 2048 2048 2048
ReadX 13437 2048 2048 2048
ReadX 13436 1144 2048 2048
ReadX 13436 1152 2048 2048
ReadX 13436 4096 16384 16384
WriteX 13436 2048 2048 2048
WriteX 13437 2048 2048 2048
WriteX 13436 0 88 88
WriteX 13437 0 88 88
Close 13443
Close 13444
Close 13445
Close 13446
Close 13448
Close 13436
Close 13437
Close 13440
Close 13441
Close 13438
Close 13439
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13449
Close 13449
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13450
QUERY_FILE_INFORMATION 13450
ReadX 13450 0 64 64
ReadX 13450 144 64 64
ReadX 13450 224 84 84
ReadX 13450 478 16 16
ReadX 13450 1056 6176 6176
Close 13450
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13451
ReadX 13451 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13452
ReadX 13452 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13453
ReadX 13453 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13454
ReadX 13454 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13455
ReadX 13455 0 53 53
ReadX 13455 53 28 28
ReadX 13455 81 28 28
ReadX 13455 109 28 28
ReadX 13455 137 28 28
ReadX 13455 165 28 28
ReadX 13455 193 28 28
ReadX 13455 221 28 28
ReadX 13455 249 4 4
ReadX 13455 253 4 4
ReadX 13455 257 4 4
ReadX 13455 261 28 28
ReadX 13455 289 2 2
ReadX 13455 291 2 2
ReadX 13455 293 2 2
Close 13455
ReadX 13451 2048 2048 2048
ReadX 13452 2048 2048 2048
ReadX 13451 1280 2048 2048
ReadX 13454 2048 2048 2048
ReadX 13453 2048 2048 2048
WriteX 13451 1280 2048 2048
WriteX 13454 2048 2048 2048
WriteX 13453 2048 2048 2048
WriteX 13452 2048 2048 2048
WriteX 13451 0 88 88
WriteX 13452 0 88 88
WriteX 13453 0 88 88
WriteX 13454 0 88 88
WriteX 13451 1280 2048 2048
WriteX 13454 2048 2048 2048
WriteX 13453 2048 2048 2048
WriteX 13452 2048 2048 2048
WriteX 13451 0 88 88
WriteX 13452 0 88 88
WriteX 13453 0 88 88
WriteX 13454 0 88 88
WriteX 13451 1280 2048 2048
WriteX 13454 2048 2048 2048
WriteX 13453 2048 2048 2048
WriteX 13452 2048 2048 2048
WriteX 13451 0 88 88
WriteX 13452 0 88 88
WriteX 13453 0 88 88
WriteX 13454 0 88 88
Close 13451
Close 13452
Close 13453
Close 13454
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13456
ReadX 13456 0 511 511
ReadX 13456 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13457
ReadX 13457 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13458
ReadX 13458 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13459
ReadX 13459 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13460
ReadX 13460 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13461
ReadX 13461 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13462
ReadX 13462 0 53 53
ReadX 13462 53 2 2
ReadX 13462 55 2 2
ReadX 13462 57 184 184
ReadX 13462 241 298 298
Close 13462
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13463
ReadX 13463 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13464
ReadX 13464 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13465
ReadX 13465 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13466
ReadX 13466 0 511 511
ReadX 13465 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13467
ReadX 13467 0 53 53
ReadX 13467 53 2 2
ReadX 13467 55 480 480
ReadX 13467 535 2 2
Close 13467
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13468
ReadX 13468 0 41 41
ReadX 13456 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13472
FIND_FIRST \clients\client1\~dmtmp\*
Close 13472
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13473
QUERY_FILE_INFORMATION 13473
WriteX 13473 2047 1 1
QUERY_FILE_INFORMATION 13473
WriteX 13473 0 2048 2048
Close 13473
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13474
ReadX 13474 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13474 4095 1 1
QUERY_FILE_INFORMATION 13474
WriteX 13474 2048 2048 2048
WriteX 13474 0 88 88
Close 13474
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13475
ReadX 13475 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13475 2048 2048 2048
Close 13463
Close 13464
Close 13465
Close 13466
Close 13468
Close 13456
Close 13457
Close 13460
Close 13461
Close 13458
Close 13459
WriteX 13475 2048 2048 2048
WriteX 13475 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13476
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13476 0 511 511
ReadX 13476 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13477
ReadX 13477 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13478
ReadX 13478 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13479
ReadX 13479 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13480
ReadX 13480 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13481
ReadX 13481 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13482
ReadX 13482 0 53 53
ReadX 13482 53 2 2
ReadX 13482 55 2 2
ReadX 13482 57 184 184
ReadX 13482 241 298 298
Close 13482
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13483
ReadX 13483 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13484
ReadX 13484 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13485
ReadX 13485 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13486
ReadX 13486 0 511 511
ReadX 13485 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13487
ReadX 13487 0 53 53
ReadX 13487 53 2 2
ReadX 13487 55 480 480
ReadX 13487 535 2 2
Close 13487
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13488
ReadX 13488 0 41 41
ReadX 13476 2048 2048 2048
ReadX 13476 1152 2048 2048
ReadX 13476 4096 16384 16384
ReadX 13476 1280 16384 16384
ReadX 13476 2304 16384 16384
ReadX 13476 3328 16384 16384
ReadX 13476 272 16384 16384
ReadX 13476 336 16384 16384
ReadX 13476 400 16384 16384
ReadX 13476 464 16384 16384
ReadX 13476 528 16384 16384
ReadX 13476 592 16384 16384
ReadX 13476 656 16384 16384
ReadX 13476 720 16384 16384
ReadX 13476 784 16384 16384
ReadX 13476 848 16384 16384
ReadX 13476 912 16384 16384
ReadX 13476 976 16384 16384
ReadX 13476 1040 16384 16384
ReadX 13476 1104 12288 12288
Close 13483
Close 13484
Close 13485
Close 13486
Close 13488
Close 13476
Close 13477
Close 13480
Close 13481
Close 13478
Close 13479
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13489
FIND_FIRST \clients\client1\~dmtmp\*
Close 13489
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13490
QUERY_FILE_INFORMATION 13490
WriteX 13490 0 2048 2048
WriteX 13490 2048 4096 4096
WriteX 13490 0 88 88
Close 13490
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13491
ReadX 13491 0 511 511
ReadX 13491 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13491
WriteX 13475 2048 2048 2048
WriteX 13475 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13492
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13492 0 511 511
ReadX 13492 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13493
ReadX 13493 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13494
ReadX 13494 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13495
ReadX 13495 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13496
ReadX 13496 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13497
ReadX 13497 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13498
ReadX 13498 0 53 53
ReadX 13498 53 2 2
ReadX 13498 55 2 2
ReadX 13498 57 184 184
ReadX 13498 241 298 298
Close 13498
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13499
ReadX 13499 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13500
ReadX 13500 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13501
ReadX 13501 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13502
ReadX 13502 0 511 511
ReadX 13501 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13503
ReadX 13503 0 53 53
ReadX 13503 53 2 2
ReadX 13503 55 480 480
ReadX 13503 535 2 2
Close 13503
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13504
ReadX 13504 0 41 41
ReadX 13492 2048 2048 2048
ReadX 13492 1152 2048 2048
ReadX 13492 4096 16384 16384
ReadX 13492 1280 16384 16384
ReadX 13492 2304 16384 16384
ReadX 13492 3328 16384 16384
ReadX 13492 272 16384 16384
ReadX 13492 336 16384 16384
ReadX 13492 400 16384 16384
ReadX 13492 464 16384 16384
ReadX 13492 528 16384 16384
ReadX 13492 592 16384 16384
ReadX 13492 656 16384 16384
ReadX 13492 720 16384 16384
ReadX 13492 784 16384 16384
ReadX 13492 848 16384 16384
ReadX 13492 912 16384 16384
ReadX 13492 976 16384 16384
ReadX 13492 1040 16384 16384
ReadX 13492 1104 12288 12288
Close 13499
Close 13500
Close 13501
Close 13502
Close 13504
Close 13492
Close 13493
Close 13496
Close 13497
Close 13494
Close 13495
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13505
FIND_FIRST \clients\client1\~dmtmp\*
Close 13505
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13506
QUERY_FILE_INFORMATION 13506
WriteX 13506 0 2048 2048
WriteX 13506 2048 4096 4096
WriteX 13506 0 88 88
Close 13506
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13507
ReadX 13507 0 511 511
ReadX 13507 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13507
Close 13475
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13508
QUERY_FILE_INFORMATION 13508
Close 13508
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13509
Close 13509
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13510
QUERY_FILE_INFORMATION 13510
ReadX 13510 0 64 64
ReadX 13510 144 64 64
ReadX 13510 224 156 156
ReadX 13510 1193 128 128
ReadX 13510 1201 128 128
ReadX 13510 1072 4 4
ReadX 13510 1076 1925 1925
ReadX 13510 758 4 4
ReadX 13510 762 4557 4557
ReadX 13510 1052 4 4
ReadX 13510 1056 314 314
ReadX 13510 1056 11056 11056
Close 13510
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13511
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13511 0 511 511
ReadX 13511 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13512
ReadX 13512 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13513
ReadX 13513 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13514
ReadX 13514 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13515
ReadX 13515 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13516
ReadX 13516 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13517
ReadX 13517 0 53 53
ReadX 13517 53 2 2
ReadX 13517 55 2 2
ReadX 13517 57 184 184
ReadX 13517 241 298 298
Close 13517
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13518
ReadX 13518 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13519
ReadX 13519 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13520
ReadX 13520 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13521
ReadX 13521 0 511 511
ReadX 13520 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13522
ReadX 13522 0 53 53
ReadX 13522 53 2 2
ReadX 13522 55 480 480
ReadX 13522 535 2 2
Close 13522
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13523
ReadX 13523 0 41 41
ReadX 13511 2048 2048 2048
ReadX 13511 1152 2048 2048
ReadX 13511 4096 16384 16384
Close 13518
Close 13519
Close 13520
Close 13521
Close 13523
Close 13511
Close 13512
Close 13515
Close 13516
Close 13513
Close 13514
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13524
ReadX 13524 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13525
ReadX 13525 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13526
ReadX 13526 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13527
ReadX 13527 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13528
ReadX 13528 0 53 53
ReadX 13528 53 2 2
ReadX 13528 55 480 480
ReadX 13528 535 2 2
Close 13528
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13529
ReadX 13529 0 511 511
ReadX 13529 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13530
ReadX 13530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13531
ReadX 13531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13532
ReadX 13532 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13533
ReadX 13533 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13534
ReadX 13534 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13535
ReadX 13535 0 41 41
ReadX 13529 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13536
ReadX 13536 0 53 53
ReadX 13536 53 2 2
ReadX 13536 55 2 2
ReadX 13536 57 184 184
ReadX 13536 241 298 298
Close 13536
ReadX 13524 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13540
FIND_FIRST \clients\client1\~dmtmp\*
Close 13540
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13541
QUERY_FILE_INFORMATION 13541
WriteX 13541 2047 1 1
QUERY_FILE_INFORMATION 13541
WriteX 13541 0 2048 2048
Close 13541
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13542
ReadX 13542 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13542 4095 1 1
QUERY_FILE_INFORMATION 13542
WriteX 13542 2048 2048 2048
WriteX 13542 0 88 88
Close 13542
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13543
ReadX 13543 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13543 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13547
Close 13547
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13548
QUERY_FILE_INFORMATION 13548
WriteX 13548 2047 1 1
QUERY_FILE_INFORMATION 13548
WriteX 13548 0 2048 2048
Close 13548
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13549
ReadX 13549 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13549 4095 1 1
QUERY_FILE_INFORMATION 13549
WriteX 13549 2048 2048 2048
WriteX 13549 0 88 88
Close 13549
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13550
ReadX 13550 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13550 2048 2048 2048
Close 13535
Close 13529
Close 13530
Close 13533
Close 13534
Close 13531
Close 13532
Close 13524
Close 13525
Close 13526
Close 13527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13551
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13551 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13552
ReadX 13552 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13553
ReadX 13553 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13554
ReadX 13554 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13555
ReadX 13555 0 53 53
ReadX 13555 53 2 2
ReadX 13555 55 480 480
ReadX 13555 535 2 2
Close 13555
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13556
ReadX 13556 0 511 511
ReadX 13556 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13557
ReadX 13557 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13558
ReadX 13558 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13559
ReadX 13559 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13560
ReadX 13560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13561
ReadX 13561 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13562
ReadX 13562 0 41 41
ReadX 13556 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13563
ReadX 13563 0 53 53
ReadX 13563 53 2 2
ReadX 13563 55 2 2
ReadX 13563 57 184 184
ReadX 13563 241 298 298
Close 13563
ReadX 13551 2048 2048 2048
ReadX 13551 384 16384 16384
ReadX 13551 1408 16384 16384
ReadX 13551 2560 16384 16384
ReadX 13551 3584 16384 16384
ReadX 13551 288 16384 16384
ReadX 13551 352 16384 16384
ReadX 13551 416 16384 16384
ReadX 13551 480 16384 16384
ReadX 13551 552 16384 16384
ReadX 13551 616 16384 16384
ReadX 13551 680 16384 16384
ReadX 13551 744 16384 16384
ReadX 13551 808 16384 16384
ReadX 13551 872 16384 16384
ReadX 13551 936 10240 10240
Close 13562
Close 13556
Close 13557
Close 13560
Close 13561
Close 13558
Close 13559
Close 13551
Close 13552
Close 13553
Close 13554
Close 13543
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13564
QUERY_FILE_INFORMATION 13564
Close 13564
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13550
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13565
QUERY_FILE_INFORMATION 13565
Close 13565
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13566
ReadX 13566 0 65471 65471
ReadX 13566 65471 63 63
ReadX 13566 65534 65471 65471
ReadX 13566 131005 63 63
ReadX 13566 131068 65471 65471
ReadX 13566 196539 63 63
ReadX 13566 196602 65471 65471
ReadX 13566 262073 63 63
ReadX 13566 262136 65471 65471
ReadX 13566 327607 63 63
ReadX 13566 327670 10 10
Close 13566
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13567
ReadX 13567 0 65471 65471
ReadX 13567 65471 63 63
ReadX 13567 65534 65471 65471
ReadX 13567 131005 63 63
ReadX 13567 131068 65471 65471
ReadX 13567 196539 63 63
ReadX 13567 196602 65471 65471
ReadX 13567 262073 63 63
ReadX 13567 262136 65471 65471
ReadX 13567 327607 63 63
ReadX 13567 327670 65471 65471
ReadX 13567 393141 63 63
ReadX 13567 393204 65471 65471
ReadX 13567 458675 63 63
ReadX 13567 458738 65471 65471
ReadX 13567 524209 63 63
ReadX 13567 524272 65471 65471
ReadX 13567 589743 63 63
ReadX 13567 589806 65471 65471
ReadX 13567 655277 63 63
ReadX 13567 655340 32 32
Close 13567
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13568
ReadX 13568 0 65471 65471
ReadX 13568 65471 63 63
ReadX 13568 65534 65471 65471
ReadX 13568 131005 63 63
ReadX 13568 131068 65471 65471
ReadX 13568 196539 63 63
ReadX 13568 196602 65471 65471
ReadX 13568 262073 63 63
ReadX 13568 262136 65471 65471
ReadX 13568 327607 63 63
ReadX 13568 327670 65471 65471
ReadX 13568 393141 63 63
ReadX 13568 393204 65471 65471
ReadX 13568 458675 63 63
ReadX 13568 458738 65471 65471
ReadX 13568 524209 63 63
ReadX 13568 524272 65471 65471
ReadX 13568 589743 63 63
ReadX 13568 589806 65471 65471
ReadX 13568 655277 63 63
ReadX 13568 655340 65471 65471
ReadX 13568 720811 63 63
ReadX 13568 720874 65471 65471
ReadX 13568 786345 63 63
ReadX 13568 786408 65471 65471
ReadX 13568 851879 63 63
ReadX 13568 851942 65471 65471
ReadX 13568 917413 63 63
ReadX 13568 917476 65471 65471
ReadX 13568 982947 63 63
ReadX 13568 983010 65471 65471
ReadX 13568 1048481 63 63
ReadX 13568 1048544 65471 65471
ReadX 13568 1114015 63 63
ReadX 13568 1114078 65471 65471
ReadX 13568 1179549 63 63
ReadX 13568 1179612 65471 65471
ReadX 13568 1245083 63 63
ReadX 13568 1245146 65471 65471
ReadX 13568 1310617 63 63
ReadX 13568 1310680 65471 65471
ReadX 13568 1376151 63 63
ReadX 13568 1376214 65471 65471
ReadX 13568 1441685 63 63
ReadX 13568 1441748 65471 65471
ReadX 13568 1507219 63 63
ReadX 13568 1507282 65471 65471
ReadX 13568 1572753 63 63
ReadX 13568 1572816 65471 65471
ReadX 13568 1638287 63 63
ReadX 13568 1638350 65471 65471
ReadX 13568 1703821 63 63
ReadX 13568 1703884 65471 65471
ReadX 13568 1769355 63 63
ReadX 13568 1769418 65471 65471
ReadX 13568 1834889 63 63
ReadX 13568 1834952 32824 32824
Close 13568
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13569
QUERY_FILE_INFORMATION 13569
ReadX 13569 0 512 512
ReadX 13569 512 512 512
ReadX 13569 1024 512 512
QUERY_FILE_INFORMATION 13569
QUERY_FILE_INFORMATION 13569
ReadX 13569 2560 2048 2048
ReadX 13569 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13570
WriteX 13570 52 1 1
QUERY_FILE_INFORMATION 13570
WriteX 13570 0 53 53
Close 13570
ReadX 13569 2208 650 650
ReadX 13569 1920 2048 2048
ReadX 13569 2112 2048 2048
ReadX 13569 1856 2048 2048
ReadX 13569 1824 2048 2048
ReadX 13569 1536 512 512
ReadX 13569 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13571
Close 13571
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13569 1568 512 512
ReadX 13569 1536 512 512
ReadX 13569 2176 384 384
ReadX 13569 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13572
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13569 288 2048 2048
ReadX 13569 2336 2048 2048
ReadX 13569 4384 2048 2048
ReadX 13569 6432 2048 2048
ReadX 13569 8480 2048 2048
ReadX 13569 10528 2048 2048
ReadX 13569 12576 2048 2048
WriteX 13572 15359 1 1
QUERY_FILE_INFORMATION 13572
ReadX 13569 14624 2048 2048
ReadX 13569 16672 2048 2048
ReadX 13569 18720 2048 2048
ReadX 13569 1728 2048 2048
WriteX 13572 0 15360 15360
Close 13572
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13573
QUERY_FILE_INFORMATION 13573
ReadX 13573 0 512 512
ReadX 13573 2048 512 512
ReadX 13573 2560 512 512
QUERY_FILE_INFORMATION 13573
QUERY_FILE_INFORMATION 13573
QUERY_FILE_INFORMATION 13573
QUERY_FILE_INFORMATION 13573
QUERY_FILE_INFORMATION 13573
WriteX 13573 2152 384 384
QUERY_FILE_INFORMATION 13573
WriteX 13573 2150 22 22
WriteX 13573 2144 106 106
QUERY_FILE_INFORMATION 13573
WriteX 13573 2176 496 496
ReadX 13573 2176 496 496
QUERY_FILE_INFORMATION 13573
WriteX 13573 2440 384 384
QUERY_FILE_INFORMATION 13573
WriteX 13573 2152 384 384
WriteX 13573 2432 112 112
QUERY_FILE_INFORMATION 13573
WriteX 13573 2439 16 16
QUERY_FILE_INFORMATION 13573
WriteX 13573 2208 220 220
ReadX 13573 2208 220 220
QUERY_FILE_INFORMATION 13573
QUERY_FILE_INFORMATION 13573
WriteX 13573 2440 220 220
QUERY_FILE_INFORMATION 13573
WriteX 13573 2453 36 36
WriteX 13573 2080 512 512
WriteX 13573 2176 512 512
WriteX 13573 2112 512 512
WriteX 13573 2048 512 512
WriteX 13573 0 512 512
QUERY_FILE_INFORMATION 13569
QUERY_FILE_INFORMATION 13569
WriteX 13573 2080 512 512
Close 13573
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13574
Close 13574
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13575
QUERY_FILE_INFORMATION 13575
ReadX 13575 0 512 512
ReadX 13575 2048 512 512
ReadX 13575 2560 512 512
QUERY_FILE_INFORMATION 13575
QUERY_FILE_INFORMATION 13575
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13576
Close 13576
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13569
ReadX 13575 1408 512 512
ReadX 13575 2048 512 512
ReadX 13575 1536 512 512
ReadX 13575 2560 512 512
ReadX 13575 3072 512 512
ReadX 13575 3584 512 512
ReadX 13575 4096 512 512
ReadX 13575 4608 512 512
ReadX 13575 5120 512 512
ReadX 13575 5632 512 512
ReadX 13575 6144 512 512
ReadX 13575 6656 512 512
ReadX 13575 7168 512 512
ReadX 13575 7680 512 512
ReadX 13575 8192 512 512
ReadX 13575 8704 512 512
ReadX 13575 9216 512 512
ReadX 13575 9728 512 512
ReadX 13575 10240 512 512
ReadX 13575 10752 512 512
ReadX 13575 11264 512 512
ReadX 13575 11776 512 512
ReadX 13575 12288 512 512
ReadX 13575 12800 512 512
ReadX 13575 13312 512 512
ReadX 13575 13824 512 512
ReadX 13575 14336 512 512
ReadX 13575 14848 512 512
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 15360 512 0
ReadX 13575 2560 2048 2048
ReadX 13575 4608 2048 2048
ReadX 13575 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13577
QUERY_FILE_INFORMATION 13577
ReadX 13577 0 512 512
ReadX 13577 512 512 512
ReadX 13577 1024 512 512
QUERY_FILE_INFORMATION 13577
QUERY_FILE_INFORMATION 13577
ReadX 13577 352 2048 2048
ReadX 13577 608 1097 1097
ReadX 13577 576 1609 1609
ReadX 13577 4096 512 512
ReadX 13577 1536 512 512
ReadX 13577 3840 256 256
ReadX 13577 288 576 576
ReadX 13577 512 512 512
ReadX 13577 480 512 512
ReadX 13577 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13578
ReadX 13578 0 4096 4096
ReadX 13578 4096 4096 4096
ReadX 13578 8192 4096 4096
Close 13577
Close 13578
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13579
WriteX 13579 15359 1 1
QUERY_FILE_INFORMATION 13579
WriteX 13579 0 15360 15360
Close 13579
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13580
QUERY_FILE_INFORMATION 13580
ReadX 13580 0 512 512
ReadX 13580 2048 512 512
ReadX 13580 2560 512 512
QUERY_FILE_INFORMATION 13580
QUERY_FILE_INFORMATION 13580
QUERY_FILE_INFORMATION 13580
QUERY_FILE_INFORMATION 13580
QUERY_FILE_INFORMATION 13580
WriteX 13580 2152 384 384
QUERY_FILE_INFORMATION 13580
WriteX 13580 2150 22 22
WriteX 13580 2144 106 106
QUERY_FILE_INFORMATION 13580
WriteX 13580 2176 476 476
ReadX 13580 2176 476 476
QUERY_FILE_INFORMATION 13580
WriteX 13580 2440 384 384
QUERY_FILE_INFORMATION 13580
WriteX 13580 2152 384 384
WriteX 13580 2432 92 92
QUERY_FILE_INFORMATION 13580
WriteX 13580 2437 36 36
QUERY_FILE_INFORMATION 13580
WriteX 13580 2208 220 220
ReadX 13580 2208 220 220
QUERY_FILE_INFORMATION 13580
QUERY_FILE_INFORMATION 13580
WriteX 13580 2440 220 220
QUERY_FILE_INFORMATION 13580
WriteX 13580 2453 36 36
WriteX 13580 2080 512 512
WriteX 13580 2176 512 512
WriteX 13580 2112 512 512
WriteX 13580 2048 512 512
WriteX 13580 0 512 512
QUERY_FILE_INFORMATION 13575
QUERY_FILE_INFORMATION 13575
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13575
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13581
Close 13581
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13582
QUERY_FILE_INFORMATION 13582
ReadX 13582 0 512 512
ReadX 13582 2048 512 512
ReadX 13582 2560 512 512
QUERY_FILE_INFORMATION 13582
QUERY_FILE_INFORMATION 13582
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13583
Close 13583
WriteX 13580 2080 512 512
Close 13580
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13584
Close 13584
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13585
QUERY_FILE_INFORMATION 13585
ReadX 13585 0 512 512
ReadX 13585 2048 512 512
ReadX 13585 2560 512 512
QUERY_FILE_INFORMATION 13585
QUERY_FILE_INFORMATION 13585
ReadX 13585 1312 512 512
ReadX 13585 1536 512 512
ReadX 13585 2048 512 512
ReadX 13585 576 512 512
ReadX 13585 1088 512 512
ReadX 13585 1056 512 512
ReadX 13585 1120 512 512
ReadX 13585 1184 512 512
ReadX 13585 2560 2048 2048
ReadX 13585 4608 2048 2048
ReadX 13585 6656 2048 2048
ReadX 13585 8704 2048 2048
ReadX 13585 10752 2048 2048
ReadX 13585 12800 2048 2048
ReadX 13585 14848 2048 512
ReadX 13585 15360 1536 0
ReadX 13585 1088 2048 2048
ReadX 13585 3136 2048 2048
ReadX 13585 1665 5835 5835
ReadX 13585 1856 2048 2048
ReadX 13585 2112 512 512
ReadX 13585 2152 384 384
ReadX 13585 2432 92 92
ReadX 13585 2176 512 512
ReadX 13585 2440 220 220
QUERY_FILE_INFORMATION 13585
QUERY_FILE_INFORMATION 13585
ReadX 13585 2432 512 512
WriteX 13585 2272 512 512
ReadX 13585 2144 512 512
WriteX 13585 2304 512 512
WriteX 13585 2272 92 92
WriteX 13585 2208 512 512
WriteX 13585 2720 512 512
WriteX 13585 0 512 512
QUERY_FILE_INFORMATION 13585
QUERY_FILE_INFORMATION 13585
ReadX 13585 1312 4096 4096
ReadX 13585 5408 4096 4096
ReadX 13585 9504 3305 3305
ReadX 13585 512 4096 4096
QUERY_FILE_INFORMATION 13585
QUERY_FILE_INFORMATION 13585
QUERY_FILE_INFORMATION 13585
WriteX 13585 3132 50 50
WriteX 13585 3182 4096 4096
WriteX 13585 7278 4096 4096
WriteX 13585 15469 1 1
QUERY_FILE_INFORMATION 13585
WriteX 13585 11374 4096 4096
WriteX 13585 15470 3584 3584
WriteX 13585 2144 512 512
WriteX 13585 2336 4096 4096
WriteX 13585 6432 4096 4096
WriteX 13585 10528 4096 4096
WriteX 13585 14624 462 462
WriteX 13585 2048 512 512
WriteX 13585 2560 512 512
WriteX 13585 0 512 512
QUERY_FILE_INFORMATION 13585
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13586
QUERY_FILE_INFORMATION 13586
ReadX 13586 0 512 512
ReadX 13586 1152 512 512
ReadX 13586 1664 512 512
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
ReadX 13586 512 2048 2048
ReadX 13586 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13587
WriteX 13587 52 1 1
QUERY_FILE_INFORMATION 13587
WriteX 13587 0 53 53
Close 13587
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
ReadX 13586 1120 504 504
ReadX 13586 896 2048 2048
ReadX 13586 1056 1528 1528
ReadX 13586 864 2048 2048
ReadX 13586 832 2048 2048
ReadX 13586 736 2048 2048
ReadX 13586 1216 512 512
ReadX 13586 1256 384 384
ReadX 13586 1536 140 140
ReadX 13586 1280 512 512
ReadX 13586 1548 252 252
ReadX 13585 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13588
Close 13588
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13589
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13586 2560 2048 2048
ReadX 13586 4608 2048 2048
ReadX 13586 6656 2048 2048
ReadX 13586 8704 2048 2048
ReadX 13586 10752 2048 2048
WriteX 13589 12005 1 1
QUERY_FILE_INFORMATION 13589
WriteX 13589 0 12006 12006
Close 13589
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13590
QUERY_FILE_INFORMATION 13590
ReadX 13590 0 512 512
ReadX 13590 1152 512 512
ReadX 13590 1664 512 512
QUERY_FILE_INFORMATION 13590
QUERY_FILE_INFORMATION 13590
QUERY_FILE_INFORMATION 13590
QUERY_FILE_INFORMATION 13590
QUERY_FILE_INFORMATION 13590
QUERY_FILE_INFORMATION 13590
QUERY_FILE_INFORMATION 13590
WriteX 13590 1256 384 384
QUERY_FILE_INFORMATION 13590
WriteX 13590 1254 22 22
WriteX 13590 1248 106 106
QUERY_FILE_INFORMATION 13590
WriteX 13590 1280 508 508
ReadX 13590 1280 508 508
QUERY_FILE_INFORMATION 13590
WriteX 13590 1544 384 384
QUERY_FILE_INFORMATION 13590
WriteX 13590 1256 384 384
WriteX 13590 1536 124 124
QUERY_FILE_INFORMATION 13590
WriteX 13590 1543 4 4
QUERY_FILE_INFORMATION 13590
WriteX 13590 1312 252 252
ReadX 13590 1312 252 252
QUERY_FILE_INFORMATION 13590
QUERY_FILE_INFORMATION 13590
WriteX 13590 1544 252 252
QUERY_FILE_INFORMATION 13590
WriteX 13590 1559 4 4
WriteX 13590 1184 512 512
WriteX 13590 1280 512 512
WriteX 13590 1216 512 512
WriteX 13590 1152 512 512
WriteX 13590 0 512 512
QUERY_FILE_INFORMATION 13586
QUERY_FILE_INFORMATION 13586
WriteX 13590 1184 512 512
Close 13590
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13591
Close 13591
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13592
QUERY_FILE_INFORMATION 13592
ReadX 13592 0 512 512
ReadX 13592 1152 512 512
ReadX 13592 1664 512 512
QUERY_FILE_INFORMATION 13592
QUERY_FILE_INFORMATION 13592
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13593
Close 13593
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13586
ReadX 13592 736 512 512
ReadX 13592 1536 2048 2048
ReadX 13592 3584 2048 2048
ReadX 13592 5632 2048 2048
ReadX 13592 7680 2048 2048
ReadX 13592 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13594
WriteX 13594 11990 1 1
QUERY_FILE_INFORMATION 13594
WriteX 13594 0 11991 11991
Close 13594
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13595
QUERY_FILE_INFORMATION 13595
ReadX 13595 0 512 512
ReadX 13595 1184 512 512
ReadX 13595 1696 512 512
QUERY_FILE_INFORMATION 13595
QUERY_FILE_INFORMATION 13595
QUERY_FILE_INFORMATION 13595
QUERY_FILE_INFORMATION 13595
QUERY_FILE_INFORMATION 13595
QUERY_FILE_INFORMATION 13595
QUERY_FILE_INFORMATION 13595
WriteX 13595 1288 384 384
QUERY_FILE_INFORMATION 13595
WriteX 13595 1286 22 22
WriteX 13595 1280 106 106
QUERY_FILE_INFORMATION 13595
WriteX 13595 1312 508 508
ReadX 13595 1312 508 508
QUERY_FILE_INFORMATION 13595
WriteX 13595 1576 384 384
QUERY_FILE_INFORMATION 13595
WriteX 13595 1288 384 384
WriteX 13595 1568 124 124
QUERY_FILE_INFORMATION 13595
WriteX 13595 1575 4 4
QUERY_FILE_INFORMATION 13595
WriteX 13595 1344 252 252
ReadX 13595 1344 252 252
QUERY_FILE_INFORMATION 13595
QUERY_FILE_INFORMATION 13595
WriteX 13595 1576 252 252
QUERY_FILE_INFORMATION 13595
WriteX 13595 1591 4 4
WriteX 13595 1216 512 512
WriteX 13595 1312 512 512
WriteX 13595 1248 512 512
WriteX 13595 1184 512 512
WriteX 13595 0 512 512
QUERY_FILE_INFORMATION 13592
QUERY_FILE_INFORMATION 13592
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13592
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13596
Close 13596
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13597
QUERY_FILE_INFORMATION 13597
ReadX 13597 0 512 512
ReadX 13597 1152 512 512
ReadX 13597 1664 512 512
QUERY_FILE_INFORMATION 13597
QUERY_FILE_INFORMATION 13597
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13598
Close 13598
WriteX 13595 1216 512 512
Close 13595
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13599
Close 13599
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13600
QUERY_FILE_INFORMATION 13600
ReadX 13600 0 512 512
ReadX 13600 1184 512 512
ReadX 13600 1696 512 512
QUERY_FILE_INFORMATION 13600
QUERY_FILE_INFORMATION 13600
ReadX 13600 1536 512 512
ReadX 13600 736 512 512
ReadX 13600 2048 512 512
ReadX 13600 2560 512 512
ReadX 13600 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13601
Close 13601
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13600 914 3899 3899
ReadX 13600 1248 512 512
ReadX 13600 1288 384 384
ReadX 13600 1568 124 124
ReadX 13600 1312 512 512
ReadX 13600 1576 252 252
QUERY_FILE_INFORMATION 13600
QUERY_FILE_INFORMATION 13600
ReadX 13600 1568 512 512
WriteX 13600 1408 512 512
ReadX 13600 1280 512 512
WriteX 13600 1440 512 512
WriteX 13600 1408 124 124
WriteX 13600 1344 512 512
WriteX 13600 1856 512 512
WriteX 13600 0 512 512
QUERY_FILE_INFORMATION 13600
QUERY_FILE_INFORMATION 13600
ReadX 13600 544 4096 4096
ReadX 13600 4640 4096 4096
ReadX 13600 8736 1637 1637
ReadX 13600 512 4096 4096
QUERY_FILE_INFORMATION 13600
QUERY_FILE_INFORMATION 13600
WriteX 13600 1280 512 512
WriteX 13600 1472 3584 3584
WriteX 13600 5056 4096 4096
WriteX 13600 13247 1 1
QUERY_FILE_INFORMATION 13600
WriteX 13600 9152 4096 4096
WriteX 13600 13248 1736 1736
WriteX 13600 1184 512 512
WriteX 13600 1696 512 512
WriteX 13600 0 512 512
QUERY_FILE_INFORMATION 13600
ReadX 13600 1632 1024 1024
ReadX 13600 288 1024 1024
ReadX 13600 1312 2048 2048
ReadX 13600 3360 1024 1024
ReadX 13600 1696 1024 1024
ReadX 13600 2720 512 512
ReadX 13600 3232 512 512
ReadX 13600 3744 512 512
ReadX 13600 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13600 2066 3998 3998
ReadX 13600 1448 384 384
ReadX 13600 1408 124 124
ReadX 13600 1416 252 252
QUERY_FILE_INFORMATION 13600
QUERY_FILE_INFORMATION 13600
ReadX 13600 1408 512 512
WriteX 13600 1536 512 512
ReadX 13600 1440 512 512
WriteX 13600 2048 512 512
WriteX 13600 1536 124 124
WriteX 13600 512 512 512
WriteX 13600 1024 512 512
WriteX 13600 0 512 512
QUERY_FILE_INFORMATION 13600
ReadX 13600 1696 4096 4096
ReadX 13600 5792 4096 4096
ReadX 13600 9888 1736 1736
ReadX 13600 1280 512 512
ReadX 13600 1472 3584 3584
QUERY_FILE_INFORMATION 13600
QUERY_FILE_INFORMATION 13600
WriteX 13600 3940 156 156
WriteX 13600 4096 512 512
WriteX 13600 544 3584 3584
WriteX 13600 4128 4096 4096
WriteX 13600 8224 3584 3584
WriteX 13600 1344 512 512
WriteX 13600 1856 1536 1536
WriteX 13600 2336 512 512
WriteX 13600 3584 356 356
WriteX 13600 2560 512 512
WriteX 13600 3072 512 512
WriteX 13600 0 512 512
QUERY_FILE_INFORMATION 13600
Close 13582
Close 13585
Close 13600
Close 13597
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13602
Close 13602
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13603
Close 13603
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13604
WriteX 13604 0 65471 65471
WriteX 13604 65471 63 63
WriteX 13604 65534 65471 65471
WriteX 13604 131005 63 63
Close 13604
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13605
WriteX 13605 0 65471 65471
WriteX 13605 65471 63 63
WriteX 13605 65534 65471 65471
WriteX 13605 131005 63 63
WriteX 13605 131068 65471 65471
WriteX 13605 196539 63 63
WriteX 13605 196602 65471 65471
WriteX 13605 262073 63 63
Close 13605
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13606
WriteX 13606 0 65471 65471
WriteX 13606 65471 63 63
WriteX 13606 65534 65471 65471
WriteX 13606 131005 63 63
WriteX 13606 131068 65471 65471
WriteX 13606 196539 63 63
WriteX 13606 196602 65471 65471
WriteX 13606 262073 63 63
WriteX 13606 262136 65471 65471
WriteX 13606 327607 63 63
WriteX 13606 327670 65471 65471
WriteX 13606 393141 63 63
WriteX 13606 393204 65471 65471
WriteX 13606 458675 63 63
WriteX 13606 458738 65471 65471
WriteX 13606 524209 63 63
Close 13606
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13607
QUERY_FILE_INFORMATION 13607
QUERY_FILE_INFORMATION 13607
ReadX 13607 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13608
Close 13608
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13609
WriteX 13609 63 1 1
QUERY_FILE_INFORMATION 13609
WriteX 13609 0 64 64
ReadX 13607 992 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 344 2048 2048
ReadX 13607 1344 2048 2048
ReadX 13607 1352 2048 2048
ReadX 13607 1320 2048 2048
ReadX 13607 1360 2048 2048
ReadX 13607 1344 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2304 2048 2048
ReadX 13607 1472 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 1480 2048 2048
ReadX 13607 1488 2048 2048
ReadX 13607 1496 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 1504 2048 2048
ReadX 13607 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 1000 2048 2048
ReadX 13607 1416 2048 2048
ReadX 13607 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13607 360 2048 2048
ReadX 13607 368 2048 2048
ReadX 13607 360 2048 2048
ReadX 13607 376 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 1232 2048 2048
ReadX 13607 2432 6144 6144
ReadX 13607 2376 2048 2048
ReadX 13607 2360 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 2376 2048 2048
ReadX 13607 2384 2048 2048
ReadX 13607 2368 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 1296 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 13607 0 2048 2048
ReadX 13607 2688 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 2688 2048 2048
WriteX 13607 2688 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 2688 2048 2048
ReadX 13607 2688 2048 2048
ReadX 13607 2688 2048 2048
WriteX 13607 2688 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13607 2688 2048 2048
ReadX 13607 2688 2048 2048
WriteX 13607 2688 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 320 4096 4096
ReadX 13607 0 2048 2048
ReadX 13607 3584 2048 2048
ReadX 13607 3584 2048 2048
ReadX 13607 3584 2048 2048
ReadX 13607 0 2048 2048
WriteX 13607 3584 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2688 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 2688 2048 2048
ReadX 13607 2688 2048 2048
WriteX 13607 2688 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 3200 2048 2048
ReadX 13607 3200 2048 2048
ReadX 13607 3200 2048 2048
WriteX 13607 3200 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 3456 2048 2048
ReadX 13607 3456 2048 2048
ReadX 13607 3456 2048 2048
WriteX 13607 3456 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2496 2048 2048
ReadX 13607 2472 2048 2048
ReadX 13607 2456 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 2472 2048 2048
ReadX 13607 2480 2048 2048
ReadX 13607 2464 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 2488 2048 2048
ReadX 13607 2568 8192 8192
ReadX 13607 1000 2048 2048
ReadX 13607 328 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 2048 2048 2048
ReadX 13607 2560 2048 2048
ReadX 13607 920 2048 2048
WriteX 13607 2048 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 312 2048 2048
WriteX 13607 336 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 328 2048 2048
WriteX 13607 2560 2048 2048
WriteX 13607 3840 2048 2048
WriteX 13607 920 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2432 2048 2048
WriteX 13607 2432 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2456 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 328 2048 2048
ReadX 13607 2560 2048 2048
ReadX 13607 2048 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 336 2048 2048
ReadX 13607 920 2048 2048
WriteX 13607 1536 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 2048 2048 2048
WriteX 13607 2560 2048 2048
WriteX 13607 336 2048 2048
WriteX 13607 920 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2048 2048 2048
ReadX 13607 2432 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 2048 2048 2048
WriteX 13607 2432 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2456 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1536 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 336 2048 2048
ReadX 13607 920 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 1536 2048 2048
WriteX 13607 336 2048 2048
WriteX 13607 920 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2432 2048 2048
WriteX 13607 2432 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2456 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1536 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 336 2048 2048
ReadX 13607 920 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 1536 2048 2048
WriteX 13607 336 2048 2048
WriteX 13607 920 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2432 2048 2048
WriteX 13607 2432 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2456 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1536 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 336 2048 2048
ReadX 13607 920 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 1536 2048 2048
WriteX 13607 336 2048 2048
WriteX 13607 920 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2432 2048 2048
WriteX 13607 2432 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2456 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1536 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 336 2048 2048
ReadX 13607 920 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 1536 2048 2048
WriteX 13607 336 2048 2048
WriteX 13607 920 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2432 2048 2048
WriteX 13607 2432 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
Flush 13607
ReadX 13607 2456 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1536 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 336 2048 2048
ReadX 13607 920 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 1536 2048 2048
WriteX 13607 336 2048 2048
WriteX 13607 920 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2432 2048 2048
WriteX 13607 2432 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2624 6144 6144
ReadX 13607 2616 2048 2048
ReadX 13607 2688 2048 2048
ReadX 13607 2600 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 2616 2048 2048
ReadX 13607 2608 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 344 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 520 2048 2048
ReadX 13607 1392 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 400 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 536 2048 2048
ReadX 13607 824 2048 2048
ReadX 13607 832 2048 2048
ReadX 13607 384 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 408 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 552 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 824 2048 2048
ReadX 13607 840 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 768 2048 2048
ReadX 13607 2048 2048 2048
WriteX 13607 1415 1 1
WriteX 13607 352 2048 2048
WriteX 13607 1112 2048 2048
WriteX 13607 1400 2048 2048
WriteX 13607 1408 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 2048 2048 2048
WriteX 13607 768 2048 2048
WriteX 13607 344 2048 2048
WriteX 13607 1000 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 416 2048 2048
ReadX 13607 424 2048 2048
ReadX 13607 432 2048 2048
ReadX 13607 440 2048 2048
ReadX 13607 576 16384 16384
ReadX 13607 448 2048 2048
ReadX 13607 456 2048 2048
ReadX 13607 464 2048 2048
ReadX 13607 640 16384 16384
ReadX 13607 704 16384 16384
ReadX 13607 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 13607 848 2048 2048
ReadX 13607 560 2048 2048
ReadX 13607 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 2600 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 352 2048 2048
ReadX 13607 1928 8192 8192
ReadX 13607 528 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 824 2048 2048
ReadX 13607 0 2048 2048
Flush 13607
ReadX 13607 2600 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 352 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 824 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 856 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 392 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 472 2048 2048
ReadX 13607 480 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 488 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 928 2048 2048
ReadX 13607 936 2048 2048
ReadX 13607 976 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 392 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 952 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 528 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 528 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 816 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13607 1336 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 528 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 528 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1240 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2200 4096 4096
ReadX 13607 2152 2048 2048
ReadX 13607 2160 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1312 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 1928 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 824 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1416 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 352 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 824 2048 2048
ReadX 13607 384 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13607 352 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 768 2048 2048
ReadX 13607 2048 2048 2048
ReadX 13607 352 2048 2048
WriteX 13607 1551 1 1
WriteX 13607 1512 2048 2048
WriteX 13607 1520 2048 2048
WriteX 13607 1528 2048 2048
WriteX 13607 1544 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 2048 2048 2048
WriteX 13607 768 2048 2048
WriteX 13607 344 2048 2048
WriteX 13607 1000 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2048 2048 2048
WriteX 13607 2048 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 1000 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1240 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 344 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 384 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 768 2048 2048
WriteX 13607 1567 1 1
WriteX 13607 1552 2048 2048
WriteX 13607 1560 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 768 2048 2048
WriteX 13607 344 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 1328 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1240 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2200 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1240 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 344 2048 2048
ReadX 13607 384 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 2048 2048 2048
ReadX 13607 768 2048 2048
WriteX 13607 1583 1 1
WriteX 13607 1568 2048 2048
WriteX 13607 1576 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 2048 2048 2048
WriteX 13607 768 2048 2048
WriteX 13607 344 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 864 2048 2048
ReadX 13607 872 2048 2048
ReadX 13607 912 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 2688 2048 2048
ReadX 13607 1000 2048 2048
WriteX 13607 2688 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 2944 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 0 2048 2048
Flush 13607
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 2688 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 2688 2048 2048
WriteX 13607 2688 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 392 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 416 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 416 2048 2048
ReadX 13607 864 2048 2048
ReadX 13607 872 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 312 2048 2048
ReadX 13607 888 2048 2048
ReadX 13607 400 2048 2048
ReadX 13607 896 2048 2048
WriteX 13607 1584 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 400 2048 2048
WriteX 13607 416 2048 2048
WriteX 13607 864 2048 2048
WriteX 13607 872 2048 2048
WriteX 13607 888 2048 2048
WriteX 13607 896 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 584 2048 2048
ReadX 13607 392 2048 2048
WriteX 13607 392 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 1328 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 0 2048 2048
ReadX 13607 408 2048 2048
ReadX 13607 1328 2048 2048
ReadX 13607 864 2048 2048
ReadX 13607 912 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 3840 2048 2048
ReadX 13607 312 2048 2048
ReadX 13607 1584 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 408 2048 2048
WriteX 13607 912 2048 2048
WriteX 13607 1584 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 408 2048 2048
ReadX 13607 392 2048 2048
WriteX 13607 392 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 1000 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 528 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 528 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 552 2048 2048
ReadX 13607 1336 2048 2048
WriteX 13607 552 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 0 2048 2048
ReadX 13607 552 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 2664 2048 2048
ReadX 13607 2648 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 2672 2048 2048
ReadX 13607 2656 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13607 528 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 1336 2048 2048
ReadX 13607 2680 2048 2048
ReadX 13607 2760 8192 8192
ReadX 13607 544 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 568 2048 2048
ReadX 13607 544 2048 2048
ReadX 13607 0 2048 2048
Flush 13607
ReadX 13607 2816 6144 6144
ReadX 13607 2760 2048 2048
ReadX 13607 2744 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 2752 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 528 2048 2048
ReadX 13607 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13611
Close 13611
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13613
WriteX 13613 4065 1 1
QUERY_FILE_INFORMATION 13613
WriteX 13613 0 62591 62591
Close 13613
ReadX 13607 0 2048 2048
ReadX 13607 2808 2048 2048
ReadX 13607 2792 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 2800 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 384 2048 2048
ReadX 13607 392 2048 2048
ReadX 13607 1384 2048 2048
ReadX 13607 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13615
Close 13615
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13617
WriteX 13617 4094 1 1
QUERY_FILE_INFORMATION 13617
WriteX 13617 0 4095 4095
WriteX 13617 0 10845 10845
Close 13617
ReadX 13607 1432 2048 2048
ReadX 13607 1304 2048 2048
ReadX 13607 1368 2048 2048
ReadX 13607 2304 2048 2048
ReadX 13607 1440 2048 2048
ReadX 13607 1424 2048 2048
ReadX 13607 1448 2048 2048
ReadX 13607 1456 2048 2048
ReadX 13607 2432 2048 2048
ReadX 13607 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13619
Close 13619
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13621
ReadX 13607 0 2048 2048
WriteX 13621 4081 1 1
QUERY_FILE_INFORMATION 13621
WriteX 13621 0 30118 30118
Close 13621
ReadX 13607 1344 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1152 2048 2048
ReadX 13607 1152 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 1000 2048 2048
ReadX 13607 768 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 344 2048 2048
WriteX 13607 1000 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 1416 2048 2048
ReadX 13607 1416 2048 2048
ReadX 13607 344 2048 2048
ReadX 13607 896 2048 2048
WriteX 13607 1538 2 2
WriteX 13607 344 2048 2048
WriteX 13607 1416 2048 2048
WriteX 13607 1538 2 2
ReadX 13607 2048 2048 2048
WriteX 13607 2048 2048 2048
WriteX 13607 1538 2 2
Close 13607
Close 13609
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13622
ReadX 13622 0 65471 65471
ReadX 13622 65471 63 63
ReadX 13622 65534 65471 65471
ReadX 13622 131005 63 63
ReadX 13622 131068 65471 65471
ReadX 13622 196539 63 63
ReadX 13622 196602 65471 65471
ReadX 13622 262073 63 63
ReadX 13622 262136 65471 65471
ReadX 13622 327607 63 63
ReadX 13622 327670 10 10
Close 13622
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13623
ReadX 13623 0 65471 65471
ReadX 13623 65471 63 63
ReadX 13623 65534 65471 65471
ReadX 13623 131005 63 63
ReadX 13623 131068 65471 65471
ReadX 13623 196539 63 63
ReadX 13623 196602 65471 65471
ReadX 13623 262073 63 63
ReadX 13623 262136 65471 65471
ReadX 13623 327607 63 63
ReadX 13623 327670 65471 65471
ReadX 13623 393141 63 63
ReadX 13623 393204 65471 65471
ReadX 13623 458675 63 63
ReadX 13623 458738 65471 65471
ReadX 13623 524209 63 63
ReadX 13623 524272 65471 65471
ReadX 13623 589743 63 63
ReadX 13623 589806 65471 65471
ReadX 13623 655277 63 63
ReadX 13623 655340 32 32
Close 13623
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13624
ReadX 13624 0 65471 65471
ReadX 13624 65471 63 63
ReadX 13624 65534 65471 65471
ReadX 13624 131005 63 63
ReadX 13624 131068 65471 65471
ReadX 13624 196539 63 63
ReadX 13624 196602 65471 65471
ReadX 13624 262073 63 63
ReadX 13624 262136 65471 65471
ReadX 13624 327607 63 63
ReadX 13624 327670 65471 65471
ReadX 13624 393141 63 63
ReadX 13624 393204 65471 65471
ReadX 13624 458675 63 63
ReadX 13624 458738 65471 65471
ReadX 13624 524209 63 63
ReadX 13624 524272 65471 65471
ReadX 13624 589743 63 63
ReadX 13624 589806 65471 65471
ReadX 13624 655277 63 63
ReadX 13624 655340 65471 65471
ReadX 13624 720811 63 63
ReadX 13624 720874 65471 65471
ReadX 13624 786345 63 63
ReadX 13624 786408 65471 65471
ReadX 13624 851879 63 63
ReadX 13624 851942 65471 65471
ReadX 13624 917413 63 63
ReadX 13624 917476 65471 65471
ReadX 13624 982947 63 63
ReadX 13624 983010 65471 65471
ReadX 13624 1048481 63 63
ReadX 13624 1048544 65471 65471
ReadX 13624 1114015 63 63
ReadX 13624 1114078 65471 65471
ReadX 13624 1179549 63 63
ReadX 13624 1179612 65471 65471
ReadX 13624 1245083 63 63
ReadX 13624 1245146 65471 65471
ReadX 13624 1310617 63 63
ReadX 13624 1310680 65471 65471
ReadX 13624 1376151 63 63
ReadX 13624 1376214 65471 65471
ReadX 13624 1441685 63 63
ReadX 13624 1441748 65471 65471
ReadX 13624 1507219 63 63
ReadX 13624 1507282 65471 65471
ReadX 13624 1572753 63 63
ReadX 13624 1572816 65471 65471
ReadX 13624 1638287 63 63
ReadX 13624 1638350 65471 65471
ReadX 13624 1703821 63 63
ReadX 13624 1703884 65471 65471
ReadX 13624 1769355 63 63
ReadX 13624 1769418 65471 65471
ReadX 13624 1834889 63 63
ReadX 13624 1834952 32824 32824
Close 13624
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13625
Close 13625
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13626
ReadX 13626 0 24 24
Close 13626
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13627
QUERY_FILE_INFORMATION 13627
ReadX 13627 0 512 512
ReadX 13627 464 512 512
ReadX 13627 498 512 512
ReadX 13627 472 512 512
ReadX 13627 466 512 512
ReadX 13627 978 512 512
ReadX 13627 497 57 57
Close 13627
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13628
QUERY_FILE_INFORMATION 13628
ReadX 13628 0 512 512
ReadX 13628 464 512 512
ReadX 13628 498 512 512
ReadX 13628 472 512 512
ReadX 13628 462 512 512
ReadX 13628 468 512 512
ReadX 13628 466 512 512
QUERY_FILE_INFORMATION 13628
WriteX 13628 482 60 60
WriteX 13628 482 4 4
QUERY_FILE_INFORMATION 13628
WriteX 13628 482 11 11
ReadX 13628 497 57 57
ReadX 13628 497 57 57
ReadX 13628 368 4096 4096
ReadX 13628 460 512 512
ReadX 13628 512 4096 4096
ReadX 13628 4608 4096 4096
ReadX 13628 8704 4096 4096
ReadX 13628 12800 4096 4096
ReadX 13628 16896 4096 4096
ReadX 13628 20992 4096 4096
ReadX 13628 25088 4096 4096
ReadX 13628 29184 4096 4096
ReadX 13628 33280 4096 4096
ReadX 13628 37376 4096 4096
ReadX 13628 41472 4096 4096
ReadX 13628 45568 4096 4096
ReadX 13628 49664 4096 4096
ReadX 13628 53760 4096 4096
ReadX 13628 57856 4096 4096
ReadX 13628 61952 4096 4096
ReadX 13628 66048 4096 4096
ReadX 13628 70144 4096 4096
ReadX 13628 497 20 20
ReadX 13628 496 103 103
ReadX 13628 500 448 448
ReadX 13628 470 512 512
ReadX 13628 486 2692 2692
ReadX 13628 290 4096 4096
ReadX 13628 4386 4096 4096
ReadX 13628 8482 4096 4096
ReadX 13628 500 20 20
ReadX 13628 483 108 108
ReadX 13628 482 292 292
ReadX 13628 338 4096 4096
ReadX 13628 4434 3103 3103
ReadX 13628 384 28 28
ReadX 13628 412 20 20
ReadX 13628 432 8 8
ReadX 13628 440 136 136
ReadX 13628 576 8 8
ReadX 13628 584 4 4
ReadX 13628 588 4 4
ReadX 13628 592 39 39
ReadX 13628 384 4 4
ReadX 13628 388 4 4
ReadX 13628 392 23 23
ReadX 13628 385 4 4
ReadX 13628 389 4 4
ReadX 13628 393 12 12
ReadX 13628 405 4 4
ReadX 13628 409 4 4
ReadX 13628 413 1 1
ReadX 13628 385 4 4
ReadX 13628 389 4 4
ReadX 13628 393 1 1
ReadX 13628 385 4 4
ReadX 13628 389 4 4
ReadX 13628 393 12 12
ReadX 13628 405 4 4
ReadX 13628 409 4 4
ReadX 13628 413 2 2
ReadX 13628 385 4 4
ReadX 13628 389 4 4
ReadX 13628 393 25 25
ReadX 13628 385 4 4
ReadX 13628 389 8 8
ReadX 13628 397 4 4
ReadX 13628 401 8 8
ReadX 13628 409 4 4
ReadX 13628 413 8 8
ReadX 13628 421 4 4
ReadX 13628 425 8 8
ReadX 13628 433 4 4
ReadX 13628 437 4 4
ReadX 13628 441 4 4
ReadX 13628 445 4 4
ReadX 13628 449 4 4
ReadX 13628 453 4 4
ReadX 13628 457 4 4
ReadX 13628 461 4 4
ReadX 13628 465 10670 10670
ReadX 13628 428 4096 4096
WriteX 13628 498 512 512
WriteX 13628 472 512 512
WriteX 13628 462 512 512
WriteX 13628 468 512 512
Close 13628
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13629
Close 13629
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13630
QUERY_FILE_INFORMATION 13630
ReadX 13630 0 512 512
ReadX 13630 464 512 512
ReadX 13630 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13631
Close 13631
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13630
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13633
WriteX 13633 4607 1 1
QUERY_FILE_INFORMATION 13633
WriteX 13633 0 65471 65471
WriteX 13633 65471 65 65
WriteX 13633 65536 19979 19979
Close 13633
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13634
QUERY_FILE_INFORMATION 13634
ReadX 13634 0 512 512
ReadX 13634 462 512 512
ReadX 13634 974 512 512
ReadX 13634 1486 512 512
ReadX 13634 460 512 512
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
WriteX 13634 470 448 448
QUERY_FILE_INFORMATION 13634
WriteX 13634 470 60 60
WriteX 13634 470 4 4
QUERY_FILE_INFORMATION 13634
WriteX 13634 470 11 11
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
WriteX 13634 464 512 512
WriteX 13634 976 512 512
WriteX 13634 1488 512 512
WriteX 13634 462 512 512
WriteX 13634 0 512 512
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
ReadX 13634 470 512 512
WriteX 13634 482 512 512
WriteX 13634 482 292 292
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
WriteX 13634 483 20 20
WriteX 13634 483 108 108
QUERY_FILE_INFORMATION 13634
WriteX 13634 484 448 448
QUERY_FILE_INFORMATION 13634
WriteX 13634 484 44 44
WriteX 13634 484 20 20
WriteX 13634 480 512 512
WriteX 13634 472 512 512
WriteX 13634 476 512 512
WriteX 13634 988 512 512
WriteX 13634 474 512 512
Flush 13634
WriteX 13634 0 512 512
Flush 13634
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
WriteX 13634 480 512 512
WriteX 13634 472 512 512
WriteX 13634 476 512 512
QUERY_FILE_INFORMATION 13634
WriteX 13634 496 320 320
QUERY_FILE_INFORMATION 13634
WriteX 13634 496 60 60
ReadX 13634 484 512 512
WriteX 13634 500 512 512
WriteX 13634 470 512 512
WriteX 13634 486 2692 2692
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
WriteX 13634 497 25 25
WriteX 13634 496 103 103
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
WriteX 13634 497 44 44
WriteX 13634 497 20 20
WriteX 13634 498 512 512
WriteX 13634 462 512 512
WriteX 13634 466 512 512
WriteX 13634 978 512 512
WriteX 13634 464 512 512
Flush 13634
WriteX 13634 0 512 512
Flush 13634
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
QUERY_FILE_INFORMATION 13634
WriteX 13634 497 7 7
WriteX 13634 497 57 57
WriteX 13634 498 512 512
WriteX 13634 472 512 512
WriteX 13634 462 512 512
WriteX 13634 466 512 512
WriteX 13634 978 512 512
Flush 13634
WriteX 13634 498 512 512
Flush 13634
Close 13634
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13635
QUERY_FILE_INFORMATION 13635
ReadX 13635 0 512 512
ReadX 13635 464 512 512
ReadX 13635 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13636
ReadX 13636 0 20 20
ReadX 13636 14 40 40
ReadX 13636 54 64 64
ReadX 13636 118 1152 1152
Close 13636
Close 13635
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13637
Close 13637
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13638
ReadX 13638 0 24 24
Close 13638
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13639
QUERY_FILE_INFORMATION 13639
ReadX 13639 0 512 512
ReadX 13639 464 512 512
ReadX 13639 498 512 512
ReadX 13639 472 512 512
ReadX 13639 462 512 512
ReadX 13639 466 512 512
ReadX 13639 978 512 512
ReadX 13639 497 57 57
Close 13639
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13640
QUERY_FILE_INFORMATION 13640
ReadX 13640 0 512 512
ReadX 13640 464 512 512
ReadX 13640 498 512 512
ReadX 13640 472 512 512
ReadX 13640 468 512 512
ReadX 13640 462 512 512
ReadX 13640 466 512 512
QUERY_FILE_INFORMATION 13640
WriteX 13640 482 60 60
WriteX 13640 482 4 4
QUERY_FILE_INFORMATION 13640
WriteX 13640 482 11 11
WriteX 13640 498 512 512
WriteX 13640 472 512 512
WriteX 13640 462 512 512
WriteX 13640 466 512 512
WriteX 13640 978 512 512
Close 13640
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13641
Close 13641
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13642
Close 13642
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13644
WriteX 13644 4607 1 1
QUERY_FILE_INFORMATION 13644
WriteX 13644 0 65471 65471
WriteX 13644 65471 65 65
WriteX 13644 65536 17654 17654
Close 13644
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13645
QUERY_FILE_INFORMATION 13645
ReadX 13645 0 512 512
ReadX 13645 474 512 512
ReadX 13645 986 512 512
ReadX 13645 1498 512 512
ReadX 13645 472 512 512
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 482 448 448
QUERY_FILE_INFORMATION 13645
WriteX 13645 482 60 60
WriteX 13645 482 4 4
QUERY_FILE_INFORMATION 13645
WriteX 13645 482 11 11
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 476 512 512
WriteX 13645 988 512 512
WriteX 13645 1500 512 512
WriteX 13645 474 512 512
WriteX 13645 0 512 512
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
ReadX 13645 482 512 512
WriteX 13645 494 512 512
WriteX 13645 494 292 292
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 495 20 20
WriteX 13645 495 108 108
QUERY_FILE_INFORMATION 13645
WriteX 13645 496 448 448
QUERY_FILE_INFORMATION 13645
WriteX 13645 496 44 44
WriteX 13645 496 20 20
WriteX 13645 492 512 512
WriteX 13645 484 512 512
WriteX 13645 488 512 512
WriteX 13645 1000 512 512
WriteX 13645 486 512 512
Flush 13645
WriteX 13645 0 512 512
Flush 13645
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 492 512 512
WriteX 13645 484 512 512
WriteX 13645 488 512 512
QUERY_FILE_INFORMATION 13645
WriteX 13645 508 320 320
QUERY_FILE_INFORMATION 13645
WriteX 13645 508 60 60
ReadX 13645 496 512 512
WriteX 13645 512 512 512
WriteX 13645 482 512 512
WriteX 13645 498 2692 2692
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 509 25 25
WriteX 13645 508 103 103
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 509 44 44
WriteX 13645 509 20 20
WriteX 13645 510 512 512
WriteX 13645 474 512 512
WriteX 13645 478 512 512
WriteX 13645 990 512 512
WriteX 13645 476 512 512
Flush 13645
WriteX 13645 0 512 512
Flush 13645
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
QUERY_FILE_INFORMATION 13645
WriteX 13645 509 7 7
WriteX 13645 509 57 57
WriteX 13645 510 512 512
WriteX 13645 484 512 512
WriteX 13645 474 512 512
WriteX 13645 478 512 512
WriteX 13645 990 512 512
Flush 13645
WriteX 13645 510 512 512
Flush 13645
Close 13645
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13646
Close 13646
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13647
QUERY_FILE_INFORMATION 13647
ReadX 13647 0 512 512
ReadX 13647 476 512 512
ReadX 13647 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13648
Close 13648
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13649
QUERY_FILE_INFORMATION 13649
ReadX 13649 0 512 512
ReadX 13649 512 512 512
ReadX 13649 770 512 512
ReadX 13649 1282 512 512
ReadX 13649 1794 512 512
ReadX 13649 2562 512 512
ReadX 13649 3586 512 512
ReadX 13649 3828 512 512
ReadX 13649 288 512 512
ReadX 13649 1024 512 512
ReadX 13649 954 512 512
ReadX 13649 295 512 512
ReadX 13649 320 512 512
ReadX 13649 322 512 512
ReadX 13649 834 512 512
ReadX 13649 1346 512 512
ReadX 13649 1858 512 512
ReadX 13649 323 512 512
ReadX 13649 835 512 512
ReadX 13649 1347 512 512
ReadX 13649 1859 512 512
ReadX 13649 2371 345 345
ReadX 13649 322 167 167
ReadX 13649 489 512 512
ReadX 13649 1001 512 512
ReadX 13649 1513 512 512
ReadX 13649 2025 512 512
ReadX 13649 2537 512 512
ReadX 13649 3049 512 512
ReadX 13649 3561 345 345
ReadX 13649 323 167 167
ReadX 13649 490 512 512
ReadX 13649 1002 512 512
ReadX 13649 1514 512 512
ReadX 13649 2026 512 512
ReadX 13649 2538 512 512
ReadX 13649 3050 512 512
ReadX 13649 3562 512 512
ReadX 13649 4074 512 512
ReadX 13649 4586 512 512
ReadX 13649 5098 512 512
ReadX 13649 5610 512 512
ReadX 13649 6122 512 512
ReadX 13649 6634 512 512
ReadX 13649 7146 512 512
ReadX 13649 7658 512 512
ReadX 13649 8170 512 512
ReadX 13649 8682 512 512
ReadX 13649 9194 512 512
ReadX 13649 9706 512 512
ReadX 13649 10218 512 512
ReadX 13649 10730 345 345
ReadX 13649 11075 512 512
ReadX 13649 11587 167 167
ReadX 13649 11754 512 512
ReadX 13649 12266 512 512
ReadX 13649 12778 512 512
ReadX 13649 13290 512 512
ReadX 13649 13802 512 512
ReadX 13649 14314 512 512
ReadX 13649 14826 512 512
ReadX 13649 15338 512 512
ReadX 13649 337 512 512
ReadX 13649 337 512 512
ReadX 13649 849 34 34
ReadX 13649 352 512 512
ReadX 13649 864 512 512
ReadX 13649 1376 512 512
ReadX 13649 1888 512 512
ReadX 13649 2400 512 512
ReadX 13649 2912 512 512
ReadX 13649 3424 512 512
ReadX 13649 3936 512 512
ReadX 13649 1632 512 512
ReadX 13649 2144 512 512
ReadX 13649 1682 512 512
ReadX 13649 258 512 512
ReadX 13649 360 144 144
ReadX 13649 2517 512 512
ReadX 13649 3029 512 512
ReadX 13649 1751 512 512
ReadX 13649 2263 512 512
ReadX 13649 2775 512 512
ReadX 13649 3287 512 512
ReadX 13649 3799 512 512
ReadX 13649 4311 512 512
ReadX 13649 4823 512 512
ReadX 13649 5335 512 512
ReadX 13649 5847 512 512
ReadX 13649 6359 512 512
ReadX 13649 6871 512 512
ReadX 13649 7383 512 512
ReadX 13649 7895 512 512
ReadX 13649 8407 512 512
ReadX 13649 8919 512 512
ReadX 13649 9431 512 512
ReadX 13649 9943 512 512
ReadX 13649 10455 512 512
ReadX 13649 10967 512 512
ReadX 13649 11479 512 512
ReadX 13649 2556 512 512
ReadX 13649 3068 512 512
ReadX 13649 3580 512 512
ReadX 13649 4092 512 512
ReadX 13649 4604 512 512
ReadX 13649 5116 512 512
ReadX 13649 5628 512 512
ReadX 13649 6140 512 512
ReadX 13649 6652 512 512
ReadX 13649 7164 512 512
ReadX 13649 7676 512 512
ReadX 13649 8188 512 512
ReadX 13649 8700 512 512
ReadX 13649 9212 512 512
ReadX 13649 9724 512 512
ReadX 13649 10236 512 512
ReadX 13649 10748 512 512
ReadX 13649 11260 512 512
ReadX 13649 11772 512 512
ReadX 13649 12284 512 512
ReadX 13649 12796 49 49
ReadX 13649 260 463 463
ReadX 13649 723 512 512
ReadX 13649 1235 512 512
ReadX 13649 1747 512 512
ReadX 13649 2259 512 512
ReadX 13649 2771 512 512
ReadX 13649 3283 512 512
ReadX 13649 3795 512 512
ReadX 13649 4307 512 512
ReadX 13649 4819 512 512
ReadX 13649 5331 512 512
ReadX 13649 5843 512 512
ReadX 13649 6355 512 512
ReadX 13649 6867 512 512
ReadX 13649 7379 512 512
ReadX 13649 7891 512 512
ReadX 13649 8403 512 512
ReadX 13649 8915 512 512
ReadX 13649 9427 512 512
ReadX 13649 9939 512 512
ReadX 13649 10451 512 512
ReadX 13649 10963 402 402
ReadX 13649 593 240 240
ReadX 13649 2048 272 272
ReadX 13649 2320 512 512
ReadX 13649 2832 512 512
ReadX 13649 3344 512 512
ReadX 13649 3856 512 512
ReadX 13649 4368 512 512
ReadX 13649 4880 512 512
ReadX 13649 5392 240 240
ReadX 13649 608 272 272
ReadX 13649 880 512 512
ReadX 13649 1392 512 512
ReadX 13649 1904 512 512
ReadX 13649 2416 512 512
ReadX 13649 2928 512 512
ReadX 13649 3440 512 512
ReadX 13649 3952 512 512
ReadX 13649 4464 512 512
ReadX 13649 4976 512 512
ReadX 13649 5488 512 512
ReadX 13649 6000 512 512
ReadX 13649 6512 512 512
ReadX 13649 7024 512 512
ReadX 13649 7536 512 512
ReadX 13649 8048 512 512
ReadX 13649 8560 512 512
ReadX 13649 9072 512 512
ReadX 13649 9584 512 512
ReadX 13649 10096 512 512
ReadX 13649 1683 512 512
ReadX 13649 514 512 512
ReadX 13649 620 512 512
ReadX 13649 770 512 512
ReadX 13649 1282 512 512
ReadX 13649 1794 512 512
ReadX 13649 2000 512 512
ReadX 13649 1434 512 512
ReadX 13649 2050 512 512
ReadX 13649 2118 512 512
ReadX 13649 1715 512 512
ReadX 13649 1024 512 512
ReadX 13649 954 512 512
ReadX 13649 1880 512 512
ReadX 13649 1286 512 512
ReadX 13649 1510 512 512
ReadX 13649 2562 512 512
ReadX 13649 2610 512 512
ReadX 13649 3586 512 512
ReadX 13649 3812 512 512
ReadX 13649 3828 512 512
ReadX 13649 4046 512 512
ReadX 13649 4066 512 512
ReadX 13649 1747 512 512
ReadX 13649 1026 512 512
ReadX 13649 1538 512 512
ReadX 13649 514 512 512
ReadX 13649 751 512 512
ReadX 13649 1263 512 512
ReadX 13649 620 512 512
ReadX 13649 1132 512 512
ReadX 13649 1644 512 512
ReadX 13649 2156 512 512
ReadX 13649 2668 512 512
ReadX 13649 3180 512 512
ReadX 13649 3692 512 512
ReadX 13649 4204 394 394
ReadX 13649 606 118 118
ReadX 13649 724 512 512
ReadX 13649 1236 512 512
ReadX 13649 1748 512 512
ReadX 13649 2260 512 512
ReadX 13649 2772 512 512
ReadX 13649 3284 512 512
ReadX 13649 3796 394 394
ReadX 13649 636 118 118
ReadX 13649 754 512 512
ReadX 13649 1266 512 512
ReadX 13649 1778 512 512
ReadX 13649 2290 512 512
ReadX 13649 2802 512 512
ReadX 13649 3314 512 512
ReadX 13649 3826 512 512
ReadX 13649 4338 512 512
ReadX 13649 4850 512 512
ReadX 13649 5362 512 512
ReadX 13649 5874 512 512
ReadX 13649 6386 512 512
ReadX 13649 6898 512 512
ReadX 13649 7410 512 512
ReadX 13649 7922 512 512
ReadX 13649 8434 512 512
ReadX 13649 8946 512 512
ReadX 13649 9458 512 512
ReadX 13649 9970 512 512
ReadX 13649 10482 512 512
ReadX 13649 723 512 512
ReadX 13649 1235 512 512
ReadX 13649 725 512 512
ReadX 13649 729 512 512
ReadX 13649 1241 512 512
ReadX 13649 1753 512 512
ReadX 13649 2265 512 512
ReadX 13649 2777 512 512
ReadX 13649 3289 512 512
ReadX 13649 3801 512 512
ReadX 13649 4313 512 512
ReadX 13649 4825 512 512
ReadX 13649 5337 512 512
ReadX 13649 5849 512 512
ReadX 13649 6361 512 512
ReadX 13649 755 512 512
ReadX 13649 1267 512 512
ReadX 13649 1779 512 512
ReadX 13649 2291 512 512
ReadX 13649 2803 512 512
ReadX 13649 3315 512 512
ReadX 13649 3827 512 512
ReadX 13649 4339 244 244
ReadX 13649 4583 512 512
ReadX 13649 5095 268 268
ReadX 13649 5363 512 512
ReadX 13649 5875 512 512
ReadX 13649 6387 512 512
ReadX 13649 6899 512 512
ReadX 13649 7411 512 512
ReadX 13649 7923 512 512
ReadX 13649 8435 512 512
ReadX 13649 8947 512 512
ReadX 13649 9459 512 512
ReadX 13649 9971 512 512
ReadX 13649 10483 512 512
ReadX 13649 10995 512 512
ReadX 13649 11507 512 512
ReadX 13649 12019 512 512
ReadX 13649 12531 512 512
ReadX 13649 13043 512 512
ReadX 13649 13555 512 512
ReadX 13649 14067 512 512
ReadX 13649 14579 512 512
ReadX 13649 15091 512 512
ReadX 13649 15603 342 342
ReadX 13649 725 512 512
ReadX 13649 2000 512 512
ReadX 13649 3918 512 512
ReadX 13649 727 512 512
ReadX 13649 258 512 512
ReadX 13649 376 512 512
ReadX 13649 1109 512 512
ReadX 13649 1028 512 512
ReadX 13649 1540 512 512
ReadX 13649 2052 512 512
ReadX 13649 2564 512 512
ReadX 13649 3076 512 512
ReadX 13649 3588 512 512
ReadX 13649 4100 512 512
ReadX 13649 4612 412 412
ReadX 13649 1012 100 100
ReadX 13649 1112 512 512
ReadX 13649 1624 512 512
ReadX 13649 2136 512 512
ReadX 13649 2648 512 512
ReadX 13649 3160 512 512
ReadX 13649 3672 512 512
ReadX 13649 4184 412 412
ReadX 13649 1044 100 100
ReadX 13649 1144 512 512
ReadX 13649 1656 512 512
ReadX 13649 2168 512 512
ReadX 13649 2680 512 512
ReadX 13649 3192 512 512
ReadX 13649 3704 512 512
ReadX 13649 4216 512 512
ReadX 13649 4728 512 512
ReadX 13649 5240 512 512
ReadX 13649 5752 512 512
ReadX 13649 6264 512 512
ReadX 13649 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 13649 7288 512 512
ReadX 13649 7800 512 512
ReadX 13649 8312 512 512
ReadX 13649 8824 512 512
ReadX 13649 9336 512 512
ReadX 13649 9848 512 512
ReadX 13649 10360 512 512
ReadX 13649 10872 512 512
ReadX 13649 11384 512 512
ReadX 13649 11896 512 512
ReadX 13649 12408 512 512
ReadX 13649 1088 512 512
ReadX 13649 1600 512 512
ReadX 13649 1090 512 512
ReadX 13649 1094 512 512
ReadX 13649 1606 512 512
ReadX 13649 2118 512 512
ReadX 13649 2630 512 512
ReadX 13649 3142 512 512
ReadX 13649 3654 512 512
ReadX 13649 4166 512 512
ReadX 13649 4678 512 512
ReadX 13649 1111 512 512
ReadX 13649 1623 512 512
ReadX 13649 2135 512 512
ReadX 13649 2647 512 512
ReadX 13649 3159 512 512
ReadX 13649 3671 512 512
ReadX 13649 4183 512 512
ReadX 13649 4695 512 512
ReadX 13649 5207 512 512
ReadX 13649 5719 512 512
ReadX 13649 6231 512 512
ReadX 13649 6743 512 512
ReadX 13649 7255 512 512
ReadX 13649 7767 512 512
ReadX 13649 8279 512 512
ReadX 13649 8791 512 512
ReadX 13649 9303 512 512
ReadX 13649 9815 512 512
ReadX 13649 10327 512 512
ReadX 13649 10839 512 512
ReadX 13649 11351 294 294
ReadX 13649 1091 512 512
ReadX 13649 970 512 512
ReadX 13649 1093 512 512
ReadX 13649 1434 512 512
ReadX 13649 2050 512 512
ReadX 13649 2158 512 512
ReadX 13649 2118 512 512
ReadX 13649 2630 512 512
ReadX 13649 3142 512 512
ReadX 13649 3654 512 512
ReadX 13649 4166 512 512
ReadX 13649 4678 512 512
ReadX 13649 5190 512 512
ReadX 13649 5702 382 382
ReadX 13649 2104 130 130
ReadX 13649 2234 512 512
ReadX 13649 2746 512 512
ReadX 13649 3258 512 512
ReadX 13649 3770 512 512
ReadX 13649 4282 512 512
ReadX 13649 4794 512 512
ReadX 13649 5306 382 382
ReadX 13649 2134 130 130
ReadX 13649 2264 512 512
ReadX 13649 2776 512 512
ReadX 13649 3288 512 512
ReadX 13649 3800 512 512
ReadX 13649 4312 512 512
ReadX 13649 4824 512 512
ReadX 13649 5336 512 512
ReadX 13649 2147 512 512
ReadX 13649 2149 512 512
ReadX 13649 2152 512 512
ReadX 13649 2664 512 512
ReadX 13649 3176 512 512
ReadX 13649 3688 512 512
ReadX 13649 2159 512 512
ReadX 13649 2671 512 512
ReadX 13649 3183 512 512
ReadX 13649 3695 512 512
ReadX 13649 4207 512 512
ReadX 13649 4719 512 512
ReadX 13649 5231 512 512
ReadX 13649 5743 512 512
ReadX 13649 6255 512 512
ReadX 13649 6767 512 512
ReadX 13649 7279 512 512
ReadX 13649 7791 512 512
ReadX 13649 8303 512 512
ReadX 13649 8815 512 512
ReadX 13649 9327 512 512
ReadX 13649 9839 512 512
ReadX 13649 10351 512 512
ReadX 13649 10863 512 512
ReadX 13649 11375 512 512
ReadX 13649 11887 512 512
ReadX 13649 12399 38 38
ReadX 13649 2149 512 512
ReadX 13649 1794 512 512
ReadX 13649 2016 512 512
ReadX 13649 2151 512 512
ReadX 13649 1918 512 512
ReadX 13649 1880 512 512
ReadX 13649 2392 512 512
ReadX 13649 2904 512 512
ReadX 13649 3416 512 512
ReadX 13649 3928 512 512
ReadX 13649 4440 512 512
ReadX 13649 4952 512 512
ReadX 13649 5464 416 416
ReadX 13649 1866 96 96
ReadX 13649 1962 512 512
ReadX 13649 2474 512 512
ReadX 13649 2986 512 512
ReadX 13649 3498 512 512
ReadX 13649 4010 512 512
ReadX 13649 4522 512 512
ReadX 13649 5034 416 416
ReadX 13649 1896 96 96
ReadX 13649 1992 512 512
ReadX 13649 2504 512 512
ReadX 13649 3016 512 512
ReadX 13649 3528 512 512
ReadX 13649 1903 512 512
ReadX 13649 1905 512 512
ReadX 13649 1908 512 512
ReadX 13649 2420 512 512
ReadX 13649 2932 512 512
ReadX 13649 3444 512 512
ReadX 13649 3956 512 512
ReadX 13649 1919 512 512
ReadX 13649 2431 512 512
ReadX 13649 2943 512 512
ReadX 13649 3455 512 512
ReadX 13649 3967 512 512
ReadX 13649 4479 512 512
ReadX 13649 4991 512 512
ReadX 13649 5503 512 512
ReadX 13649 6015 512 512
ReadX 13649 6527 512 512
ReadX 13649 7039 512 512
ReadX 13649 7551 512 512
ReadX 13649 8063 512 512
ReadX 13649 8575 512 512
ReadX 13649 9087 512 512
ReadX 13649 9599 512 512
ReadX 13649 10111 512 512
ReadX 13649 10623 512 512
ReadX 13649 11135 512 512
ReadX 13649 11647 512 512
ReadX 13649 12159 322 322
ReadX 13649 1905 512 512
ReadX 13649 1846 512 512
ReadX 13649 1907 512 512
ReadX 13649 1860 268 268
ReadX 13649 1832 244 244
ReadX 13649 1846 512 512
ReadX 13649 2358 512 512
ReadX 13649 2870 512 512
ReadX 13649 3382 512 512
ReadX 13649 3894 512 512
ReadX 13649 4406 512 512
ReadX 13649 4918 512 512
ReadX 13649 1858 512 512
ReadX 13649 1859 512 512
ReadX 13649 1860 488 488
ReadX 13649 1832 24 24
ReadX 13649 1861 228 228
ReadX 13649 1832 284 284
ReadX 13649 2116 512 512
ReadX 13649 2628 512 512
ReadX 13649 3140 512 512
ReadX 13649 3652 512 512
ReadX 13649 4164 512 512
ReadX 13649 4676 512 512
ReadX 13649 5188 228 228
ReadX 13649 1862 284 284
ReadX 13649 2146 512 512
ReadX 13649 2658 38 38
ReadX 13649 1859 512 512
ReadX 13649 2047 512 512
ReadX 13649 2016 512 512
ReadX 13649 2528 512 512
ReadX 13649 3040 512 512
ReadX 13649 3552 512 512
ReadX 13649 4064 512 512
ReadX 13649 4576 512 512
ReadX 13649 5088 512 512
ReadX 13649 5600 424 424
ReadX 13649 2002 88 88
ReadX 13649 2090 512 512
ReadX 13649 2602 512 512
ReadX 13649 3114 512 512
ReadX 13649 3626 512 512
ReadX 13649 4138 512 512
ReadX 13649 4650 512 512
ReadX 13649 5162 424 424
ReadX 13649 2032 88 88
ReadX 13649 2120 512 512
ReadX 13649 2632 512 512
ReadX 13649 3144 512 512
ReadX 13649 3656 512 512
ReadX 13649 4168 512 512
ReadX 13649 4680 512 512
ReadX 13649 5192 512 512
ReadX 13649 2044 512 512
ReadX 13649 2045 512 512
ReadX 13649 2046 512 512
ReadX 13649 2047 512 512
ReadX 13649 2559 110 110
ReadX 13649 2052 402 402
ReadX 13649 2454 512 512
ReadX 13649 2966 512 512
ReadX 13649 3478 512 512
ReadX 13649 3990 512 512
ReadX 13649 4502 512 512
ReadX 13649 5014 512 512
ReadX 13649 5526 512 512
ReadX 13649 6038 512 512
ReadX 13649 6550 512 512
ReadX 13649 7062 512 512
ReadX 13649 7574 512 512
ReadX 13649 8086 512 512
ReadX 13649 8598 512 512
ReadX 13649 9110 512 512
ReadX 13649 9622 512 512
ReadX 13649 10134 512 512
ReadX 13649 10646 512 512
ReadX 13649 11158 512 512
ReadX 13649 11670 512 512
ReadX 13649 12182 512 512
ReadX 13649 12694 118 118
ReadX 13649 2045 512 512
ReadX 13649 1282 512 512
ReadX 13649 1343 512 512
ReadX 13649 1286 512 512
ReadX 13649 1798 512 512
ReadX 13649 2310 512 512
ReadX 13649 2822 512 512
ReadX 13649 3334 512 512
ReadX 13649 3846 512 512
ReadX 13649 4358 512 512
ReadX 13649 4870 416 416
ReadX 13649 1270 96 96
ReadX 13649 1366 512 512
ReadX 13649 1878 512 512
ReadX 13649 2390 512 512
ReadX 13649 2902 512 512
ReadX 13649 3414 512 512
ReadX 13649 3926 416 416
ReadX 13649 1284 96 96
ReadX 13649 1380 416 416
ReadX 13649 1302 96 96
ReadX 13649 1398 512 512
ReadX 13649 1910 512 512
ReadX 13649 2422 512 512
ReadX 13649 2934 512 512
ReadX 13649 3446 512 512
ReadX 13649 3958 512 512
ReadX 13649 4470 512 512
ReadX 13649 4982 512 512
ReadX 13649 5494 512 512
ReadX 13649 6006 512 512
ReadX 13649 6518 512 512
ReadX 13649 7030 512 512
ReadX 13649 7542 512 512
ReadX 13649 1328 512 512
ReadX 13649 1330 512 512
ReadX 13649 1333 512 512
ReadX 13649 1845 512 512
ReadX 13649 2357 512 512
ReadX 13649 2869 512 512
ReadX 13649 3381 512 512
ReadX 13649 1344 512 512
ReadX 13649 1856 512 512
ReadX 13649 2368 512 512
ReadX 13649 2880 512 512
ReadX 13649 3392 512 512
ReadX 13649 3904 512 512
ReadX 13649 4416 512 512
ReadX 13649 4928 512 512
ReadX 13649 5440 512 512
ReadX 13649 5952 512 512
ReadX 13649 6464 512 512
ReadX 13649 6976 512 512
ReadX 13649 7488 512 512
ReadX 13649 8000 512 512
ReadX 13649 8512 512 512
ReadX 13649 9024 512 512
ReadX 13649 9536 512 512
ReadX 13649 10048 512 512
ReadX 13649 10560 512 512
ReadX 13649 11072 512 512
ReadX 13649 11584 426 426
ReadX 13649 1330 512 512
ReadX 13649 1842 512 512
ReadX 13649 1250 512 512
ReadX 13649 1264 268 268
ReadX 13649 1236 244 244
ReadX 13649 1250 512 512
ReadX 13649 1762 512 512
ReadX 13649 2274 512 512
ReadX 13649 2786 512 512
ReadX 13649 3298 512 512
ReadX 13649 3810 512 512
ReadX 13649 4322 512 512
ReadX 13649 1262 512 512
ReadX 13649 1263 512 512
ReadX 13649 1264 488 488
ReadX 13649 1236 24 24
ReadX 13649 1265 228 228
ReadX 13649 1236 284 284
ReadX 13649 1520 512 512
ReadX 13649 2032 512 512
ReadX 13649 2544 512 512
ReadX 13649 3056 512 512
ReadX 13649 3568 512 512
ReadX 13649 4080 512 512
ReadX 13649 4592 228 228
ReadX 13649 1266 284 284
ReadX 13649 1550 512 512
ReadX 13649 2062 42 42
ReadX 13649 1263 512 512
ReadX 13649 1538 512 512
ReadX 13649 1640 512 512
ReadX 13649 1510 512 512
ReadX 13649 2022 512 512
ReadX 13649 2534 512 512
ReadX 13649 3046 512 512
ReadX 13649 3558 512 512
ReadX 13649 4070 512 512
ReadX 13649 4582 512 512
ReadX 13649 5094 408 408
ReadX 13649 1496 104 104
ReadX 13649 1600 512 512
ReadX 13649 2112 512 512
ReadX 13649 2624 512 512
ReadX 13649 3136 512 512
ReadX 13649 3648 512 512
ReadX 13649 4160 512 512
ReadX 13649 4672 408 408
ReadX 13649 1526 104 104
ReadX 13649 1630 512 512
ReadX 13649 2142 512 512
ReadX 13649 2654 512 512
ReadX 13649 3166 512 512
ReadX 13649 3678 512 512
ReadX 13649 4190 408 408
ReadX 13649 1540 104 104
ReadX 13649 1644 512 512
ReadX 13649 2156 512 512
ReadX 13649 2668 512 512
ReadX 13649 3180 512 512
ReadX 13649 3692 512 512
ReadX 13649 4204 512 512
ReadX 13649 4716 512 512
ReadX 13649 5228 512 512
ReadX 13649 5740 512 512
ReadX 13649 6252 512 512
ReadX 13649 6764 512 512
ReadX 13649 7276 512 512
ReadX 13649 7788 512 512
ReadX 13649 8300 512 512
ReadX 13649 8812 512 512
ReadX 13649 9324 512 512
ReadX 13649 9836 512 512
ReadX 13649 10348 512 512
ReadX 13649 10860 512 512
ReadX 13649 11372 512 512
ReadX 13649 1615 512 512
ReadX 13649 2127 512 512
ReadX 13649 1617 512 512
ReadX 13649 1621 512 512
ReadX 13649 2133 512 512
ReadX 13649 2645 512 512
ReadX 13649 3157 512 512
ReadX 13649 3669 512 512
ReadX 13649 4181 512 512
ReadX 13649 4693 512 512
ReadX 13649 5205 512 512
ReadX 13649 5717 512 512
ReadX 13649 6229 512 512
ReadX 13649 1641 512 512
ReadX 13649 2153 512 512
ReadX 13649 2665 512 512
ReadX 13649 3177 512 512
ReadX 13649 3689 512 512
ReadX 13649 4201 512 512
ReadX 13649 4713 512 512
ReadX 13649 5225 512 512
ReadX 13649 5737 512 512
ReadX 13649 6249 512 512
ReadX 13649 6761 512 512
ReadX 13649 7273 512 512
ReadX 13649 7785 512 512
ReadX 13649 8297 512 512
ReadX 13649 8809 512 512
ReadX 13649 9321 512 512
ReadX 13649 9833 512 512
ReadX 13649 10345 512 512
ReadX 13649 10857 512 512
ReadX 13649 11369 512 512
ReadX 13649 11881 2 2
ReadX 13649 1796 510 510
ReadX 13649 2306 512 512
ReadX 13649 2818 512 512
ReadX 13649 3330 512 512
ReadX 13649 3842 512 512
ReadX 13649 4354 512 512
ReadX 13649 4866 512 512
ReadX 13649 5378 512 512
ReadX 13649 5890 512 512
ReadX 13649 6402 512 512
ReadX 13649 6914 512 512
ReadX 13649 7426 512 512
ReadX 13649 7938 512 512
ReadX 13649 8450 512 512
ReadX 13649 8962 512 512
ReadX 13649 9474 512 512
ReadX 13649 9986 512 512
ReadX 13649 10498 326 326
ReadX 13649 1617 512 512
ReadX 13649 2129 512 512
ReadX 13649 1450 512 512
ReadX 13649 1621 512 512
ReadX 13649 1446 512 512
ReadX 13649 1450 512 512
ReadX 13649 1962 512 512
ReadX 13649 2474 512 512
ReadX 13649 2986 512 512
ReadX 13649 3498 512 512
ReadX 13649 4010 512 512
ReadX 13649 4522 512 512
ReadX 13649 5034 424 424
ReadX 13649 1436 88 88
ReadX 13649 1524 512 512
ReadX 13649 2036 512 512
ReadX 13649 2548 512 512
ReadX 13649 3060 512 512
ReadX 13649 1442 512 512
ReadX 13649 1443 512 512
ReadX 13649 1444 512 512
ReadX 13649 1446 512 512
ReadX 13649 1958 386 386
ReadX 13649 1466 126 126
ReadX 13649 1592 512 512
ReadX 13649 2104 512 512
ReadX 13649 2616 512 512
ReadX 13649 3128 512 512
ReadX 13649 3640 512 512
ReadX 13649 4152 512 512
ReadX 13649 4664 512 512
ReadX 13649 5176 512 512
ReadX 13649 5688 512 512
ReadX 13649 6200 512 512
ReadX 13649 6712 512 512
ReadX 13649 7224 512 512
ReadX 13649 7736 512 512
ReadX 13649 8248 512 512
ReadX 13649 8760 294 294
ReadX 13649 1443 512 512
ReadX 13649 964 512 512
ReadX 13649 970 512 512
ReadX 13649 1482 512 512
ReadX 13649 1994 512 512
ReadX 13649 2506 512 512
ReadX 13649 3018 512 512
ReadX 13649 3530 512 512
ReadX 13649 4042 512 512
ReadX 13649 4554 424 424
ReadX 13649 956 88 88
ReadX 13649 1044 512 512
ReadX 13649 1556 512 512
ReadX 13649 2068 512 512
ReadX 13649 2580 512 512
ReadX 13649 962 512 512
ReadX 13649 963 512 512
ReadX 13649 964 512 512
ReadX 13649 965 512 512
ReadX 13649 1477 512 512
ReadX 13649 1989 228 228
ReadX 13649 986 284 284
ReadX 13649 1270 512 512
ReadX 13649 1782 512 512
ReadX 13649 2294 512 512
ReadX 13649 2806 512 512
ReadX 13649 3318 512 512
ReadX 13649 3830 512 512
ReadX 13649 4342 512 512
ReadX 13649 4854 512 512
ReadX 13649 5366 512 512
ReadX 13649 5878 512 512
ReadX 13649 6390 512 512
ReadX 13649 6902 512 512
ReadX 13649 7414 42 42
ReadX 13649 963 512 512
ReadX 13649 2610 512 512
ReadX 13649 3812 512 512
ReadX 13649 3828 512 512
ReadX 13649 3969 512 512
ReadX 13649 3918 512 512
ReadX 13649 4430 512 512
ReadX 13649 4942 512 512
ReadX 13649 5454 512 512
ReadX 13649 5966 512 512
ReadX 13649 6478 512 512
ReadX 13649 6990 512 512
ReadX 13649 7502 424 424
ReadX 13649 3904 88 88
ReadX 13649 3992 512 512
ReadX 13649 4504 512 512
ReadX 13649 5016 512 512
ReadX 13649 5528 512 512
ReadX 13649 6040 512 512
ReadX 13649 6552 512 512
ReadX 13649 7064 424 424
ReadX 13649 3934 88 88
ReadX 13649 4022 512 512
ReadX 13649 4534 512 512
ReadX 13649 5046 512 512
ReadX 13649 5558 512 512
ReadX 13649 6070 512 512
ReadX 13649 6582 512 512
ReadX 13649 7094 512 512
ReadX 13649 7606 512 512
ReadX 13649 8118 512 512
ReadX 13649 8630 512 512
ReadX 13649 3953 512 512
ReadX 13649 4465 512 512
ReadX 13649 3956 512 512
ReadX 13649 3964 512 512
ReadX 13649 4476 512 512
ReadX 13649 4988 512 512
ReadX 13649 3970 512 512
ReadX 13649 4482 512 512
ReadX 13649 4994 512 512
ReadX 13649 5506 512 512
ReadX 13649 6018 512 512
ReadX 13649 6530 512 512
ReadX 13649 7042 512 512
ReadX 13649 7554 512 512
ReadX 13649 8066 512 512
ReadX 13649 8578 512 512
ReadX 13649 9090 512 512
ReadX 13649 9602 512 512
ReadX 13649 10114 512 512
ReadX 13649 10626 512 512
ReadX 13649 11138 512 512
ReadX 13649 11650 512 512
ReadX 13649 12162 512 512
ReadX 13649 12674 512 512
ReadX 13649 13186 512 512
ReadX 13649 13698 512 512
ReadX 13649 14210 134 134
ReadX 13649 3956 512 512
ReadX 13649 4468 512 512
ReadX 13649 4980 512 512
ReadX 13649 5492 512 512
ReadX 13649 3074 512 512
ReadX 13649 3246 512 512
ReadX 13649 3964 512 512
ReadX 13649 3330 512 512
ReadX 13649 3465 512 512
ReadX 13649 3246 512 512
ReadX 13649 3758 512 512
ReadX 13649 4270 512 512
ReadX 13649 4782 512 512
ReadX 13649 5294 512 512
ReadX 13649 5806 512 512
ReadX 13649 6318 512 512
ReadX 13649 6830 368 368
ReadX 13649 3232 144 144
ReadX 13649 3376 512 512
ReadX 13649 3888 512 512
ReadX 13649 4400 512 512
ReadX 13649 4912 512 512
ReadX 13649 5424 512 512
ReadX 13649 5936 512 512
ReadX 13649 6448 368 368
ReadX 13649 3262 144 144
ReadX 13649 3406 512 512
ReadX 13649 3918 512 512
ReadX 13649 4430 512 512
ReadX 13649 4942 512 512
ReadX 13649 5454 512 512
ReadX 13649 5966 512 512
ReadX 13649 6478 512 512
ReadX 13649 6990 512 512
ReadX 13649 7502 512 512
ReadX 13649 8014 512 512
ReadX 13649 8526 512 512
ReadX 13649 9038 512 512
ReadX 13649 9550 512 512
ReadX 13649 10062 512 512
ReadX 13649 10574 512 512
ReadX 13649 11086 512 512
ReadX 13649 11598 512 512
ReadX 13649 12110 512 512
ReadX 13649 12622 512 512
ReadX 13649 13134 512 512
ReadX 13649 13646 368 368
ReadX 13649 3332 144 144
ReadX 13649 3476 512 512
ReadX 13649 3988 512 512
ReadX 13649 4500 512 512
ReadX 13649 5012 512 512
ReadX 13649 5524 512 512
ReadX 13649 6036 512 512
ReadX 13649 6548 512 512
ReadX 13649 7060 512 512
ReadX 13649 7572 512 512
ReadX 13649 8084 512 512
ReadX 13649 8596 512 512
ReadX 13649 9108 512 512
ReadX 13649 9620 512 512
ReadX 13649 10132 512 512
ReadX 13649 10644 512 512
ReadX 13649 11156 512 512
ReadX 13649 11668 512 512
ReadX 13649 12180 512 512
ReadX 13649 12692 512 512
ReadX 13649 13204 512 512
ReadX 13649 3430 512 512
ReadX 13649 3942 512 512
ReadX 13649 3434 512 512
ReadX 13649 3435 512 512
ReadX 13649 3947 512 512
ReadX 13649 4459 512 512
ReadX 13649 4971 512 512
ReadX 13649 5483 512 512
ReadX 13649 5995 512 512
ReadX 13649 6507 512 512
ReadX 13649 7019 512 512
ReadX 13649 7531 512 512
ReadX 13649 8043 512 512
ReadX 13649 8555 512 512
ReadX 13649 9067 512 512
ReadX 13649 9579 512 512
ReadX 13649 10091 512 512
ReadX 13649 10603 512 512
ReadX 13649 11115 512 512
ReadX 13649 3467 512 512
ReadX 13649 3979 512 512
ReadX 13649 4491 512 512
ReadX 13649 5003 512 512
ReadX 13649 5515 512 512
ReadX 13649 6027 512 512
ReadX 13649 6539 512 512
ReadX 13649 7051 512 512
ReadX 13649 7563 512 512
ReadX 13649 8075 512 512
ReadX 13649 8587 512 512
ReadX 13649 9099 512 512
ReadX 13649 9611 512 512
ReadX 13649 10123 512 512
ReadX 13649 10635 512 512
ReadX 13649 11147 512 512
ReadX 13649 11659 512 512
ReadX 13649 12171 512 512
ReadX 13649 12683 512 512
ReadX 13649 13195 512 512
ReadX 13649 13707 56 56
ReadX 13649 13763 512 512
ReadX 13649 14275 456 456
ReadX 13649 14731 512 512
ReadX 13649 15243 512 512
ReadX 13649 15755 512 512
ReadX 13649 16267 512 512
ReadX 13649 16779 512 512
ReadX 13649 17291 512 512
ReadX 13649 17803 512 512
ReadX 13649 18315 512 512
ReadX 13649 18827 512 512
ReadX 13649 19339 512 512
ReadX 13649 19851 512 512
ReadX 13649 20363 512 512
ReadX 13649 20875 512 512
ReadX 13649 21387 512 512
ReadX 13649 21899 512 512
ReadX 13649 22411 512 512
ReadX 13649 22923 512 512
ReadX 13649 23435 512 512
ReadX 13649 23947 512 512
ReadX 13649 24459 512 512
ReadX 13649 24971 282 282
ReadX 13649 3434 512 512
ReadX 13649 2818 512 512
ReadX 13649 2870 512 512
ReadX 13649 3026 512 512
ReadX 13649 3538 512 512
ReadX 13649 2870 512 512
ReadX 13649 3382 512 512
ReadX 13649 3894 512 512
ReadX 13649 4406 512 512
ReadX 13649 4918 512 512
ReadX 13649 5430 512 512
ReadX 13649 5942 512 512
ReadX 13649 6454 374 374
ReadX 13649 2856 138 138
ReadX 13649 2994 512 512
ReadX 13649 3506 512 512
ReadX 13649 4018 512 512
ReadX 13649 4530 512 512
ReadX 13649 5042 512 512
ReadX 13649 5554 512 512
ReadX 13649 6066 374 374
ReadX 13649 2886 138 138
ReadX 13649 3024 512 512
ReadX 13649 3536 512 512
ReadX 13649 4048 512 512
ReadX 13649 4560 512 512
ReadX 13649 5072 512 512
ReadX 13649 5584 512 512
ReadX 13649 6096 512 512
ReadX 13649 6608 512 512
ReadX 13649 7120 512 512
ReadX 13649 7632 512 512
ReadX 13649 8144 512 512
ReadX 13649 8656 512 512
ReadX 13649 9168 512 512
ReadX 13649 9680 512 512
ReadX 13649 10192 512 512
ReadX 13649 10704 512 512
ReadX 13649 11216 512 512
ReadX 13649 11728 512 512
ReadX 13649 12240 512 512
ReadX 13649 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 13649 13264 512 512
ReadX 13649 13776 512 512
ReadX 13649 14288 512 512
ReadX 13649 14800 512 512
ReadX 13649 15312 512 512
ReadX 13649 15824 512 512
ReadX 13649 16336 512 512
ReadX 13649 16848 512 512
ReadX 13649 17360 512 512
ReadX 13649 17872 512 512
ReadX 13649 18384 512 512
ReadX 13649 18896 512 512
ReadX 13649 19408 512 512
ReadX 13649 19920 512 512
ReadX 13649 20432 512 512
ReadX 13649 20944 512 512
ReadX 13649 21456 512 512
ReadX 13649 21968 512 512
ReadX 13649 22480 512 512
ReadX 13649 22992 512 512
ReadX 13649 2998 512 512
ReadX 13649 3510 512 512
ReadX 13649 3001 512 512
ReadX 13649 3003 512 512
ReadX 13649 3515 512 512
ReadX 13649 4027 512 512
ReadX 13649 4539 512 512
ReadX 13649 5051 512 512
ReadX 13649 5563 512 512
ReadX 13649 6075 512 512
ReadX 13649 6587 512 512
ReadX 13649 7099 512 512
ReadX 13649 7611 512 512
ReadX 13649 8123 512 512
ReadX 13649 8635 512 512
ReadX 13649 3029 512 512
ReadX 13649 3541 512 512
ReadX 13649 4053 512 512
ReadX 13649 4565 512 512
ReadX 13649 5077 512 512
ReadX 13649 5589 512 512
ReadX 13649 6101 512 512
ReadX 13649 6613 512 512
ReadX 13649 7125 512 512
ReadX 13649 7637 512 512
ReadX 13649 8149 512 512
ReadX 13649 8661 512 512
ReadX 13649 9173 512 512
ReadX 13649 9685 512 512
ReadX 13649 10197 512 512
ReadX 13649 10709 512 512
ReadX 13649 11221 512 512
ReadX 13649 11733 512 512
ReadX 13649 12245 512 512
ReadX 13649 12757 512 512
ReadX 13649 13269 40 40
ReadX 13649 3076 472 472
ReadX 13649 3548 512 512
ReadX 13649 4060 512 512
ReadX 13649 4572 512 512
ReadX 13649 5084 512 512
ReadX 13649 5596 512 512
ReadX 13649 6108 512 512
ReadX 13649 6620 512 512
ReadX 13649 7132 512 512
ReadX 13649 7644 512 512
ReadX 13649 8156 512 512
ReadX 13649 8668 512 512
ReadX 13649 9180 512 512
ReadX 13649 9692 512 512
ReadX 13649 10204 512 512
ReadX 13649 10716 512 512
ReadX 13649 11228 512 512
ReadX 13649 11740 512 512
ReadX 13649 12252 512 512
ReadX 13649 12764 512 512
ReadX 13649 13276 310 310
ReadX 13649 3001 512 512
ReadX 13649 2562 512 512
ReadX 13649 2626 512 512
ReadX 13649 3003 512 512
ReadX 13649 2721 512 512
ReadX 13649 2626 512 512
ReadX 13649 3138 512 512
ReadX 13649 3650 512 512
ReadX 13649 4162 512 512
ReadX 13649 4674 512 512
ReadX 13649 5186 512 512
ReadX 13649 5698 512 512
ReadX 13649 6210 424 424
ReadX 13649 2612 88 88
ReadX 13649 2700 512 512
ReadX 13649 3212 512 512
ReadX 13649 3724 512 512
ReadX 13649 4236 512 512
ReadX 13649 4748 512 512
ReadX 13649 5260 512 512
ReadX 13649 5772 424 424
ReadX 13649 2642 88 88
ReadX 13649 2730 512 512
ReadX 13649 3242 512 512
ReadX 13649 3754 512 512
ReadX 13649 4266 512 512
ReadX 13649 4778 512 512
ReadX 13649 5290 512 512
ReadX 13649 5802 512 512
ReadX 13649 6314 512 512
ReadX 13649 6826 512 512
ReadX 13649 7338 512 512
ReadX 13649 7850 512 512
ReadX 13649 8362 512 512
ReadX 13649 8874 512 512
ReadX 13649 9386 512 512
ReadX 13649 9898 512 512
ReadX 13649 10410 512 512
ReadX 13649 10922 512 512
ReadX 13649 11434 512 512
ReadX 13649 11946 512 512
ReadX 13649 12458 512 512
ReadX 13649 2716 512 512
ReadX 13649 2717 512 512
ReadX 13649 2718 512 512
ReadX 13649 3230 512 512
ReadX 13649 2721 512 512
ReadX 13649 3233 512 512
ReadX 13649 3745 512 512
ReadX 13649 4257 512 512
ReadX 13649 4769 512 512
ReadX 13649 5281 512 512
ReadX 13649 5793 512 512
ReadX 13649 6305 512 512
ReadX 13649 6817 512 512
ReadX 13649 7329 512 512
ReadX 13649 7841 512 512
ReadX 13649 8353 512 512
ReadX 13649 8865 512 512
ReadX 13649 9377 512 512
ReadX 13649 9889 512 512
ReadX 13649 10401 512 512
ReadX 13649 10913 512 512
ReadX 13649 11425 512 512
ReadX 13649 11937 512 512
ReadX 13649 12449 512 512
ReadX 13649 12961 512 512
ReadX 13649 13473 512 512
ReadX 13649 13985 106 106
ReadX 13649 2820 406 406
ReadX 13649 3226 512 512
ReadX 13649 3738 512 512
ReadX 13649 4250 512 512
ReadX 13649 4762 512 512
ReadX 13649 5274 512 512
ReadX 13649 5786 512 512
ReadX 13649 6298 512 512
ReadX 13649 6810 512 512
ReadX 13649 7322 512 512
ReadX 13649 7834 512 512
ReadX 13649 8346 512 512
ReadX 13649 8858 512 512
ReadX 13649 9370 512 512
ReadX 13649 9882 512 512
ReadX 13649 10394 512 512
ReadX 13649 10906 512 512
ReadX 13649 11418 182 182
ReadX 13649 2717 512 512
ReadX 13649 258 512 512
ReadX 13649 470 512 512
ReadX 13649 376 512 512
ReadX 13649 888 512 512
ReadX 13649 1400 512 512
ReadX 13649 1912 512 512
ReadX 13649 2424 512 512
ReadX 13649 2936 512 512
ReadX 13649 3448 512 512
ReadX 13649 3960 424 424
ReadX 13649 362 88 88
ReadX 13649 450 512 512
ReadX 13649 962 512 512
ReadX 13649 1474 512 512
ReadX 13649 1986 512 512
ReadX 13649 2498 512 512
ReadX 13649 3010 512 512
ReadX 13649 3522 424 424
ReadX 13649 392 88 88
ReadX 13649 480 512 512
ReadX 13649 992 512 512
ReadX 13649 1504 512 512
ReadX 13649 2016 512 512
ReadX 13649 2528 512 512
ReadX 13649 3040 512 512
ReadX 13649 3552 512 512
ReadX 13649 4064 512 512
ReadX 13649 4576 512 512
ReadX 13649 5088 512 512
ReadX 13649 5600 512 512
ReadX 13649 6112 512 512
ReadX 13649 6624 512 512
ReadX 13649 7136 512 512
ReadX 13649 7648 512 512
ReadX 13649 8160 512 512
ReadX 13649 8672 512 512
ReadX 13649 9184 512 512
ReadX 13649 9696 512 512
ReadX 13649 10208 512 512
ReadX 13649 464 512 512
ReadX 13649 465 512 512
ReadX 13649 466 512 512
ReadX 13649 978 512 512
ReadX 13649 470 512 512
ReadX 13649 982 512 512
ReadX 13649 1494 512 512
ReadX 13649 2006 512 512
ReadX 13649 2518 512 512
ReadX 13649 3030 512 512
ReadX 13649 3542 512 512
ReadX 13649 4054 512 512
ReadX 13649 4566 512 512
ReadX 13649 5078 512 512
ReadX 13649 5590 512 512
ReadX 13649 6102 512 512
ReadX 13649 6614 512 512
ReadX 13649 7126 512 512
ReadX 13649 7638 512 512
ReadX 13649 8150 512 512
ReadX 13649 8662 512 512
ReadX 13649 9174 512 512
ReadX 13649 9686 512 512
ReadX 13649 10198 512 512
ReadX 13649 10710 333 333
ReadX 13649 11043 512 512
ReadX 13649 11555 179 179
ReadX 13649 11734 512 512
ReadX 13649 12246 512 512
ReadX 13649 12758 512 512
ReadX 13649 13270 512 512
ReadX 13649 13782 512 512
ReadX 13649 14294 512 512
ReadX 13649 14806 512 512
ReadX 13649 15318 512 512
ReadX 13649 15830 512 512
ReadX 13649 16342 512 512
ReadX 13649 16854 512 512
ReadX 13649 17366 512 512
ReadX 13649 17878 512 512
ReadX 13649 18390 512 512
ReadX 13649 18902 512 512
ReadX 13649 19414 512 512
ReadX 13649 19926 512 512
ReadX 13649 20438 512 512
ReadX 13649 20950 512 512
ReadX 13649 21462 512 512
ReadX 13649 21974 350 350
ReadX 13649 465 512 512
ReadX 13649 3812 512 512
ReadX 13649 4046 512 512
ReadX 13649 3828 512 512
ReadX 13649 256 512 512
ReadX 13649 260 512 512
ReadX 13649 4066 512 512
ReadX 13649 4578 512 512
ReadX 13649 5090 512 512
ReadX 13649 5602 512 512
ReadX 13649 6114 512 512
ReadX 13649 6626 512 512
ReadX 13649 7138 512 512
ReadX 13649 7650 394 394
ReadX 13649 4052 118 118
ReadX 13649 4170 512 512
ReadX 13649 4682 512 512
ReadX 13649 5194 512 512
ReadX 13649 5706 512 512
ReadX 13649 6218 512 512
ReadX 13649 6730 512 512
ReadX 13649 7242 394 394
ReadX 13649 4082 118 118
ReadX 13649 4200 512 512
ReadX 13649 4712 512 512
ReadX 13649 5224 512 512
ReadX 13649 5736 512 512
ReadX 13649 6248 512 512
ReadX 13649 6760 512 512
ReadX 13649 7272 512 512
ReadX 13649 7784 394 394
ReadX 13649 256 118 118
ReadX 13649 374 512 512
ReadX 13649 886 512 512
ReadX 13649 1398 512 512
ReadX 13649 1910 512 512
ReadX 13649 2422 512 512
ReadX 13649 2934 512 512
ReadX 13649 3446 512 512
ReadX 13649 3958 512 512
ReadX 13649 4470 512 512
ReadX 13649 4982 512 512
ReadX 13649 5494 512 512
ReadX 13649 6006 512 512
ReadX 13649 6518 512 512
ReadX 13649 7030 512 512
ReadX 13649 7542 512 512
ReadX 13649 8054 512 512
ReadX 13649 8566 512 512
ReadX 13649 9078 512 512
ReadX 13649 9590 512 512
ReadX 13649 10102 512 512
ReadX 13649 259 512 512
ReadX 13649 771 512 512
ReadX 13649 259 512 512
ReadX 13649 259 512 512
ReadX 13649 771 512 512
ReadX 13649 1283 512 512
ReadX 13649 1795 512 512
ReadX 13649 2307 512 512
ReadX 13649 2819 512 512
ReadX 13649 3331 512 512
ReadX 13649 3843 512 512
ReadX 13649 4355 512 512
ReadX 13649 4867 512 512
ReadX 13649 260 512 512
ReadX 13649 772 512 512
ReadX 13649 1284 512 512
ReadX 13649 1796 512 512
ReadX 13649 2308 512 512
ReadX 13649 2820 512 512
ReadX 13649 3332 512 512
ReadX 13649 3844 512 512
ReadX 13649 4356 512 512
ReadX 13649 4868 512 512
ReadX 13649 5380 512 512
ReadX 13649 5892 512 512
ReadX 13649 6404 512 512
ReadX 13649 6916 512 512
ReadX 13649 7428 512 512
ReadX 13649 7940 512 512
ReadX 13649 8452 512 512
ReadX 13649 8964 512 512
ReadX 13649 9476 512 512
ReadX 13649 9988 512 512
ReadX 13649 10500 378 378
ReadX 13649 10878 512 512
ReadX 13649 11390 134 134
ReadX 13649 11524 512 512
ReadX 13649 12036 512 512
ReadX 13649 12548 512 512
ReadX 13649 13060 512 512
ReadX 13649 13572 138 138
ReadX 13649 259 512 512
ReadX 13649 273 512 512
ReadX 13649 276 512 512
ReadX 13649 295 512 512
ReadX 13649 288 512 512
ReadX 13649 296 512 512
ReadX 13649 259 512 512
ReadX 13649 273 512 512
ReadX 13649 273 512 512
ReadX 13649 785 512 512
ReadX 13649 1297 512 512
ReadX 13649 1809 512 512
ReadX 13649 2321 512 512
ReadX 13649 274 512 512
ReadX 13649 274 512 512
ReadX 13649 274 497 497
ReadX 13649 272 15 15
ReadX 13649 287 512 512
ReadX 13649 799 512 512
ReadX 13649 273 512 512
ReadX 13649 785 512 512
ReadX 13649 1297 512 512
ReadX 13649 1809 512 512
ReadX 13649 2321 512 512
ReadX 13649 2833 317 317
ReadX 13649 274 195 195
ReadX 13649 469 512 512
ReadX 13649 981 512 512
ReadX 13649 1493 512 512
ReadX 13649 2005 512 512
ReadX 13649 2517 512 512
ReadX 13649 3029 512 512
ReadX 13649 3541 512 512
ReadX 13649 4053 512 512
ReadX 13649 4565 250 250
ReadX 13649 274 512 512
ReadX 13649 283 512 512
ReadX 13649 795 512 512
ReadX 13649 276 512 512
ReadX 13649 788 512 512
ReadX 13649 1300 512 512
ReadX 13649 1812 512 512
ReadX 13649 2324 512 512
ReadX 13649 2836 512 512
ReadX 13649 3348 512 512
ReadX 13649 3860 420 420
ReadX 13649 275 92 92
ReadX 13649 367 512 512
ReadX 13649 879 512 512
ReadX 13649 1391 512 512
ReadX 13649 1903 512 512
ReadX 13649 2415 512 512
ReadX 13649 2927 512 512
ReadX 13649 3439 420 420
ReadX 13649 277 92 92
ReadX 13649 369 512 512
ReadX 13649 881 512 512
ReadX 13649 1393 512 512
ReadX 13649 1905 512 512
ReadX 13649 2417 512 512
ReadX 13649 2929 512 512
ReadX 13649 3441 512 512
ReadX 13649 3953 512 512
ReadX 13649 4465 512 512
ReadX 13649 4977 512 512
ReadX 13649 5489 512 512
ReadX 13649 6001 512 512
ReadX 13649 6513 512 512
ReadX 13649 7025 512 512
ReadX 13649 7537 512 512
ReadX 13649 8049 512 512
ReadX 13649 8561 512 512
ReadX 13649 9073 512 512
ReadX 13649 9585 512 512
ReadX 13649 10097 512 512
ReadX 13649 282 512 512
ReadX 13649 794 512 512
ReadX 13649 1306 512 512
ReadX 13649 1818 512 512
ReadX 13649 2330 512 512
ReadX 13649 2842 512 512
ReadX 13649 3354 512 512
ReadX 13649 3866 512 512
ReadX 13649 4378 512 512
ReadX 13649 284 512 512
ReadX 13649 796 512 512
ReadX 13649 1308 512 512
ReadX 13649 1820 512 512
ReadX 13649 2332 512 512
ReadX 13649 2844 512 512
ReadX 13649 3356 512 512
ReadX 13649 3868 512 512
ReadX 13649 4380 512 512
ReadX 13649 4892 512 512
ReadX 13649 5404 512 512
ReadX 13649 5916 512 512
ReadX 13649 6428 512 512
ReadX 13649 6940 512 512
ReadX 13649 7452 512 512
ReadX 13649 7964 512 512
ReadX 13649 8476 512 512
ReadX 13649 8988 512 512
ReadX 13649 9500 512 512
ReadX 13649 10012 512 512
ReadX 13649 10524 472 472
ReadX 13649 288 40 40
ReadX 13649 328 512 512
ReadX 13649 840 512 512
ReadX 13649 1352 512 512
ReadX 13649 1864 512 512
ReadX 13649 2376 512 512
ReadX 13649 2888 512 512
ReadX 13649 3400 512 512
ReadX 13649 3912 512 512
ReadX 13649 4424 512 512
ReadX 13649 4936 512 512
ReadX 13649 5448 512 512
ReadX 13649 5960 512 512
ReadX 13649 6472 512 512
ReadX 13649 6984 512 512
ReadX 13649 7496 512 512
ReadX 13649 8008 512 512
ReadX 13649 8520 512 512
ReadX 13649 9032 512 512
ReadX 13649 9544 512 512
ReadX 13649 10056 512 512
ReadX 13649 10568 506 506
ReadX 13649 282 512 512
ReadX 13649 794 512 512
ReadX 13649 301 512 512
ReadX 13649 296 512 512
ReadX 13649 808 512 512
ReadX 13649 1320 512 512
ReadX 13649 1832 512 512
ReadX 13649 2344 512 512
ReadX 13649 2856 512 512
ReadX 13649 3368 512 512
ReadX 13649 3880 424 424
ReadX 13649 295 88 88
ReadX 13649 383 512 512
ReadX 13649 895 512 512
ReadX 13649 1407 512 512
ReadX 13649 1919 512 512
ReadX 13649 2431 512 512
ReadX 13649 2943 512 512
ReadX 13649 3455 424 424
ReadX 13649 297 88 88
ReadX 13649 385 512 512
ReadX 13649 897 512 512
ReadX 13649 1409 512 512
ReadX 13649 1921 512 512
ReadX 13649 2433 512 512
ReadX 13649 2945 512 512
ReadX 13649 3457 512 512
ReadX 13649 3969 512 512
ReadX 13649 4481 512 512
ReadX 13649 4993 512 512
ReadX 13649 5505 512 512
ReadX 13649 6017 512 512
ReadX 13649 6529 512 512
ReadX 13649 7041 512 512
ReadX 13649 7553 512 512
ReadX 13649 8065 512 512
ReadX 13649 8577 512 512
ReadX 13649 9089 512 512
ReadX 13649 9601 512 512
ReadX 13649 10113 512 512
ReadX 13649 301 512 512
ReadX 13649 301 512 512
ReadX 13649 301 512 512
ReadX 13649 813 512 512
ReadX 13649 301 512 512
ReadX 13649 813 512 512
ReadX 13649 1325 512 512
ReadX 13649 1837 512 512
ReadX 13649 2349 512 512
ReadX 13649 2861 512 512
ReadX 13649 3373 512 512
ReadX 13649 3885 512 512
ReadX 13649 4397 512 512
ReadX 13649 4909 512 512
ReadX 13649 5421 512 512
ReadX 13649 5933 512 512
ReadX 13649 6445 512 512
ReadX 13649 6957 512 512
ReadX 13649 7469 512 512
ReadX 13649 7981 512 512
ReadX 13649 8493 512 512
ReadX 13649 9005 512 512
ReadX 13649 9517 463 463
ReadX 13649 9980 512 512
ReadX 13649 10492 49 49
ReadX 13649 10541 512 512
ReadX 13649 11053 512 512
ReadX 13649 11565 512 512
ReadX 13649 12077 512 512
ReadX 13649 12589 512 512
ReadX 13649 13101 512 512
ReadX 13649 13613 512 512
ReadX 13649 14125 512 512
ReadX 13649 14637 512 512
ReadX 13649 15149 512 512
ReadX 13649 15661 512 512
ReadX 13649 16173 512 512
ReadX 13649 16685 512 512
ReadX 13649 17197 512 512
ReadX 13649 17709 512 512
ReadX 13649 18221 512 512
ReadX 13649 18733 512 512
ReadX 13649 19245 512 512
ReadX 13649 19757 512 512
ReadX 13649 20269 512 512
ReadX 13649 20781 326 326
ReadX 13649 301 512 512
QUERY_FS_INFORMATION 259
Close 13647
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13650
Close 13650
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13651
ReadX 13651 0 24 24
Close 13651
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13652
QUERY_FILE_INFORMATION 13652
ReadX 13652 0 512 512
ReadX 13652 476 512 512
ReadX 13652 510 512 512
ReadX 13652 484 512 512
ReadX 13652 474 512 512
ReadX 13652 478 512 512
ReadX 13652 990 512 512
ReadX 13652 509 57 57
Close 13652
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13653
QUERY_FILE_INFORMATION 13653
ReadX 13653 0 512 512
ReadX 13653 476 512 512
ReadX 13653 510 512 512
ReadX 13653 484 512 512
ReadX 13653 480 512 512
ReadX 13653 474 512 512
ReadX 13653 478 512 512
QUERY_FILE_INFORMATION 13653
WriteX 13653 494 60 60
WriteX 13653 494 4 4
QUERY_FILE_INFORMATION 13653
WriteX 13653 494 11 11
WriteX 13653 510 512 512
WriteX 13653 484 512 512
WriteX 13653 474 512 512
WriteX 13653 478 512 512
WriteX 13653 990 512 512
Close 13653
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13654
Close 13654
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13655
Close 13655
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13657
WriteX 13657 4607 1 1
QUERY_FILE_INFORMATION 13657
WriteX 13657 0 65471 65471
WriteX 13657 65471 65 65
WriteX 13657 65536 19490 19490
Close 13657
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13658
QUERY_FILE_INFORMATION 13658
ReadX 13658 0 512 512
ReadX 13658 482 512 512
ReadX 13658 994 512 512
ReadX 13658 1506 512 512
ReadX 13658 480 512 512
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 490 448 448
QUERY_FILE_INFORMATION 13658
WriteX 13658 490 60 60
WriteX 13658 490 4 4
QUERY_FILE_INFORMATION 13658
WriteX 13658 490 11 11
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 484 512 512
WriteX 13658 996 512 512
WriteX 13658 1508 512 512
WriteX 13658 482 512 512
WriteX 13658 0 512 512
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
ReadX 13658 490 512 512
WriteX 13658 502 512 512
WriteX 13658 502 292 292
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 503 20 20
WriteX 13658 503 108 108
QUERY_FILE_INFORMATION 13658
WriteX 13658 504 448 448
QUERY_FILE_INFORMATION 13658
WriteX 13658 504 44 44
WriteX 13658 504 20 20
WriteX 13658 500 512 512
WriteX 13658 492 512 512
WriteX 13658 496 512 512
WriteX 13658 1008 512 512
WriteX 13658 494 512 512
Flush 13658
WriteX 13658 0 512 512
Flush 13658
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 500 512 512
WriteX 13658 492 512 512
WriteX 13658 496 512 512
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 518 320 320
QUERY_FILE_INFORMATION 13658
WriteX 13658 518 60 60
ReadX 13658 504 512 512
WriteX 13658 522 512 512
WriteX 13658 506 3204 3204
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 519 25 25
WriteX 13658 518 103 103
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 519 44 44
WriteX 13658 519 20 20
WriteX 13658 520 512 512
WriteX 13658 482 512 512
WriteX 13658 486 512 512
WriteX 13658 998 512 512
WriteX 13658 484 512 512
WriteX 13658 490 512 512
Flush 13658
WriteX 13658 0 512 512
Flush 13658
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
QUERY_FILE_INFORMATION 13658
WriteX 13658 519 7 7
WriteX 13658 519 57 57
WriteX 13658 520 512 512
WriteX 13658 492 512 512
WriteX 13658 482 512 512
WriteX 13658 486 512 512
WriteX 13658 998 512 512
Flush 13658
WriteX 13658 520 512 512
Flush 13658
Close 13658
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13659
Close 13659
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13660
QUERY_FILE_INFORMATION 13660
ReadX 13660 0 512 512
ReadX 13660 490 512 512
ReadX 13660 484 512 512
ReadX 13660 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13661
Close 13661
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13660
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13662
Close 13662
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13663
ReadX 13663 0 24 24
Close 13663
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13664
QUERY_FILE_INFORMATION 13664
ReadX 13664 0 512 512
ReadX 13664 366 512 512
ReadX 13664 878 512 512
ReadX 13664 1390 512 512
ReadX 13664 1902 512 512
ReadX 13664 374 57 57
Close 13664
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13665
QUERY_FILE_INFORMATION 13665
ReadX 13665 0 512 512
ReadX 13665 366 512 512
ReadX 13665 878 512 512
ReadX 13665 1390 512 512
ReadX 13665 1902 512 512
QUERY_FILE_INFORMATION 13665
WriteX 13665 374 60 60
WriteX 13665 374 4 4
QUERY_FILE_INFORMATION 13665
WriteX 13665 374 11 11
ReadX 13665 374 57 57
ReadX 13665 374 57 57
ReadX 13665 292 4096 4096
ReadX 13665 364 512 512
ReadX 13665 512 4096 4096
ReadX 13665 4608 4096 4096
ReadX 13665 8704 4096 4096
ReadX 13665 12800 4096 4096
ReadX 13665 16896 4096 4096
ReadX 13665 20992 4096 4096
ReadX 13665 25088 4096 4096
ReadX 13665 29184 4096 4096
ReadX 13665 33280 4096 4096
ReadX 13665 37376 4096 4096
ReadX 13665 41472 4096 4096
ReadX 13665 45568 4096 4096
ReadX 13665 49664 4096 4096
ReadX 13665 53760 4096 4096
ReadX 13665 57856 4096 4096
ReadX 13665 61952 4096 4096
ReadX 13665 66048 4096 4096
ReadX 13665 70144 4096 4096
ReadX 13665 74240 162 162
ReadX 13665 308 4096 4096
ReadX 13665 4404 4096 4096
WriteX 13665 368 512 512
WriteX 13665 880 512 512
WriteX 13665 1392 512 512
Close 13665
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13666
Close 13666
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13667
QUERY_FILE_INFORMATION 13667
ReadX 13667 0 512 512
ReadX 13667 366 512 512
ReadX 13667 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13668
Close 13668
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13667
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13670
WriteX 13670 4607 1 1
QUERY_FILE_INFORMATION 13670
WriteX 13670 0 65471 65471
WriteX 13670 65471 65 65
WriteX 13670 65536 8866 8866
Close 13670
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13671
QUERY_FILE_INFORMATION 13671
ReadX 13671 0 512 512
ReadX 13671 366 512 512
ReadX 13671 878 512 512
ReadX 13671 1390 512 512
ReadX 13671 364 512 512
QUERY_FILE_INFORMATION 13671
QUERY_FILE_INFORMATION 13671
QUERY_FILE_INFORMATION 13671
WriteX 13671 374 448 448
QUERY_FILE_INFORMATION 13671
WriteX 13671 374 60 60
WriteX 13671 374 4 4
QUERY_FILE_INFORMATION 13671
WriteX 13671 374 11 11
QUERY_FILE_INFORMATION 13671
QUERY_FILE_INFORMATION 13671
WriteX 13671 374 7 7
WriteX 13671 374 57 57
WriteX 13671 368 512 512
WriteX 13671 880 512 512
WriteX 13671 1392 512 512
WriteX 13671 366 512 512
WriteX 13671 0 512 512
Flush 13671
WriteX 13671 368 512 512
Flush 13671
Close 13671
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13672
QUERY_FILE_INFORMATION 13672
ReadX 13672 0 512 512
ReadX 13672 366 512 512
ReadX 13672 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13672
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13673
Close 13673
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13674
ReadX 13674 0 24 24
Close 13674
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13675
QUERY_FILE_INFORMATION 13675
ReadX 13675 0 512 512
ReadX 13675 366 512 512
ReadX 13675 878 512 512
ReadX 13675 1390 512 512
ReadX 13675 1902 512 512
ReadX 13675 374 57 57
Close 13675
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13676
QUERY_FILE_INFORMATION 13676
ReadX 13676 0 512 512
ReadX 13676 366 512 512
ReadX 13676 878 512 512
ReadX 13676 1390 512 512
ReadX 13676 1902 512 512
QUERY_FILE_INFORMATION 13676
WriteX 13676 374 60 60
WriteX 13676 374 4 4
QUERY_FILE_INFORMATION 13676
WriteX 13676 374 11 11
WriteX 13676 368 512 512
WriteX 13676 880 512 512
WriteX 13676 1392 512 512
Close 13676
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13677
Close 13677
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13678
Close 13678
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13680
WriteX 13680 4607 1 1
QUERY_FILE_INFORMATION 13680
WriteX 13680 0 65471 65471
WriteX 13680 65471 65 65
WriteX 13680 0 8192 8192
WriteX 13680 65536 9298 9298
Close 13680
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13681
QUERY_FILE_INFORMATION 13681
ReadX 13681 0 512 512
ReadX 13681 368 512 512
ReadX 13681 880 512 512
ReadX 13681 1392 512 512
ReadX 13681 366 512 512
QUERY_FILE_INFORMATION 13681
QUERY_FILE_INFORMATION 13681
QUERY_FILE_INFORMATION 13681
WriteX 13681 376 448 448
QUERY_FILE_INFORMATION 13681
WriteX 13681 376 60 60
WriteX 13681 376 4 4
QUERY_FILE_INFORMATION 13681
WriteX 13681 376 11 11
QUERY_FILE_INFORMATION 13681
QUERY_FILE_INFORMATION 13681
WriteX 13681 376 7 7
WriteX 13681 376 57 57
WriteX 13681 370 512 512
WriteX 13681 882 512 512
WriteX 13681 1394 512 512
WriteX 13681 368 512 512
WriteX 13681 0 512 512
Flush 13681
WriteX 13681 370 512 512
Flush 13681
Close 13681
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13682
Close 13682
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13683
QUERY_FILE_INFORMATION 13683
ReadX 13683 0 512 512
ReadX 13683 368 512 512
ReadX 13683 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13684
Close 13684
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13686
Close 13686
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13687
ReadX 13687 0 24 24
Close 13687
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13688
QUERY_FILE_INFORMATION 13688
ReadX 13688 0 512 512
ReadX 13688 512 512 512
ReadX 13688 1024 512 512
ReadX 13688 2016 512 512
ReadX 13688 1056 512 512
ReadX 13688 1096 57 57
Close 13688
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13689
QUERY_FILE_INFORMATION 13689
ReadX 13689 0 512 512
ReadX 13689 512 512 512
ReadX 13689 1024 512 512
ReadX 13689 2016 512 512
ReadX 13689 1056 512 512
ReadX 13689 1096 57 57
ReadX 13689 1096 57 57
ReadX 13689 1088 62 62
ReadX 13689 1536 4096 4096
ReadX 13689 5632 4096 4096
ReadX 13689 9728 4096 4096
ReadX 13689 13824 2859 2859
ReadX 13689 1120 28 28
ReadX 13689 1148 20 20
ReadX 13689 1168 8 8
ReadX 13689 1176 88 88
ReadX 13689 1264 8 8
ReadX 13689 1272 4 4
ReadX 13689 1276 4 4
ReadX 13689 1280 1 1
ReadX 13689 1130 4 4
ReadX 13689 1134 4 4
ReadX 13689 1138 1 1
ReadX 13689 1131 4 4
ReadX 13689 1135 4 4
ReadX 13689 1139 1 1
ReadX 13689 1131 4 4
ReadX 13689 1135 4 4
ReadX 13689 1139 2 2
ReadX 13689 1132 4 4
ReadX 13689 1136 4 4
ReadX 13689 1140 25 25
ReadX 13689 1134 4 4
ReadX 13689 1138 8 8
ReadX 13689 1146 4 4
ReadX 13689 1150 8 8
ReadX 13689 1158 4 4
ReadX 13689 1162 8 8
ReadX 13689 1170 4 4
ReadX 13689 1174 4 4
ReadX 13689 1178 4 4
ReadX 13689 1182 4 4
ReadX 13689 1186 4 4
ReadX 13689 1190 4 4
ReadX 13689 1194 13900 13900
ReadX 13689 2048 4096 4096
Close 13689
QUERY_FS_INFORMATION 259
Close 13683
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13690
Close 13690
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13691
ReadX 13691 0 24 24
Close 13691
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13692
QUERY_FILE_INFORMATION 13692
ReadX 13692 0 512 512
ReadX 13692 368 512 512
ReadX 13692 880 512 512
ReadX 13692 1392 512 512
ReadX 13692 1904 512 512
ReadX 13692 376 57 57
Close 13692
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13693
QUERY_FILE_INFORMATION 13693
ReadX 13693 0 512 512
ReadX 13693 368 512 512
ReadX 13693 880 512 512
ReadX 13693 1392 512 512
ReadX 13693 1904 512 512
QUERY_FILE_INFORMATION 13693
WriteX 13693 376 60 60
WriteX 13693 376 4 4
QUERY_FILE_INFORMATION 13693
WriteX 13693 376 11 11
WriteX 13693 370 512 512
WriteX 13693 882 512 512
WriteX 13693 1394 512 512
Close 13693
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13694
Close 13694
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13695
Close 13695
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13697
WriteX 13697 4607 1 1
QUERY_FILE_INFORMATION 13697
WriteX 13697 0 65471 65471
WriteX 13697 65471 65 65
WriteX 13697 65536 11540 11540
Close 13697
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13698
QUERY_FILE_INFORMATION 13698
ReadX 13698 0 512 512
ReadX 13698 398 512 512
ReadX 13698 910 512 512
ReadX 13698 1422 512 512
ReadX 13698 396 512 512
QUERY_FILE_INFORMATION 13698
QUERY_FILE_INFORMATION 13698
QUERY_FILE_INFORMATION 13698
WriteX 13698 406 448 448
QUERY_FILE_INFORMATION 13698
WriteX 13698 406 60 60
WriteX 13698 406 4 4
QUERY_FILE_INFORMATION 13698
WriteX 13698 406 11 11
QUERY_FILE_INFORMATION 13698
QUERY_FILE_INFORMATION 13698
WriteX 13698 406 7 7
WriteX 13698 406 57 57
WriteX 13698 400 512 512
WriteX 13698 912 512 512
WriteX 13698 1424 512 512
WriteX 13698 398 512 512
WriteX 13698 0 512 512
Flush 13698
WriteX 13698 400 512 512
Flush 13698
Close 13698
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13699
Close 13699
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13700
QUERY_FILE_INFORMATION 13700
ReadX 13700 0 512 512
ReadX 13700 398 512 512
ReadX 13700 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13701
Close 13701
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13700
ReadX 13649 1434 512 512
Close 13649
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13702
WriteX 13702 0 65471 65471
WriteX 13702 65471 63 63
WriteX 13702 65534 65471 65471
WriteX 13702 131005 63 63
Close 13702
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13703
WriteX 13703 0 65471 65471
WriteX 13703 65471 63 63
WriteX 13703 65534 65471 65471
WriteX 13703 131005 63 63
WriteX 13703 131068 65471 65471
WriteX 13703 196539 63 63
WriteX 13703 196602 65471 65471
WriteX 13703 262073 63 63
Close 13703
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13704
WriteX 13704 0 65471 65471
WriteX 13704 65471 63 63
WriteX 13704 65534 65471 65471
WriteX 13704 131005 63 63
WriteX 13704 131068 65471 65471
WriteX 13704 196539 63 63
WriteX 13704 196602 65471 65471
WriteX 13704 262073 63 63
WriteX 13704 262136 65471 65471
WriteX 13704 327607 63 63
WriteX 13704 327670 65471 65471
WriteX 13704 393141 63 63
WriteX 13704 393204 65471 65471
WriteX 13704 458675 63 63
WriteX 13704 458738 65471 65471
WriteX 13704 524209 63 63
Close 13704
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13705
Close 13705
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13706
ReadX 13706 0 512 512
ReadX 13706 512 511 511
ReadX 13706 1023 512 512
ReadX 13706 1535 512 512
Close 13706
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13707
ReadX 13707 0 512 512
ReadX 13707 512 510 510
ReadX 13707 1022 512 512
ReadX 13707 1534 510 510
ReadX 13707 2044 510 510
Close 13707
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13708
ReadX 13708 0 512 512
ReadX 13708 512 512 512
ReadX 13708 1024 512 512
ReadX 13708 1536 512 512
ReadX 13708 2048 512 512
ReadX 13708 2560 512 512
ReadX 13708 3072 512 512
ReadX 13708 3584 512 512
ReadX 13708 4096 512 512
ReadX 13708 4608 512 512
ReadX 13708 5120 512 512
ReadX 13708 5632 512 512
ReadX 13708 6144 512 512
ReadX 13708 6656 512 512
ReadX 13708 7168 512 512
ReadX 13708 7680 512 512
ReadX 13708 8192 512 512
ReadX 13708 8704 512 512
Close 13708
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13709
Close 13709
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13710
QUERY_FILE_INFORMATION 13710
Close 13710
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13711
ReadX 13711 0 8192 8192
Close 13711
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13712
Close 13712
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13713
QUERY_FILE_INFORMATION 13713
Close 13713
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13714
ReadX 13714 0 8192 8192
Close 13714
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13715
Close 13715
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13716
QUERY_FILE_INFORMATION 13716
Close 13716
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13717
ReadX 13717 0 8192 8192
Close 13717
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13718
ReadX 13718 0 8192 8192
ReadX 13718 8192 8192 8192
ReadX 13718 16384 8192 8192
ReadX 13718 24576 8192 8192
Close 13718
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13720
Close 13720
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13722
WriteX 13722 8191 1 1
QUERY_FILE_INFORMATION 13722
WriteX 13722 0 10438 10438
Close 13722
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13723
Close 13723
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13724
QUERY_FILE_INFORMATION 13724
QUERY_FILE_INFORMATION 13724
Close 13724
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13725
QUERY_FILE_INFORMATION 13725
QUERY_FILE_INFORMATION 13725
Close 13725
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13726
Close 13726
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13727
QUERY_FILE_INFORMATION 13727
QUERY_FILE_INFORMATION 13727
Close 13727
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13728
QUERY_FILE_INFORMATION 13728
QUERY_FILE_INFORMATION 13728
Close 13728
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13729
Close 13729
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13730
QUERY_FILE_INFORMATION 13730
QUERY_FILE_INFORMATION 13730
Close 13730
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13731
QUERY_FILE_INFORMATION 13731
QUERY_FILE_INFORMATION 13731
Close 13731
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13732
Close 13732
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13733
QUERY_FILE_INFORMATION 13733
QUERY_FILE_INFORMATION 13733
Close 13733
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13734
ReadX 13734 0 8 8
ReadX 13734 8 4 4
ReadX 13734 12 8 8
ReadX 13734 22 8 8
ReadX 13734 520 8 8
ReadX 13734 525 8 8
ReadX 13734 533 4 4
ReadX 13734 543 8 8
ReadX 13734 551 4 4
ReadX 13734 1058 8 8
ReadX 13734 1066 4 4
ReadX 13734 1081 8 8
ReadX 13734 1089 4 4
ReadX 13734 660 8 8
Close 13734
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13735
ReadX 13735 0 8192 8192
Close 13735
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13736
ReadX 13736 0 8192 8192
ReadX 13736 520 8192 8192
ReadX 13736 8712 8192 8192
ReadX 13736 16904 8192 8192
ReadX 13736 25096 8192 8192
ReadX 13736 33288 8192 8192
ReadX 13736 41480 8192 8192
ReadX 13736 49672 8192 8192
ReadX 13736 57864 8192 8192
ReadX 13736 66056 8192 8192
ReadX 13736 74248 8192 8192
ReadX 13736 82440 8192 8192
ReadX 13736 90632 8192 8192
ReadX 13736 98824 8192 8192
ReadX 13736 107016 8192 8192
ReadX 13736 115208 8192 8192
ReadX 13736 123400 8192 8192
ReadX 13736 131592 8192 8192
ReadX 13736 139784 8192 8192
ReadX 13736 147976 8192 8192
ReadX 13736 156168 8192 8192
Close 13736
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13737
QUERY_FILE_INFORMATION 13737
Close 13737
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13738
Close 13738
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13740
WriteX 13740 8191 1 1
QUERY_FILE_INFORMATION 13740
WriteX 13740 0 28489 28489
WriteX 13740 0 12288 12288
Close 13740
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13741
Close 13741
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13742
Close 13742
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13743
QUERY_FILE_INFORMATION 13743
Close 13743
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13744
ReadX 13744 0 8192 8192
Close 13744
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13745
Close 13745
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13746
QUERY_FILE_INFORMATION 13746
Close 13746
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13747
ReadX 13747 0 8192 8192
Close 13747
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13748
ReadX 13748 0 8192 8192
ReadX 13748 8192 8192 8192
ReadX 13748 16384 8192 8192
ReadX 13748 24576 8192 8192
ReadX 13748 32768 16384 16384
ReadX 13748 49152 8192 8192
ReadX 13748 57344 8192 8192
ReadX 13748 65536 8192 8192
Close 13748
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13750
Close 13750
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13752
WriteX 13752 8191 1 1
QUERY_FILE_INFORMATION 13752
WriteX 13752 0 29253 29253
Close 13752
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13753
Close 13753
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13754
QUERY_FILE_INFORMATION 13754
QUERY_FILE_INFORMATION 13754
Close 13754
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13755
QUERY_FILE_INFORMATION 13755
QUERY_FILE_INFORMATION 13755
Close 13755
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13756
QUERY_FILE_INFORMATION 13756
Close 13756
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13757
Close 13757
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13759
WriteX 13759 8191 1 1
QUERY_FILE_INFORMATION 13759
WriteX 13759 0 30183 30183
Close 13759
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13760
Close 13760
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13761
WriteX 13761 0 510 510
WriteX 13761 510 512 512
WriteX 13761 1022 510 510
WriteX 13761 1532 510 510
WriteX 13761 2042 168 168
Close 13761
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13762
Close 13762
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13763
WriteX 13763 0 511 511
WriteX 13763 511 512 512
WriteX 13763 1023 512 512
WriteX 13763 1535 488 488
Close 13763
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13764
ReadX 13764 0 65471 65471
ReadX 13764 65471 63 63
ReadX 13764 65534 65471 65471
ReadX 13764 131005 63 63
ReadX 13764 131068 65471 65471
ReadX 13764 196539 63 63
ReadX 13764 196602 65471 65471
ReadX 13764 262073 63 63
ReadX 13764 262136 65471 65471
ReadX 13764 327607 63 63
ReadX 13764 327670 10 10
Close 13764
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13765
ReadX 13765 0 65471 65471
ReadX 13765 65471 63 63
ReadX 13765 65534 65471 65471
ReadX 13765 131005 63 63
ReadX 13765 131068 65471 65471
ReadX 13765 196539 63 63
ReadX 13765 196602 65471 65471
ReadX 13765 262073 63 63
ReadX 13765 262136 65471 65471
ReadX 13765 327607 63 63
ReadX 13765 327670 65471 65471
ReadX 13765 393141 63 63
ReadX 13765 393204 65471 65471
ReadX 13765 458675 63 63
ReadX 13765 458738 65471 65471
ReadX 13765 524209 63 63
ReadX 13765 524272 65471 65471
ReadX 13765 589743 63 63
ReadX 13765 589806 65471 65471
ReadX 13765 655277 63 63
ReadX 13765 655340 32 32
Close 13765
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13766
ReadX 13766 0 65471 65471
ReadX 13766 65471 63 63
ReadX 13766 65534 65471 65471
ReadX 13766 131005 63 63
ReadX 13766 131068 65471 65471
ReadX 13766 196539 63 63
ReadX 13766 196602 65471 65471
ReadX 13766 262073 63 63
ReadX 13766 262136 65471 65471
ReadX 13766 327607 63 63
ReadX 13766 327670 65471 65471
ReadX 13766 393141 63 63
ReadX 13766 393204 65471 65471
ReadX 13766 458675 63 63
ReadX 13766 458738 65471 65471
ReadX 13766 524209 63 63
ReadX 13766 524272 65471 65471
ReadX 13766 589743 63 63
ReadX 13766 589806 65471 65471
ReadX 13766 655277 63 63
ReadX 13766 655340 65471 65471
ReadX 13766 720811 63 63
ReadX 13766 720874 65471 65471
ReadX 13766 786345 63 63
ReadX 13766 786408 65471 65471
ReadX 13766 851879 63 63
ReadX 13766 851942 65471 65471
ReadX 13766 917413 63 63
ReadX 13766 917476 65471 65471
ReadX 13766 982947 63 63
ReadX 13766 983010 65471 65471
ReadX 13766 1048481 63 63
ReadX 13766 1048544 65471 65471
ReadX 13766 1114015 63 63
ReadX 13766 1114078 65471 65471
ReadX 13766 1179549 63 63
ReadX 13766 1179612 65471 65471
ReadX 13766 1245083 63 63
ReadX 13766 1245146 65471 65471
ReadX 13766 1310617 63 63
ReadX 13766 1310680 65471 65471
ReadX 13766 1376151 63 63
ReadX 13766 1376214 65471 65471
ReadX 13766 1441685 63 63
ReadX 13766 1441748 65471 65471
ReadX 13766 1507219 63 63
ReadX 13766 1507282 65471 65471
ReadX 13766 1572753 63 63
ReadX 13766 1572816 65471 65471
ReadX 13766 1638287 63 63
ReadX 13766 1638350 65471 65471
ReadX 13766 1703821 63 63
ReadX 13766 1703884 65471 65471
ReadX 13766 1769355 63 63
ReadX 13766 1769418 65471 65471
ReadX 13766 1834889 63 63
ReadX 13766 1834952 32824 32824
Close 13766
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13767
QUERY_FILE_INFORMATION 13767
ReadX 13767 0 512 512
ReadX 13767 512 512 512
ReadX 13767 1024 512 512
QUERY_FILE_INFORMATION 13767
QUERY_FILE_INFORMATION 13767
ReadX 13767 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13767
QUERY_FILE_INFORMATION 13767
ReadX 13767 512 4096 4096
QUERY_FILE_INFORMATION 13767
QUERY_FILE_INFORMATION 13767
QUERY_FILE_INFORMATION 13767
WriteX 13767 512 4096 4096
WriteX 13767 1024 512 512
ReadX 13767 502 512 512
QUERY_FILE_INFORMATION 13767
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13767 2560 512 512
ReadX 13767 1536 512 512
ReadX 13767 2176 384 384
ReadX 13767 3072 128 128
ReadX 13767 3107 512 512
ReadX 13767 3619 512 512
ReadX 13767 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13767 286 123 123
ReadX 13767 292 24 24
ReadX 13767 512 2048 2048
ReadX 13767 512 2048 2048
ReadX 13767 2560 2048 2048
ReadX 13767 416 1536 1536
ReadX 13767 768 512 512
ReadX 13767 1280 2048 2048
ReadX 13767 3328 2048 2048
ReadX 13767 5376 2048 2048
ReadX 13767 7424 2048 2048
ReadX 13767 9472 2048 2048
ReadX 13767 11520 2048 2048
ReadX 13767 13568 2048 2048
ReadX 13767 15616 2048 2048
ReadX 13767 17664 2048 2048
ReadX 13767 19712 2048 2048
ReadX 13767 21760 2048 2048
ReadX 13767 23808 2048 2048
ReadX 13767 25856 2048 2048
ReadX 13767 27904 2048 2048
ReadX 13767 29952 2048 2048
ReadX 13767 32000 2048 2048
ReadX 13767 34048 2048 2048
ReadX 13767 36096 2048 2048
ReadX 13767 38144 2048 2048
ReadX 13767 40192 2048 2048
ReadX 13767 42240 512 512
ReadX 13767 42752 2048 2048
ReadX 13767 44800 2048 2048
ReadX 13767 46848 2048 2048
ReadX 13767 48896 2048 2048
ReadX 13767 50944 2048 2048
ReadX 13767 52992 2048 2048
ReadX 13767 55040 2048 2048
ReadX 13767 57088 2048 2048
ReadX 13767 316 2048 2048
ReadX 13767 2364 2048 2048
ReadX 13767 4412 2048 2048
ReadX 13767 6460 2048 2048
ReadX 13767 8508 2048 2048
ReadX 13767 10556 2048 2048
ReadX 13767 12604 2048 2048
ReadX 13767 14652 2048 2048
ReadX 13767 16700 2048 2048
ReadX 13767 18748 2048 2048
ReadX 13767 20796 2048 2048
ReadX 13767 22844 2048 2048
ReadX 13767 24892 2048 2048
ReadX 13767 26940 2048 2048
ReadX 13767 28988 2048 2048
ReadX 13767 31036 2048 2048
ReadX 13767 436 2048 2048
ReadX 13767 2484 2048 2048
ReadX 13767 4532 2048 2048
ReadX 13767 6580 2048 2048
ReadX 13767 8628 2048 2048
ReadX 13767 10676 2048 2048
ReadX 13767 476 2048 2048
ReadX 13767 476 2048 2048
ReadX 13767 476 2048 2048
ReadX 13767 2524 2048 2048
ReadX 13767 484 2048 2048
ReadX 13767 484 2048 2048
ReadX 13767 484 2048 2048
ReadX 13767 2532 665 665
ReadX 13767 492 665 665
ReadX 13767 492 665 665
ReadX 13767 492 665 665
ReadX 13767 296 512 512
ReadX 13767 318 512 512
ReadX 13767 300 512 512
ReadX 13767 312 512 512
ReadX 13767 320 512 512
ReadX 13767 832 354 354
ReadX 13767 504 4096 4096
ReadX 13767 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13768
Close 13768
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13769
WriteX 13769 1535 1 1
QUERY_FILE_INFORMATION 13769
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13767 296 1251 1251
ReadX 13767 2176 384 384
ReadX 13767 3072 1634 1634
QUERY_FILE_INFORMATION 13769
WriteX 13769 0 57088 57088
WriteX 13769 0 4096 4096
Flush 13769
Close 13767
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13770
Close 13770
WriteX 13769 0 4096 4096
Close 13769
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13771
Close 13771
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13772
QUERY_FILE_INFORMATION 13772
ReadX 13772 0 512 512
ReadX 13772 512 512 512
ReadX 13772 1024 512 512
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
ReadX 13772 512 2048 2048
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13772 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13773
WriteX 13773 1535 1 1
QUERY_FILE_INFORMATION 13773
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13772 1536 512 512
ReadX 13772 288 1251 1251
ReadX 13772 2048 2018 2018
QUERY_FILE_INFORMATION 13773
WriteX 13773 0 51456 51456
WriteX 13773 0 4096 4096
Flush 13773
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
Close 13772
WriteX 13773 0 4096 4096
Close 13773
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13774
Close 13774
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13775
QUERY_FILE_INFORMATION 13775
ReadX 13775 0 512 512
ReadX 13775 512 512 512
ReadX 13775 1024 512 512
QUERY_FILE_INFORMATION 13775
QUERY_FILE_INFORMATION 13775
ReadX 13775 512 2048 2048
QUERY_FILE_INFORMATION 13775
QUERY_FILE_INFORMATION 13775
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13775 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13777
Close 13777
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13779
WriteX 13779 4045 1 1
QUERY_FILE_INFORMATION 13779
WriteX 13779 0 53077 53077
Close 13779
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13780
WriteX 13780 1535 1 1
QUERY_FILE_INFORMATION 13780
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13775 1536 512 512
ReadX 13775 288 1251 1251
ReadX 13775 2048 2018 2018
QUERY_FILE_INFORMATION 13780
WriteX 13780 0 65471 65471
WriteX 13780 65471 65 65
WriteX 13780 65536 1856 1856
WriteX 13780 0 4096 4096
Flush 13780
QUERY_FILE_INFORMATION 13775
QUERY_FILE_INFORMATION 13775
Close 13775
WriteX 13780 0 4096 4096
Close 13780
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13781
Close 13781
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13782
QUERY_FILE_INFORMATION 13782
ReadX 13782 0 512 512
ReadX 13782 512 512 512
ReadX 13782 1024 512 512
QUERY_FILE_INFORMATION 13782
QUERY_FILE_INFORMATION 13782
ReadX 13782 576 2048 2048
QUERY_FILE_INFORMATION 13782
QUERY_FILE_INFORMATION 13782
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13784
Close 13784
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13786
WriteX 13786 4076 1 1
QUERY_FILE_INFORMATION 13786
WriteX 13786 0 7983 7983
Close 13786
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13788
Close 13788
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13790
WriteX 13790 4095 1 1
QUERY_FILE_INFORMATION 13790
WriteX 13790 0 65471 65471
WriteX 13790 65471 65 65
WriteX 13790 65536 65471 65471
WriteX 13790 131007 65 65
WriteX 13790 131072 65471 65471
WriteX 13790 196543 65 65
WriteX 13790 196608 65471 65471
WriteX 13790 262079 65 65
WriteX 13790 262144 65471 65471
WriteX 13790 327615 65 65
WriteX 13790 327680 65471 65471
WriteX 13790 393151 65 65
WriteX 13790 393216 65471 65471
WriteX 13790 458687 65 65
WriteX 13790 458752 46731 46731
Close 13790
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13791
WriteX 13791 1535 1 1
QUERY_FILE_INFORMATION 13791
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13782 1536 512 512
ReadX 13782 2048 2018 2018
ReadX 13782 4096 512 512
ReadX 13782 4608 2197 2197
QUERY_FILE_INFORMATION 13791
WriteX 13791 0 65471 65471
WriteX 13791 65471 65 65
WriteX 13791 65536 22848 22848
WriteX 13791 0 4096 4096
Flush 13791
QUERY_FILE_INFORMATION 13782
QUERY_FILE_INFORMATION 13782
Close 13782
WriteX 13791 0 4096 4096
Close 13791
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13792
Close 13792
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13793
QUERY_FILE_INFORMATION 13793
ReadX 13793 0 512 512
ReadX 13793 512 512 512
ReadX 13793 1024 512 512
QUERY_FILE_INFORMATION 13793
QUERY_FILE_INFORMATION 13793
ReadX 13793 576 2048 2048
QUERY_FILE_INFORMATION 13793
QUERY_FILE_INFORMATION 13793
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 4096 512 512
Close 13793
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13794
QUERY_FILE_INFORMATION 13794
ReadX 13794 0 512 512
ReadX 13794 512 512 512
ReadX 13794 1024 512 512
QUERY_FILE_INFORMATION 13794
QUERY_FILE_INFORMATION 13794
ReadX 13794 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13794
QUERY_FILE_INFORMATION 13794
ReadX 13794 288 4096 4096
QUERY_FILE_INFORMATION 13794
QUERY_FILE_INFORMATION 13794
QUERY_FILE_INFORMATION 13794
WriteX 13794 288 4096 4096
WriteX 13794 1024 512 512
ReadX 13794 1536 512 512
QUERY_FILE_INFORMATION 13794
ReadX 13794 288 2048 2048
ReadX 13794 2336 2048 2048
ReadX 13794 3072 1536 1536
ReadX 13794 544 512 512
ReadX 13794 1056 2048 2048
ReadX 13794 3104 2048 2048
ReadX 13794 5152 2048 2048
ReadX 13794 7200 2048 2048
ReadX 13794 9248 2048 2048
ReadX 13794 11296 2048 2048
ReadX 13794 13344 2048 2048
ReadX 13794 15392 2048 2048
ReadX 13794 17440 2048 2048
ReadX 13794 19488 2048 2048
ReadX 13794 21536 2048 2048
ReadX 13794 23584 2048 2048
ReadX 13794 25632 2048 2048
ReadX 13794 27680 2048 2048
ReadX 13794 29728 2048 2048
ReadX 13794 31776 2048 2048
ReadX 13794 33824 2048 2048
ReadX 13794 35872 2048 2048
ReadX 13794 37920 2048 2048
ReadX 13794 39968 2048 2048
ReadX 13794 42016 512 512
ReadX 13794 42528 512 512
ReadX 13794 43040 1536 1536
ReadX 13794 44576 2048 2048
ReadX 13794 46624 2048 2048
ReadX 13794 48672 2048 2048
ReadX 13794 50720 2048 2048
ReadX 13794 52768 2048 2048
ReadX 13794 54816 2048 2048
ReadX 13794 56864 2048 2048
ReadX 13794 58912 2048 2048
ReadX 13794 60960 2048 2048
ReadX 13794 63008 2048 2048
ReadX 13794 65056 2048 2048
ReadX 13794 67104 2048 2048
ReadX 13794 69152 2048 2048
ReadX 13794 71200 2048 2048
ReadX 13794 73248 2048 2048
ReadX 13794 75296 2048 2048
ReadX 13794 77344 2048 2048
ReadX 13794 79392 2048 2048
ReadX 13794 81440 2048 2048
ReadX 13794 83488 2048 2048
ReadX 13794 85536 512 512
ReadX 13794 86048 512 512
ReadX 13794 86560 1536 1536
ReadX 13794 88096 2048 2048
ReadX 13794 90144 2048 2048
ReadX 13794 92192 2048 2048
ReadX 13794 94240 2048 2048
ReadX 13794 96288 2048 2048
ReadX 13794 552 2048 2048
ReadX 13794 2600 2048 2048
ReadX 13794 4648 2048 2048
ReadX 13794 6696 2048 2048
ReadX 13794 8744 2048 2048
ReadX 13794 10792 2048 2048
ReadX 13794 12840 2048 2048
ReadX 13794 14888 2048 2048
ReadX 13794 16936 2048 2048
ReadX 13794 18984 2048 2048
ReadX 13794 21032 2048 2048
ReadX 13794 23080 2048 2048
ReadX 13794 25128 2048 2048
ReadX 13794 27176 2048 2048
ReadX 13794 29224 2048 2048
ReadX 13794 31272 2048 2048
ReadX 13794 33320 2048 2048
ReadX 13794 35368 2048 2048
ReadX 13794 37416 2048 2048
ReadX 13794 39464 2048 2048
ReadX 13794 41512 512 512
ReadX 13794 42024 512 512
ReadX 13794 42536 1536 1536
ReadX 13794 44072 2048 2048
ReadX 13794 46120 2048 2048
ReadX 13794 48168 2048 2048
ReadX 13794 50216 2048 2048
ReadX 13794 52264 2048 2048
ReadX 13794 54312 2048 2048
ReadX 13794 56360 2048 2048
ReadX 13794 58408 2048 2048
ReadX 13794 60456 2048 2048
ReadX 13794 62504 2048 2048
ReadX 13794 64552 2048 2048
ReadX 13794 66600 2048 2048
ReadX 13794 68648 2048 2048
ReadX 13794 70696 2048 2048
ReadX 13794 72744 2048 2048
ReadX 13794 74792 2048 2048
ReadX 13794 76840 2048 2048
ReadX 13794 78888 2048 2048
ReadX 13794 80936 2048 2048
ReadX 13794 82984 2048 2048
ReadX 13794 85032 512 512
ReadX 13794 85544 2048 2048
ReadX 13794 87592 2048 2048
ReadX 13794 89640 2048 2048
ReadX 13794 91688 2048 2048
ReadX 13794 93736 2048 2048
ReadX 13794 95784 2048 2048
ReadX 13794 97832 2048 2048
ReadX 13794 99880 2048 2048
ReadX 13794 101928 2048 2048
ReadX 13794 103976 2048 2048
ReadX 13794 106024 2048 2048
ReadX 13794 108072 2048 2048
ReadX 13794 110120 2048 2048
ReadX 13794 112168 2048 2048
ReadX 13794 114216 2048 2048
ReadX 13794 116264 2048 2048
ReadX 13794 118312 2048 2048
ReadX 13794 120360 2048 2048
ReadX 13794 122408 2048 2048
ReadX 13794 124456 512 512
ReadX 13794 124968 512 512
ReadX 13794 125480 1536 1536
ReadX 13794 127016 2048 2048
ReadX 13794 129064 2048 2048
ReadX 13794 131112 2048 2048
ReadX 13794 133160 2048 2048
ReadX 13794 135208 2048 2048
ReadX 13794 137256 2048 2048
ReadX 13794 139304 2048 2048
ReadX 13794 141352 2048 2048
ReadX 13794 143400 2048 2048
ReadX 13794 145448 2048 2048
ReadX 13794 147496 2048 2048
ReadX 13794 149544 2048 2048
ReadX 13794 151592 2048 2048
ReadX 13794 153640 2048 2048
ReadX 13794 155688 2048 2048
ReadX 13794 157736 2048 2048
ReadX 13794 159784 2048 2048
ReadX 13794 161832 2048 2048
ReadX 13794 163880 2048 2048
ReadX 13794 165928 2048 2048
ReadX 13794 167976 2048 2048
ReadX 13794 170024 512 512
ReadX 13794 1538 1536 1536
ReadX 13794 3074 2048 2048
ReadX 13794 5122 2048 2048
ReadX 13794 7170 2048 2048
ReadX 13794 9218 2048 2048
ReadX 13794 11266 2048 2048
ReadX 13794 13314 2048 2048
ReadX 13794 15362 2048 2048
ReadX 13794 17410 2048 2048
ReadX 13794 19458 2048 2048
ReadX 13794 21506 2048 2048
ReadX 13794 23554 2048 2048
ReadX 13794 25602 2048 2048
ReadX 13794 27650 2048 2048
ReadX 13794 29698 2048 2048
ReadX 13794 31746 2048 2048
ReadX 13794 33794 2048 2048
ReadX 13794 35842 2048 2048
ReadX 13794 37890 2048 2048
ReadX 13794 39938 2048 2048
ReadX 13794 41986 2048 2048
ReadX 13794 44034 875 875
ReadX 13794 1730 4096 4096
ReadX 13794 1724 1536 1536
ReadX 13794 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13795
Close 13795
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13796
WriteX 13796 2047 1 1
QUERY_FILE_INFORMATION 13796
Close 13794
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13797
Close 13797
WriteX 13796 0 42388 42388
Close 13796
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13798
Close 13798
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13799
QUERY_FILE_INFORMATION 13799
ReadX 13799 0 512 512
ReadX 13799 1756 512 512
ReadX 13799 2268 512 512
QUERY_FILE_INFORMATION 13799
QUERY_FILE_INFORMATION 13799
ReadX 13799 1744 512 512
ReadX 13799 2256 512 512
ReadX 13799 2768 512 512
ReadX 13799 3280 512 512
ReadX 13799 3792 512 512
ReadX 13799 4304 512 512
ReadX 13799 512 2048 2048
QUERY_FILE_INFORMATION 13799
QUERY_FILE_INFORMATION 13799
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13800
WriteX 13800 2047 1 1
QUERY_FILE_INFORMATION 13800
QUERY_FILE_INFORMATION 13799
QUERY_FILE_INFORMATION 13799
Close 13799
WriteX 13800 0 42652 42652
Close 13800
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13801
Close 13801
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13802
QUERY_FILE_INFORMATION 13802
ReadX 13802 0 512 512
ReadX 13802 1762 512 512
ReadX 13802 2274 512 512
QUERY_FILE_INFORMATION 13802
QUERY_FILE_INFORMATION 13802
ReadX 13802 1750 512 512
ReadX 13802 2262 512 512
ReadX 13802 2774 512 512
ReadX 13802 3286 512 512
ReadX 13802 3798 512 512
ReadX 13802 4310 512 512
ReadX 13802 512 2048 2048
QUERY_FILE_INFORMATION 13802
QUERY_FILE_INFORMATION 13802
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13804
Close 13804
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13806
WriteX 13806 4080 1 1
QUERY_FILE_INFORMATION 13806
WriteX 13806 0 65471 65471
WriteX 13806 65471 65 65
WriteX 13806 65536 49 49
Close 13806
Close 13802
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13807
WriteX 13807 0 65471 65471
WriteX 13807 65471 63 63
WriteX 13807 65534 65471 65471
WriteX 13807 131005 63 63
Close 13807
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13808
WriteX 13808 0 65471 65471
WriteX 13808 65471 63 63
WriteX 13808 65534 65471 65471
WriteX 13808 131005 63 63
WriteX 13808 131068 65471 65471
WriteX 13808 196539 63 63
WriteX 13808 196602 65471 65471
WriteX 13808 262073 63 63
Close 13808
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13809
WriteX 13809 0 65471 65471
WriteX 13809 65471 63 63
WriteX 13809 65534 65471 65471
WriteX 13809 131005 63 63
WriteX 13809 131068 65471 65471
WriteX 13809 196539 63 63
WriteX 13809 196602 65471 65471
WriteX 13809 262073 63 63
WriteX 13809 262136 65471 65471
WriteX 13809 327607 63 63
WriteX 13809 327670 65471 65471
WriteX 13809 393141 63 63
WriteX 13809 393204 65471 65471
WriteX 13809 458675 63 63
WriteX 13809 458738 65471 65471
WriteX 13809 524209 63 63
Close 13809
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13810
Close 13810
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13811
Close 13811
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13814
Close 13814
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13816
Close 13816
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13817
Close 13817
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13820
Close 13820
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13822
Close 13822
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13823
Close 13823
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13826
Close 13826
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13830
Close 13830
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13834
Close 13834
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13838
Close 13838
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13842
Close 13842
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13846
Close 13846
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13850
Close 13850
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13854
Close 13854
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13856
Close 13856
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13858
Close 13858
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13860
WriteX 13860 4095 1 1
QUERY_FILE_INFORMATION 13860
QUERY_FS_INFORMATION 259
WriteX 13860 0 65471 65471
WriteX 13860 65471 65 65
WriteX 13860 65536 65471 65471
WriteX 13860 131007 65 65
WriteX 13860 131072 65471 65471
WriteX 13860 196543 65 65
WriteX 13860 196608 65471 65471
WriteX 13860 262079 65 65
WriteX 13860 262144 26634 26634
Close 13860
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
Close 13865
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13866
Close 13866
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13867
Close 13867
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13868
QUERY_FILE_INFORMATION 13868
ReadX 13868 0 512 512
ReadX 13868 288 512 512
ReadX 13868 800 512 512
Close 13868
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13869
ReadX 13869 0 24 24
Close 13869
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13870
ReadX 13870 0 24 24
Close 13870
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13871
QUERY_FILE_INFORMATION 13871
ReadX 13871 0 512 512
ReadX 13871 288 512 512
ReadX 13871 800 512 512
ReadX 13871 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13871 1759 2849 2849
Close 13871
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13872
Close 13872
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13875
Close 13875
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13877
Close 13877
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13878
Close 13878
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13881
Close 13881
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13883
Close 13883
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13884
Close 13884
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13887
Close 13887
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13891
Close 13891
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13895
Close 13895
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13899
Close 13899
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13903
Close 13903
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13907
Close 13907
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13910
Close 13910
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13914
Close 13914
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13918
Close 13918
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13920
Close 13920
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13921
Close 13921
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13930
QUERY_FILE_INFORMATION 13930
QUERY_FILE_INFORMATION 13930
Close 13930
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13931
Close 13931
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13932
Close 13932
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13933
QUERY_FILE_INFORMATION 13933
ReadX 13933 0 512 512
ReadX 13933 288 512 512
ReadX 13933 800 512 512
Close 13933
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13934
ReadX 13934 0 24 24
Close 13934
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13935
QUERY_FILE_INFORMATION 13935
ReadX 13935 0 512 512
ReadX 13935 288 512 512
ReadX 13935 800 512 512
ReadX 13935 512 36 36
Close 13935
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13936
QUERY_FILE_INFORMATION 13936
ReadX 13936 0 512 512
ReadX 13936 288 512 512
ReadX 13936 800 512 512
ReadX 13936 512 682 682
ReadX 13936 3584 106 106
ReadX 13936 3712 10 10
ReadX 13936 3722 10 10
ReadX 13936 512 2048 2048
ReadX 13936 3072 512 512
ReadX 13936 276 84 84
ReadX 13936 273 49 49
ReadX 13936 2560 512 512
Close 13936
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13946
QUERY_FILE_INFORMATION 13946
QUERY_FILE_INFORMATION 13946
Close 13946
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13947
Close 13947
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13948
Close 13948
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13949
QUERY_FILE_INFORMATION 13949
ReadX 13949 0 512 512
ReadX 13949 288 512 512
ReadX 13949 800 512 512
Close 13949
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13950
ReadX 13950 0 24 24
Close 13950
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13951
QUERY_FILE_INFORMATION 13951
ReadX 13951 0 512 512
ReadX 13951 288 512 512
ReadX 13951 800 512 512
ReadX 13951 512 36 36
Close 13951
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13952
QUERY_FILE_INFORMATION 13952
ReadX 13952 0 512 512
ReadX 13952 288 512 512
ReadX 13952 800 512 512
ReadX 13952 512 682 682
ReadX 13952 3072 106 106
ReadX 13952 3200 10 10
ReadX 13952 3210 10 10
ReadX 13952 512 2048 2048
ReadX 13952 2560 512 512
ReadX 13952 3887 84 84
ReadX 13952 3838 49 49
ReadX 13952 2048 512 512
Close 13952
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13953
Close 13953
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13954
QUERY_FILE_INFORMATION 13954
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 13954
QUERY_FILE_INFORMATION 13954
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13955
QUERY_FILE_INFORMATION 13955
QUERY_FILE_INFORMATION 13955
QUERY_FILE_INFORMATION 13955
ReadX 13955 2156 24 24
ReadX 13955 2139 276 276
ReadX 13955 2136 14 14
ReadX 13955 2136 7 7
ReadX 13955 2138 12 12
ReadX 13955 2137 8 8
ReadX 13955 2135 15 15
ReadX 13955 0 16 16
ReadX 13955 16 2048 2048
ReadX 13955 2064 2048 2048
ReadX 13955 257 2048 2048
ReadX 13955 385 2048 2048
ReadX 13955 513 2048 2048
ReadX 13955 641 2048 2048
ReadX 13955 769 2048 2048
ReadX 13955 897 2048 2048
ReadX 13955 1025 2048 2048
ReadX 13955 1153 2048 2048
ReadX 13955 1281 2048 2048
ReadX 13955 1409 2048 2048
ReadX 13955 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13957
Close 13957
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13959
WriteX 13959 15 1 1
QUERY_FILE_INFORMATION 13959
WriteX 13959 0 10575 10575
Flush 13959
Close 13959
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13960
Close 13960
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13961
QUERY_FILE_INFORMATION 13961
QUERY_FILE_INFORMATION 13961
QUERY_FILE_INFORMATION 13961
ReadX 13961 2157 24 24
ReadX 13961 2139 276 276
ReadX 13961 2137 14 14
ReadX 13961 2137 7 7
ReadX 13961 2139 12 12
ReadX 13961 2138 8 8
ReadX 13961 2136 15 15
Close 13955
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13962
Close 13962
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13963
QUERY_FILE_INFORMATION 13963
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13964
QUERY_FILE_INFORMATION 13964
ReadX 13964 0 512 512
ReadX 13964 512 512 512
ReadX 13964 1024 512 512
QUERY_FILE_INFORMATION 13964
QUERY_FILE_INFORMATION 13964
Close 13964
QUERY_FILE_INFORMATION 13963
ReadX 13963 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13965
QUERY_FILE_INFORMATION 13965
ReadX 13965 0 512 512
ReadX 13965 512 512 512
ReadX 13965 1024 512 512
ReadX 13965 288 20 20
ReadX 13965 308 2084 2084
ReadX 13965 388 2084 2084
ReadX 13965 388 2084 2084
ReadX 13954 2157 1386 1386
ReadX 13965 2472 399 399
ReadX 13965 3072 1536 1536
ReadX 13965 544 149 149
ReadX 13965 693 485 485
Close 13965
ReadX 13954 2157 4096 4096
ReadX 13954 6253 4096 4096
ReadX 13954 10349 4096 4096
ReadX 13954 14445 4096 4096
ReadX 13954 18541 4096 4096
ReadX 13954 22637 256 256
ReadX 13954 22893 4096 4096
ReadX 13954 26989 4096 4096
ReadX 13954 31085 4096 4096
ReadX 13954 35181 4096 4096
ReadX 13954 39277 4096 4096
ReadX 13954 43373 4096 4096
ReadX 13954 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13954 2157 1024 1024
ReadX 13954 1667 4688 4688
ReadX 13954 6355 3516 3516
ReadX 13954 9871 16384 16384
ReadX 13954 26255 3771 3771
ReadX 13954 30026 2048 2048
ReadX 13954 32074 1024 1024
ReadX 13954 33098 6652 6652
ReadX 13954 39750 16384 16384
ReadX 13954 56134 10496 10496
ReadX 13954 66630 1784 1784
ReadX 13954 68414 90 90
ReadX 13954 68504 273 273
ReadX 13954 68777 1600 1600
ReadX 13954 70377 640 640
ReadX 13954 71017 1280 1280
ReadX 13954 72297 8464 8464
ReadX 13954 80761 158 158
ReadX 13954 80919 912 912
ReadX 13954 81831 1980 1980
ReadX 13954 83811 2256 2256
ReadX 13954 86067 400 400
ReadX 13954 86467 252 252
ReadX 13954 86719 42 42
ReadX 13954 86761 725 725
ReadX 13954 2009 512 512
ReadX 13954 3895 9 9
ReadX 13954 3781 46 46
ReadX 13954 4059 92 92
ReadX 13954 3781 92 92
ReadX 13954 3986 184 184
ReadX 13954 3987 16384 16384
ReadX 13954 3902 16384 16384
ReadX 13954 3781 10240 10240
ReadX 13954 3821 16384 16384
ReadX 13954 3891 935 935
ReadX 13954 4060 10240 10240
ReadX 13954 4059 184 184
ReadX 13954 256 184 184
ReadX 13954 256 1026 1026
ReadX 13954 3901 326 326
ReadX 13954 3899 652 652
ReadX 13954 256 2 2
ReadX 13954 258 4948 4948
Close 13954
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13967
Close 13967
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13969
WriteX 13969 4055 1 1
QUERY_FILE_INFORMATION 13969
WriteX 13969 0 65471 65471
WriteX 13969 65471 65 65
WriteX 13969 65536 65471 65471
WriteX 13969 131007 65 65
WriteX 13969 131072 65471 65471
WriteX 13969 196543 65 65
WriteX 13969 196608 65471 65471
WriteX 13969 262079 65 65
WriteX 13969 262144 65471 65471
WriteX 13969 327615 65 65
WriteX 13969 327680 65471 65471
WriteX 13969 393151 65 65
WriteX 13969 393216 65471 65471
WriteX 13969 458687 65 65
WriteX 13969 458752 65471 65471
WriteX 13969 524223 65 65
WriteX 13969 524288 65471 65471
WriteX 13969 589759 65 65
WriteX 13969 589824 35257 35257
Close 13969
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13971
Close 13971
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13973
WriteX 13973 4055 1 1
QUERY_FILE_INFORMATION 13973
WriteX 13973 0 65471 65471
WriteX 13973 65471 65 65
WriteX 13973 65536 65471 65471
WriteX 13973 131007 65 65
WriteX 13973 131072 65471 65471
WriteX 13973 196543 65 65
WriteX 13973 196608 65471 65471
WriteX 13973 262079 65 65
WriteX 13973 262144 65471 65471
WriteX 13973 327615 65 65
WriteX 13973 327680 65471 65471
WriteX 13973 393151 65 65
WriteX 13973 393216 65471 65471
WriteX 13973 458687 65 65
WriteX 13973 458752 65471 65471
WriteX 13973 524223 65 65
WriteX 13973 524288 65471 65471
WriteX 13973 589759 65 65
WriteX 13973 589824 57598 57598
Close 13973
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13975
WriteX 13975 15 1 1
QUERY_FILE_INFORMATION 13975
WriteX 13975 0 12543 12543
Flush 13975
Close 13975
Close 13961
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13976
Close 13976
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13977
QUERY_FILE_INFORMATION 13977
QUERY_FILE_INFORMATION 13977
QUERY_FILE_INFORMATION 13977
ReadX 13977 288 24 24
ReadX 13977 287 276 276
ReadX 13977 286 14 14
ReadX 13977 286 7 7
ReadX 13977 287 12 12
ReadX 13977 287 8 8
ReadX 13977 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13978
Close 13978
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13979
QUERY_FILE_INFORMATION 13979
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 13979
QUERY_FILE_INFORMATION 13979
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13980
QUERY_FILE_INFORMATION 13980
QUERY_FILE_INFORMATION 13980
QUERY_FILE_INFORMATION 13980
ReadX 13980 1938 24 24
ReadX 13980 1920 276 276
ReadX 13980 1918 14 14
ReadX 13980 1918 7 7
ReadX 13980 1919 12 12
ReadX 13980 1919 8 8
ReadX 13980 1917 15 15
ReadX 13980 0 16 16
ReadX 13980 16 2048 2048
ReadX 13980 2064 2048 2048
ReadX 13980 257 2048 2048
ReadX 13980 385 2048 2048
ReadX 13980 513 2048 2048
ReadX 13980 641 2048 2048
ReadX 13980 769 2048 2048
ReadX 13980 897 2048 2048
ReadX 13980 1025 2048 2048
ReadX 13980 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13982
Close 13982
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13984
WriteX 13984 15 1 1
QUERY_FILE_INFORMATION 13984
WriteX 13984 0 11588 11588
Flush 13984
Close 13984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13985
Close 13985
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13986
QUERY_FILE_INFORMATION 13986
QUERY_FILE_INFORMATION 13986
QUERY_FILE_INFORMATION 13986
ReadX 13986 1909 24 24
ReadX 13986 1892 276 276
ReadX 13986 1889 14 14
ReadX 13986 1889 7 7
ReadX 13986 1891 12 12
ReadX 13986 1890 8 8
ReadX 13986 1888 15 15
Close 13980
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13988
WriteX 13988 15 1 1
QUERY_FILE_INFORMATION 13988
WriteX 13988 0 11615 11615
Flush 13988
Close 13988
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13986
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13989
Close 13989
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13990
QUERY_FILE_INFORMATION 13990
QUERY_FILE_INFORMATION 13990
QUERY_FILE_INFORMATION 13990
ReadX 13990 1947 24 24
ReadX 13990 1929 276 276
ReadX 13990 1927 14 14
ReadX 13990 1927 7 7
ReadX 13990 1929 12 12
ReadX 13990 1928 8 8
ReadX 13990 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13992
Close 13992
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13994
WriteX 13994 4088 1 1
QUERY_FILE_INFORMATION 13994
WriteX 13994 0 65471 65471
WriteX 13994 65471 65 65
WriteX 13994 65536 16050 16050
Close 13994
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13979 1939 64 64
ReadX 13979 128 248 248
ReadX 13979 128 568 568
ReadX 13979 3872 1536 1536
ReadX 13979 3456 2560 2560
ReadX 13979 3136 512 512
ReadX 13979 2880 4096 4096
ReadX 13979 3264 3072 3072
ReadX 13979 320 4096 4096
ReadX 13979 1024 4096 4096
ReadX 13979 3616 4096 4096
ReadX 13979 1939 64 64
ReadX 13979 128 248 248
ReadX 13979 128 608 608
ReadX 13979 2858 1024 1024
ReadX 13979 2810 4096 4096
ReadX 13979 2826 4096 4096
ReadX 13979 2580 2048 2048
ReadX 13979 2800 2560 2560
ReadX 13979 2100 4096 4096
ReadX 13979 2084 4096 4096
ReadX 13979 868 4096 4096
ReadX 13979 2324 4096 4096
ReadX 13979 884 4096 4096
ReadX 13979 2604 1024 1024
ReadX 13979 580 4096 4096
ReadX 13979 596 4096 4096
ReadX 13979 2752 4096 4096
ReadX 13979 2842 1024 1024
ReadX 13979 660 4096 4096
ReadX 13979 2720 4096 4096
ReadX 13979 2736 4096 4096
ReadX 13979 628 4096 4096
ReadX 13979 2704 4096 4096
ReadX 13979 1556 4096 4096
ReadX 13979 576 4096 4096
ReadX 13979 3168 1536 1536
ReadX 13979 832 4096 4096
ReadX 13979 1088 4096 4096
ReadX 13979 1344 4096 4096
ReadX 13979 1600 4096 4096
ReadX 13979 1856 4096 4096
ReadX 13979 2112 4096 4096
ReadX 13979 1892 4096 4096
ReadX 13979 820 4096 4096
ReadX 13979 788 4096 4096
ReadX 13979 1604 4096 4096
ReadX 13979 3648 4096 4096
ReadX 13979 2608 4096 4096
ReadX 13979 548 4096 4096
ReadX 13979 740 4096 4096
ReadX 13979 1344 4096 4096
ReadX 13979 3392 4096 4096
ReadX 13979 3904 4096 4096
ReadX 13979 644 4096 4096
ReadX 13979 676 4096 4096
ReadX 13979 2688 4096 4096
ReadX 13979 320 4096 4096
ReadX 13979 900 4096 4096
ReadX 13979 1908 4096 4096
ReadX 13979 852 4096 4096
ReadX 13979 724 4096 4096
ReadX 13979 2292 4096 4096
ReadX 13979 612 4096 4096
ReadX 13979 388 4096 4096
ReadX 13979 2368 4096 4096
ReadX 13979 2624 4096 4096
ReadX 13979 500 4096 4096
ReadX 13979 356 4096 4096
ReadX 13979 1024 4096 4096
ReadX 13979 576 4096 4096
ReadX 13979 340 4096 4096
ReadX 13979 420 4096 4096
ReadX 13979 1600 4096 4096
ReadX 13979 404 4096 4096
ReadX 13979 1428 4096 4096
ReadX 13979 2656 4096 4096
ReadX 13979 2624 4096 4096
ReadX 13979 452 4096 4096
ReadX 13979 692 4096 4096
ReadX 13979 564 4096 4096
ReadX 13979 372 4096 4096
ReadX 13979 468 4096 4096
ReadX 13979 484 4096 4096
ReadX 13979 1088 4096 4096
ReadX 13979 1924 4096 4096
ReadX 13979 2768 4096 4096
ReadX 13979 832 4096 4096
ReadX 13979 836 4096 4096
ReadX 13979 1856 4096 4096
ReadX 13979 2640 4096 4096
ReadX 13979 436 4096 4096
ReadX 13979 1828 4096 4096
ReadX 13979 804 4096 4096
ReadX 13979 1860 4096 4096
ReadX 13979 1812 4096 4096
ReadX 13979 756 4096 4096
ReadX 13979 1636 4096 4096
ReadX 13979 772 4096 4096
ReadX 13979 2036 4096 4096
ReadX 13979 1220 4096 4096
ReadX 13979 1652 4096 4096
ReadX 13979 2588 4096 4096
ReadX 13979 916 4096 4096
ReadX 13979 260 4096 4096
ReadX 13979 932 4096 4096
ReadX 13979 2624 4096 4096
ReadX 13979 308 4096 4096
ReadX 13979 292 4096 4096
ReadX 13979 1140 4096 4096
ReadX 13979 276 4096 4096
ReadX 13979 2020 4096 4096
ReadX 13979 2880 4096 4096
ReadX 13979 516 4096 4096
ReadX 13979 1844 4096 4096
ReadX 13979 1124 4096 4096
ReadX 13979 3136 4096 4096
ReadX 13979 324 4096 4096
ReadX 13979 1156 4096 4096
ReadX 13979 1172 4096 4096
ReadX 13979 2112 4096 4096
ReadX 13979 2368 4096 4096
ReadX 13979 964 4096 4096
ReadX 13979 980 4096 4096
ReadX 13979 1012 4096 4096
ReadX 13979 532 4096 4096
ReadX 13979 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13979 1620 4096 4096
ReadX 13979 1604 4096 4096
ReadX 13979 2116 4096 4096
ReadX 13979 2132 4096 4096
ReadX 13979 2148 4096 4096
ReadX 13979 2276 4096 4096
ReadX 13979 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13996
Close 13996
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13998
QUERY_FILE_INFORMATION 13963
WriteX 13998 4088 1 1
QUERY_FILE_INFORMATION 13998
QUERY_FILE_INFORMATION 13963
Close 13963
WriteX 13998 0 65471 65471
WriteX 13998 65471 65 65
WriteX 13998 65536 64850 64850
Close 13998
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 14000
WriteX 14000 15 1 1
QUERY_FILE_INFORMATION 14000
ReadX 13979 2068 4096 4096
ReadX 13979 1588 4096 4096
ReadX 13979 1572 4096 4096
WriteX 14000 0 18630 18630
Flush 14000
Close 14000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13990
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 14001
Close 14001
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 14002
QUERY_FILE_INFORMATION 14002
QUERY_FILE_INFORMATION 14002
QUERY_FILE_INFORMATION 14002
ReadX 14002 661 24 24
ReadX 14002 659 356 356
ReadX 14002 659 14 14
ReadX 14002 659 7 7
ReadX 14002 659 12 12
ReadX 14002 659 8 8
ReadX 14002 659 15 15
ReadX 14002 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13979 612 4096 4096
ReadX 13979 564 4096 4096
ReadX 13979 1876 4096 4096
ReadX 13979 628 4096 4096
ReadX 13979 740 4096 4096
ReadX 13979 724 4096 4096
ReadX 13979 644 4096 4096
ReadX 13979 2324 4096 4096
ReadX 13979 660 4096 4096
ReadX 13979 852 4096 4096
ReadX 13979 868 4096 4096
Close 14002
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 13977
ReadX 13979 2368 4096 4096
ReadX 13979 1024 4096 4096
ReadX 13979 320 4096 4096
ReadX 13979 580 4096 4096
ReadX 13979 3136 512 512
ReadX 13979 2880 4096 4096
Close 13979
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14003
WriteX 14003 0 65471 65471
WriteX 14003 65471 63 63
WriteX 14003 65534 65471 65471
WriteX 14003 131005 63 63
Close 14003
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14004
WriteX 14004 0 65471 65471
WriteX 14004 65471 63 63
WriteX 14004 65534 65471 65471
WriteX 14004 131005 63 63
WriteX 14004 131068 65471 65471
WriteX 14004 196539 63 63
WriteX 14004 196602 65471 65471
WriteX 14004 262073 63 63
Close 14004
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14005
WriteX 14005 0 65471 65471
WriteX 14005 65471 63 63
WriteX 14005 65534 65471 65471
WriteX 14005 131005 63 63
WriteX 14005 131068 65471 65471
WriteX 14005 196539 63 63
WriteX 14005 196602 65471 65471
WriteX 14005 262073 63 63
WriteX 14005 262136 65471 65471
WriteX 14005 327607 63 63
WriteX 14005 327670 65471 65471
WriteX 14005 393141 63 63
WriteX 14005 393204 65471 65471
WriteX 14005 458675 63 63
WriteX 14005 458738 65471 65471
WriteX 14005 524209 63 63
Close 14005
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14006
Close 14006
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14007
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14007 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14008
ReadX 14008 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14009
ReadX 14009 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14010
ReadX 14010 0 511 511
ReadX 14007 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14007
Close 14008
Close 14009
Close 14010
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14011
ReadX 14011 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14012
ReadX 14012 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14013
ReadX 14013 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14014
ReadX 14014 0 511 511
ReadX 14011 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 14015
FIND_FIRST \clients\client1\~dmtmp\*
Close 14015
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 14016
QUERY_FILE_INFORMATION 14016
WriteX 14016 2047 1 1
QUERY_FILE_INFORMATION 14016
WriteX 14016 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 14017
Close 14017
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 14018
WriteX 14018 52 1 1
QUERY_FILE_INFORMATION 14018
WriteX 14018 0 53 53
WriteX 14018 53 28 28
WriteX 14018 81 4 4
WriteX 14018 85 28 28
WriteX 14018 113 38 38
WriteX 14018 151 28 28
WriteX 14018 179 2 2
WriteX 14018 181 28 28
WriteX 14018 209 3 3
WriteX 14018 212 279 279
WriteX 14018 9 4 4
Close 14018
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 14019
ReadX 14019 0 53 53
ReadX 14019 53 28 28
ReadX 14019 81 4 4
ReadX 14019 85 28 28
ReadX 14019 113 38 38
ReadX 14019 151 28 28
ReadX 14019 179 2 2
ReadX 14019 181 28 28
ReadX 14019 209 3 3
Close 14019
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 14011
Close 14012
Close 14013
Close 14014
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14020
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14020 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14021
ReadX 14021 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14022
ReadX 14022 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14023
ReadX 14023 0 511 511
ReadX 14020 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 14025
Close 14025
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14026
WriteX 14026 52 1 1
QUERY_FILE_INFORMATION 14026
WriteX 14026 0 53 53
WriteX 14026 53 28 28
WriteX 14026 81 28 28
WriteX 14026 109 28 28
WriteX 14026 137 28 28
WriteX 14026 165 28 28
WriteX 14026 193 28 28
WriteX 14026 221 28 28
WriteX 14026 249 4 4
WriteX 14026 253 4 4
WriteX 14026 257 4 4
WriteX 14026 261 28 28
WriteX 14026 289 2 2
WriteX 14026 291 2 2
WriteX 14026 293 2 2
WriteX 14026 295 248 248
WriteX 14026 9 4 4
Close 14026
Close 14020
Close 14021
Close 14022
Close 14023
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14027
ReadX 14027 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14028
ReadX 14028 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14029
ReadX 14029 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14030
ReadX 14030 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14031
ReadX 14031 0 53 53
ReadX 14031 53 28 28
ReadX 14031 81 28 28
ReadX 14031 109 28 28
ReadX 14031 137 28 28
ReadX 14031 165 28 28
ReadX 14031 193 28 28
ReadX 14031 221 28 28
ReadX 14031 249 4 4
ReadX 14031 253 4 4
ReadX 14031 257 4 4
ReadX 14031 261 28 28
ReadX 14031 289 2 2
ReadX 14031 291 2 2
ReadX 14031 293 2 2
Close 14031
ReadX 14027 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14027
Close 14028
Close 14029
Close 14030
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 14016
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14032
Close 14032
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14033
ReadX 14033 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14034
ReadX 14034 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14035
ReadX 14035 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14036
ReadX 14036 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14037
ReadX 14037 0 53 53
ReadX 14037 53 28 28
ReadX 14037 81 28 28
ReadX 14037 109 28 28
ReadX 14037 137 28 28
ReadX 14037 165 28 28
ReadX 14037 193 28 28
ReadX 14037 221 28 28
ReadX 14037 249 4 4
ReadX 14037 253 4 4
ReadX 14037 257 4 4
ReadX 14037 261 28 28
ReadX 14037 289 2 2
ReadX 14037 291 2 2
ReadX 14037 293 2 2
Close 14037
ReadX 14033 2048 2048 2048
Close 14033
Close 14034
Close 14035
Close 14036
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14038
ReadX 14038 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14039
ReadX 14039 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14040
ReadX 14040 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14041
ReadX 14041 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14042
ReadX 14042 0 53 53
ReadX 14042 53 28 28
ReadX 14042 81 28 28
ReadX 14042 109 28 28
ReadX 14042 137 28 28
ReadX 14042 165 28 28
ReadX 14042 193 28 28
ReadX 14042 221 28 28
ReadX 14042 249 4 4
ReadX 14042 253 4 4
ReadX 14042 257 4 4
ReadX 14042 261 28 28
ReadX 14042 289 2 2
ReadX 14042 291 2 2
ReadX 14042 293 2 2
Close 14042
ReadX 14038 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 14046
FIND_FIRST \clients\client1\~dmtmp\*
Close 14046
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14047
QUERY_FILE_INFORMATION 14047
WriteX 14047 2047 1 1
QUERY_FILE_INFORMATION 14047
WriteX 14047 0 2048 2048
Close 14047
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14048
ReadX 14048 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 14048
Close 14038
Close 14039
Close 14040
Close 14041
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14049
ReadX 14049 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 14049 4095 1 1
QUERY_FILE_INFORMATION 14049
WriteX 14049 2048 2048 2048
QUERY_FILE_INFORMATION 14049
Flush 14049
WriteX 14049 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14050
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14050 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14051
ReadX 14051 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14052
ReadX 14052 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14053
ReadX 14053 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14054
ReadX 14054 0 53 53
ReadX 14054 53 28 28
ReadX 14054 81 28 28
ReadX 14054 109 28 28
ReadX 14054 137 28 28
ReadX 14054 165 28 28
ReadX 14054 193 28 28
ReadX 14054 221 28 28
ReadX 14054 249 4 4
ReadX 14054 253 4 4
ReadX 14054 257 4 4
ReadX 14054 261 28 28
ReadX 14054 289 2 2
ReadX 14054 291 2 2
ReadX 14054 293 2 2
Close 14054
ReadX 14050 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 14058
FIND_FIRST \clients\client1\~dmtmp\*
Close 14058
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14059
QUERY_FILE_INFORMATION 14059
WriteX 14059 2047 1 1
QUERY_FILE_INFORMATION 14059
WriteX 14059 0 2048 2048
Close 14059
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14060
ReadX 14060 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 14064
Close 14064
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14065
QUERY_FILE_INFORMATION 14065
WriteX 14065 2047 1 1
QUERY_FILE_INFORMATION 14065
WriteX 14065 0 2048 2048
Close 14065
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14066
ReadX 14066 0 511 511
ReadX 14050 384 2048 2048
ReadX 14050 768 16384 16384
ReadX 14050 1792 14336 14336
Close 14066
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14067
ReadX 14067 0 511 511
Close 14067
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 14069
Close 14069
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 14060 4095 1 1
QUERY_FILE_INFORMATION 14060
WriteX 14060 2048 2048 2048
WriteX 14060 0 88 88
Close 14060
WriteX 14050 1152 2048 2048
WriteX 14050 1408 6144 6144
WriteX 14050 1920 2048 2048
WriteX 14050 0 88 88
Close 14050
WriteX 14051 0 88 88
Close 14051
WriteX 14052 0 88 88
Close 14052
Close 14053
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 14070
ReadX 14070 0 511 511
ReadX 14070 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 14070
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 14071
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 14071 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 14072
ReadX 14072 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 14073
ReadX 14073 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 14074
ReadX 14074 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 14075
ReadX 14075 0 53 53
ReadX 14075 53 28 28
ReadX 14075 81 28 28
ReadX 14075 109 28 28
ReadX 14075 137 28 28
ReadX 14075 165 28 28
ReadX 14075 193 28 28
ReadX 14075 221 28 28
ReadX 14075 249 4 4
ReadX 14075 253 4 4
ReadX 14075 257 4 4
ReadX 14075 261 28 28
ReadX 14075 289 2 2
ReadX 14075 291 2 2
ReadX 14075 293 2 2
Close 14075
ReadX 14071 2048 2048 2048
Close 14071
Close 14072
Close 14073
Close 14074
Close 14049
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 14076
QUERY_FILE_INFORMATION 14076
Close 14076
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14077
Close 14077
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14078
ReadX 14078 0 511 511
ReadX 14078 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14079
ReadX 14079 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14080
ReadX 14080 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14081
ReadX 14081 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14082
ReadX 14082 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14083
ReadX 14083 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14084
ReadX 14084 0 53 53
ReadX 14084 53 2 2
ReadX 14084 55 2 2
ReadX 14084 57 184 184
ReadX 14084 241 298 298
Close 14084
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 14085
ReadX 14085 0 41 41
ReadX 14078 2048 2048 2048
Close 14085
Close 14078
Close 14079
Close 14082
Close 14083
Close 14080
Close 14081
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 14086
ReadX 14086 0 511 511
ReadX 14086 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 14087
ReadX 14087 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 14088
ReadX 14088 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 14089
ReadX 14089 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 14090
ReadX 14090 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 14091
ReadX 14091 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 14092
ReadX 14092 0 53 53
ReadX 14092 53 2 2
ReadX 14092 55 2 2
ReadX 14092 57 184 184
ReadX 14092 241 298 298
Close 14092
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 14093
ReadX 14093 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 14094
ReadX 14094 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 14095
ReadX 14095 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12514
ReadX 12514 0 511 511
ReadX 14095 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12515
ReadX 12515 0 53 53
ReadX 12515 53 2 2
ReadX 12515 55 480 480
ReadX 12515 535 2 2
Close 12515
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12516
ReadX 12516 0 41 41
ReadX 14086 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12520
FIND_FIRST \clients\client1\~dmtmp\*
Close 12520
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12521
QUERY_FILE_INFORMATION 12521
WriteX 12521 2047 1 1
QUERY_FILE_INFORMATION 12521
WriteX 12521 0 2048 2048
Close 12521
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12522
ReadX 12522 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12522
Close 14093
Close 14094
Close 14095
Close 12514
Close 12516
Close 14086
Close 14087
Close 14090
Close 14091
Close 14088
Close 14089
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12523
ReadX 12523 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12524
Close 12524
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12525
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12525 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12526
ReadX 12526 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12527
ReadX 12527 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12528
ReadX 12528 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12529
ReadX 12529 0 53 53
ReadX 12529 53 2 2
ReadX 12529 55 480 480
ReadX 12529 535 2 2
Close 12529
ReadX 12525 2048 2048 2048
Close 12525
Close 12526
Close 12527
Close 12528
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12530
ReadX 12530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12531
ReadX 12531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12532
ReadX 12532 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12533
ReadX 12533 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12534
ReadX 12534 0 53 53
ReadX 12534 53 2 2
ReadX 12534 55 480 480
ReadX 12534 535 2 2
Close 12534
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12535
ReadX 12535 0 511 511
ReadX 12535 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12536
ReadX 12536 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12537
ReadX 12537 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12538
ReadX 12538 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12539
ReadX 12539 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12540
ReadX 12540 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12541
ReadX 12541 0 41 41
ReadX 12535 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12542
ReadX 12542 0 53 53
ReadX 12542 53 2 2
ReadX 12542 55 2 2
ReadX 12542 57 184 184
ReadX 12542 241 298 298
Close 12542
ReadX 12530 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12546
FIND_FIRST \clients\client1\~dmtmp\*
Close 12546
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12547
QUERY_FILE_INFORMATION 12547
WriteX 12547 2047 1 1
QUERY_FILE_INFORMATION 12547
WriteX 12547 0 2048 2048
Close 12547
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12548
ReadX 12548 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12548
Close 12541
Close 12535
Close 12536
Close 12539
Close 12540
Close 12537
Close 12538
Close 12530
Close 12531
Close 12532
Close 12533
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12549
ReadX 12549 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12523 4095 1 1
QUERY_FILE_INFORMATION 12523
WriteX 12523 2048 2048 2048
QUERY_FILE_INFORMATION 12523
Flush 12523
WriteX 12523 0 88 88
WriteX 12549 4095 1 1
QUERY_FILE_INFORMATION 12549
WriteX 12549 2048 2048 2048
QUERY_FILE_INFORMATION 12549
Flush 12549
WriteX 12549 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12550
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12550 0 511 511
ReadX 12550 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12551
ReadX 12551 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12552
ReadX 12552 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12553
ReadX 12553 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12554
ReadX 12554 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12555
ReadX 12555 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12556
ReadX 12556 0 53 53
ReadX 12556 53 2 2
ReadX 12556 55 2 2
ReadX 12556 57 184 184
ReadX 12556 241 298 298
Close 12556
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12557
ReadX 12557 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12558
ReadX 12558 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12559
ReadX 12559 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12560
ReadX 12560 0 511 511
ReadX 12559 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12561
ReadX 12561 0 53 53
ReadX 12561 53 2 2
ReadX 12561 55 480 480
ReadX 12561 535 2 2
Close 12561
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12562
ReadX 12562 0 41 41
ReadX 12550 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12563
ReadX 12563 0 53 53
ReadX 12563 53 2 2
ReadX 12563 55 480 480
ReadX 12563 535 2 2
Close 12563
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12564
ReadX 12564 0 53 53
ReadX 12564 53 2 2
ReadX 12564 55 2 2
ReadX 12564 57 184 184
ReadX 12564 241 298 298
Close 12564
ReadX 12557 2048 2048 2048
ReadX 12558 2048 2048 2048
ReadX 12557 320 16384 16384
ReadX 12557 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12565
FIND_FIRST \clients\client1\~dmtmp\*
Close 12565
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12566
QUERY_FILE_INFORMATION 12566
WriteX 12566 4095 1 1
QUERY_FILE_INFORMATION 12566
WriteX 12566 0 4096 4096
Close 12566
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12567
ReadX 12567 0 41 41
Close 12557
Close 12558
Close 12559
Close 12560
Close 12562
Close 12550
Close 12551
Close 12554
Close 12555
Close 12552
Close 12553
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12568
Close 12568
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12569
QUERY_FILE_INFORMATION 12569
WriteX 12569 4095 1 1
QUERY_FILE_INFORMATION 12569
WriteX 12569 0 4096 4096
Close 12569
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12570
ReadX 12570 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 12567
ReadX 12567 0 4096 4096
WriteX 12570 0 4096 4096
Close 12570
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12572
ReadX 12572 0 41 41
Close 12567
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12572
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12573
Close 12573
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12574
ReadX 12574 0 41 41
Close 12574
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12575
Close 12575
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12576
QUERY_FILE_INFORMATION 12576
WriteX 12576 2047 1 1
QUERY_FILE_INFORMATION 12576
WriteX 12576 0 2048 2048
Close 12576
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12577
ReadX 12577 0 511 511
ReadX 12577 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12578
ReadX 12578 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12578
Close 12577
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12579
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12579 0 511 511
ReadX 12579 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12580
ReadX 12580 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12581
ReadX 12581 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12582
ReadX 12582 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12583
ReadX 12583 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12584
ReadX 12584 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12585
ReadX 12585 0 53 53
ReadX 12585 53 2 2
ReadX 12585 55 2 2
ReadX 12585 57 184 184
ReadX 12585 241 298 298
Close 12585
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12586
ReadX 12586 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12587
ReadX 12587 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12588
ReadX 12588 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12589
ReadX 12589 0 511 511
ReadX 12588 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12590
ReadX 12590 0 53 53
ReadX 12590 53 2 2
ReadX 12590 55 480 480
ReadX 12590 535 2 2
Close 12590
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12591
ReadX 12591 0 41 41
ReadX 12579 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12592
ReadX 12592 0 53 53
ReadX 12592 53 2 2
ReadX 12592 55 480 480
ReadX 12592 535 2 2
Close 12592
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12593
ReadX 12593 0 53 53
ReadX 12593 53 2 2
ReadX 12593 55 2 2
ReadX 12593 57 184 184
ReadX 12593 241 298 298
Close 12593
ReadX 12586 2048 2048 2048
Close 12586
Close 12587
Close 12588
Close 12589
Close 12591
Close 12579
Close 12580
Close 12583
Close 12584
Close 12581
Close 12582
Close 12523
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12594
QUERY_FILE_INFORMATION 12594
Close 12594
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12549
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12595
QUERY_FILE_INFORMATION 12595
Close 12595
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12596
Close 12596
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12597
ReadX 12597 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12598
ReadX 12598 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12599
ReadX 12599 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12600
ReadX 12600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12601
ReadX 12601 0 53 53
ReadX 12601 53 2 2
ReadX 12601 55 480 480
ReadX 12601 535 2 2
Close 12601
ReadX 12597 2048 2048 2048
Close 12597
Close 12598
Close 12599
Close 12600
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12602
ReadX 12602 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12603
ReadX 12603 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12604
ReadX 12604 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12605
ReadX 12605 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12606
ReadX 12606 0 53 53
ReadX 12606 53 2 2
ReadX 12606 55 480 480
ReadX 12606 535 2 2
Close 12606
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12607
ReadX 12607 0 511 511
ReadX 12607 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12608
ReadX 12608 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12609
ReadX 12609 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12610
ReadX 12610 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12611
ReadX 12611 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12612
ReadX 12612 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12613
ReadX 12613 0 41 41
ReadX 12607 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12614
ReadX 12614 0 53 53
ReadX 12614 53 2 2
ReadX 12614 55 2 2
ReadX 12614 57 184 184
ReadX 12614 241 298 298
Close 12614
ReadX 12602 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12618
FIND_FIRST \clients\client1\~dmtmp\*
Close 12618
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12619
QUERY_FILE_INFORMATION 12619
WriteX 12619 2047 1 1
QUERY_FILE_INFORMATION 12619
WriteX 12619 0 2048 2048
Close 12619
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12620
ReadX 12620 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12620
Close 12613
Close 12607
Close 12608
Close 12611
Close 12612
Close 12609
Close 12610
Close 12602
Close 12603
Close 12604
Close 12605
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12621
ReadX 12621 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12622
Close 12622
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12623
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12623 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12624
ReadX 12624 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12625
ReadX 12625 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12626
ReadX 12626 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12627
ReadX 12627 0 53 53
ReadX 12627 53 28 28
ReadX 12627 81 28 28
ReadX 12627 109 28 28
ReadX 12627 137 28 28
ReadX 12627 165 28 28
ReadX 12627 193 28 28
ReadX 12627 221 28 28
ReadX 12627 249 4 4
ReadX 12627 253 4 4
ReadX 12627 257 4 4
ReadX 12627 261 28 28
ReadX 12627 289 2 2
ReadX 12627 291 2 2
ReadX 12627 293 2 2
Close 12627
ReadX 12623 2048 2048 2048
Close 12623
Close 12624
Close 12625
Close 12626
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12628
ReadX 12628 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12629
ReadX 12629 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12630
ReadX 12630 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12631
ReadX 12631 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12632
ReadX 12632 0 53 53
ReadX 12632 53 28 28
ReadX 12632 81 28 28
ReadX 12632 109 28 28
ReadX 12632 137 28 28
ReadX 12632 165 28 28
ReadX 12632 193 28 28
ReadX 12632 221 28 28
ReadX 12632 249 4 4
ReadX 12632 253 4 4
ReadX 12632 257 4 4
ReadX 12632 261 28 28
ReadX 12632 289 2 2
ReadX 12632 291 2 2
ReadX 12632 293 2 2
Close 12632
ReadX 12628 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12636
FIND_FIRST \clients\client1\~dmtmp\*
Close 12636
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12637
QUERY_FILE_INFORMATION 12637
WriteX 12637 2047 1 1
QUERY_FILE_INFORMATION 12637
WriteX 12637 0 2048 2048
Close 12637
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12638
ReadX 12638 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12638
Close 12628
Close 12629
Close 12630
Close 12631
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12639
ReadX 12639 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12640
Close 12640
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12641
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12641 0 511 511
ReadX 12641 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12642
ReadX 12642 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12643
ReadX 12643 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12644
ReadX 12644 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12645
ReadX 12645 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12646
ReadX 12646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12647
ReadX 12647 0 53 53
ReadX 12647 53 2 2
ReadX 12647 55 2 2
ReadX 12647 57 184 184
ReadX 12647 241 298 298
Close 12647
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12648
ReadX 12648 0 41 41
ReadX 12641 2048 2048 2048
Close 12648
Close 12641
Close 12642
Close 12645
Close 12646
Close 12643
Close 12644
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12649
ReadX 12649 0 511 511
ReadX 12649 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12650
ReadX 12650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12651
ReadX 12651 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12652
ReadX 12652 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12653
ReadX 12653 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12654
ReadX 12654 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12655
ReadX 12655 0 53 53
ReadX 12655 53 2 2
ReadX 12655 55 2 2
ReadX 12655 57 184 184
ReadX 12655 241 298 298
Close 12655
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12656
ReadX 12656 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12657
ReadX 12657 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12658
ReadX 12658 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12659
ReadX 12659 0 511 511
ReadX 12658 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12660
ReadX 12660 0 53 53
ReadX 12660 53 2 2
ReadX 12660 55 480 480
ReadX 12660 535 2 2
Close 12660
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12661
ReadX 12661 0 41 41
ReadX 12649 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12665
FIND_FIRST \clients\client1\~dmtmp\*
Close 12665
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12666
QUERY_FILE_INFORMATION 12666
WriteX 12666 2047 1 1
QUERY_FILE_INFORMATION 12666
WriteX 12666 0 2048 2048
Close 12666
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12667
ReadX 12667 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12667
Close 12656
Close 12657
Close 12658
Close 12659
Close 12661
Close 12649
Close 12650
Close 12653
Close 12654
Close 12651
Close 12652
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12668
ReadX 12668 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12621 4095 1 1
QUERY_FILE_INFORMATION 12621
WriteX 12621 2048 2048 2048
QUERY_FILE_INFORMATION 12621
Flush 12621
WriteX 12621 0 88 88
WriteX 12639 4095 1 1
QUERY_FILE_INFORMATION 12639
WriteX 12639 2048 2048 2048
QUERY_FILE_INFORMATION 12639
Flush 12639
WriteX 12639 0 88 88
WriteX 12668 4095 1 1
QUERY_FILE_INFORMATION 12668
WriteX 12668 2048 2048 2048
QUERY_FILE_INFORMATION 12668
Flush 12668
WriteX 12668 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12669
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12669 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12670
ReadX 12670 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12671
ReadX 12671 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12672
ReadX 12672 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12673
ReadX 12673 0 53 53
ReadX 12673 53 2 2
ReadX 12673 55 480 480
ReadX 12673 535 2 2
Close 12673
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12674
ReadX 12674 0 511 511
ReadX 12674 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12675
ReadX 12675 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12676
ReadX 12676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12677
ReadX 12677 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12678
ReadX 12678 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12679
ReadX 12679 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12680
ReadX 12680 0 41 41
ReadX 12674 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12681
ReadX 12681 0 53 53
ReadX 12681 53 2 2
ReadX 12681 55 2 2
ReadX 12681 57 184 184
ReadX 12681 241 298 298
Close 12681
ReadX 12669 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12682
ReadX 12682 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12683
ReadX 12683 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12684
ReadX 12684 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12685
ReadX 12685 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12686
ReadX 12686 0 53 53
ReadX 12686 53 28 28
ReadX 12686 81 28 28
ReadX 12686 109 28 28
ReadX 12686 137 28 28
ReadX 12686 165 28 28
ReadX 12686 193 28 28
ReadX 12686 221 28 28
ReadX 12686 249 4 4
ReadX 12686 253 4 4
ReadX 12686 257 4 4
ReadX 12686 261 28 28
ReadX 12686 289 2 2
ReadX 12686 291 2 2
ReadX 12686 293 2 2
Close 12686
ReadX 12682 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12687
ReadX 12687 0 53 53
ReadX 12687 53 2 2
ReadX 12687 55 2 2
ReadX 12687 57 184 184
ReadX 12687 241 298 298
Close 12687
ReadX 12671 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12688
ReadX 12688 0 53 53
ReadX 12688 53 2 2
ReadX 12688 55 480 480
ReadX 12688 535 2 2
Close 12688
ReadX 12682 4096 16384 16384
ReadX 12682 1280 16384 16384
ReadX 12682 2304 6144 6144
ReadX 12682 2688 2048 2048
ReadX 12669 4096 16384 16384
ReadX 12669 1280 16384 16384
ReadX 12669 2304 16384 16384
ReadX 12669 3328 16384 16384
ReadX 12669 272 16384 16384
ReadX 12669 336 16384 16384
ReadX 12669 400 16384 16384
ReadX 12669 464 16384 16384
ReadX 12669 528 16384 16384
ReadX 12669 592 16384 16384
ReadX 12669 656 16384 16384
ReadX 12669 720 16384 16384
ReadX 12669 784 16384 16384
ReadX 12669 848 16384 16384
ReadX 12669 912 16384 16384
ReadX 12675 2048 2048 2048
ReadX 12674 760 2048 2048
ReadX 12674 1144 2048 2048
ReadX 12674 408 2048 2048
ReadX 12674 912 2048 2048
ReadX 12674 1096 2048 2048
ReadX 12674 776 2048 2048
ReadX 12674 560 2048 2048
ReadX 12674 376 2048 2048
ReadX 12674 320 2048 2048
ReadX 12674 3072 2048 2048
ReadX 12674 784 2048 2048
ReadX 12674 2176 2048 2048
ReadX 12674 792 2048 2048
ReadX 12674 576 2048 2048
ReadX 12674 600 2048 2048
ReadX 12674 728 2048 2048
ReadX 12674 1112 2048 2048
ReadX 12674 664 2048 2048
ReadX 12674 976 2048 2048
ReadX 12674 3840 2048 2048
ReadX 12674 296 2048 2048
ReadX 12674 480 2048 2048
ReadX 12674 680 2048 2048
ReadX 12674 696 2048 2048
ReadX 12674 832 2048 2048
ReadX 12674 1016 2048 2048
ReadX 12674 1104 2048 2048
ReadX 12674 3200 2048 2048
ReadX 12674 264 2048 2048
ReadX 12674 448 2048 2048
ReadX 12674 648 2048 2048
ReadX 12674 1136 2048 2048
ReadX 12674 288 2048 2048
ReadX 12674 352 2048 2048
ReadX 12674 536 2048 2048
ReadX 12674 800 2048 2048
ReadX 12674 736 2048 2048
ReadX 12674 392 2048 2048
ReadX 12674 752 2048 2048
ReadX 12674 880 2048 2048
ReadX 12674 1064 2048 2048
ReadX 12674 1128 2048 2048
ReadX 12674 1536 2048 2048
ReadX 12674 2432 2048 2048
ReadX 12674 688 2048 2048
ReadX 12674 872 2048 2048
ReadX 12674 1072 2048 2048
ReadX 12674 984 2048 2048
ReadX 12674 704 2048 2048
ReadX 12674 3328 2048 2048
ReadX 12674 888 2048 2048
ReadX 12674 496 2048 2048
ReadX 12674 624 2048 2048
ReadX 12674 808 2048 2048
ReadX 12674 1008 2048 2048
ReadX 12674 1152 2048 2048
ReadX 12674 416 2048 2048
ReadX 12674 584 2048 2048
ReadX 12674 384 2048 2048
ReadX 12674 568 2048 2048
ReadX 12674 512 2048 2048
ReadX 12674 1408 2048 2048
ReadX 12674 472 2048 2048
ReadX 12674 672 2048 2048
ReadX 12674 2560 2048 2048
ReadX 12674 544 2048 2048
ReadX 12674 920 2048 2048
ReadX 12674 1120 2048 2048
ReadX 12674 2304 2048 2048
ReadX 12674 1080 2048 2048
ReadX 12674 1664 2048 2048
ReadX 12674 608 2048 2048
ReadX 12674 2688 2048 2048
ReadX 12674 3712 2048 2048
ReadX 12674 616 2048 2048
ReadX 12674 632 2048 2048
ReadX 12674 944 2048 2048
ReadX 12674 856 2048 2048
ReadX 12674 768 2048 2048
ReadX 12674 720 2048 2048
ReadX 12674 640 2048 2048
ReadX 12674 1048 2048 2048
ReadX 12674 1040 2048 2048
ReadX 12674 1032 2048 2048
ReadX 12674 1000 2048 2048
ReadX 12674 992 2048 2048
ReadX 12674 968 2048 2048
ReadX 12674 952 2048 2048
ReadX 12674 1056 2048 2048
ReadX 12674 816 2048 2048
ReadX 12674 864 2048 2048
ReadX 12674 2816 2048 2048
ReadX 12674 640 2048 2048
ReadX 12674 1024 2048 2048
ReadX 12674 504 2048 2048
ReadX 12674 424 2048 2048
ReadX 12674 840 2048 2048
ReadX 12674 896 2048 2048
ReadX 12674 520 2048 2048
ReadX 12674 960 2048 2048
ReadX 12674 552 2048 2048
ReadX 12674 488 2048 2048
ReadX 12674 824 2048 2048
ReadX 12674 304 2048 2048
ReadX 12674 768 2048 2048
ReadX 12674 712 2048 2048
ReadX 12674 512 2048 2048
ReadX 12674 432 2048 2048
ReadX 12674 384 2048 2048
ReadX 12674 2944 2048 2048
ReadX 12674 1088 2048 2048
ReadX 12674 928 2048 2048
ReadX 12674 280 2048 2048
ReadX 12674 744 2048 2048
ReadX 12674 3968 2048 2048
ReadX 12674 336 2048 2048
ReadX 12674 592 2048 2048
ReadX 12674 312 2048 2048
ReadX 12674 400 2048 2048
ReadX 12674 904 2048 2048
ReadX 12674 464 2048 2048
ReadX 12674 3456 2048 2048
ReadX 12674 848 2048 2048
ReadX 12674 936 2048 2048
ReadX 12674 656 2048 2048
ReadX 12674 344 2048 2048
ReadX 12674 440 2048 2048
ReadX 12674 4096 2048 2048
ReadX 12674 528 2048 2048
ReadX 12674 2048 2048 2048
ReadX 12674 1024 2048 2048
ReadX 12674 456 2048 2048
ReadX 12674 1792 2048 2048
ReadX 12674 1152 2048 2048
ReadX 12674 3584 2048 2048
ReadX 12674 1920 2048 2048
ReadX 12674 1280 2048 2048
ReadX 12674 896 2048 2048
ReadX 12674 328 2048 2048
Close 12682
Close 12683
Close 12684
Close 12685
Close 12680
Close 12674
Close 12675
Close 12678
Close 12679
Close 12676
Close 12677
Close 12669
Close 12670
Close 12671
Close 12672
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12689
FIND_FIRST \clients\client1\~dmtmp\*
Close 12689
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12690
QUERY_FILE_INFORMATION 12690
WriteX 12690 0 2048 2048
WriteX 12690 18431 1 1
QUERY_FILE_INFORMATION 12690
WriteX 12690 2048 16384 16384
WriteX 12690 1152 16384 16384
WriteX 12690 2176 16384 16384
WriteX 12690 3200 16384 16384
WriteX 12690 264 16384 16384
WriteX 12690 328 16384 16384
WriteX 12690 392 16384 16384
WriteX 12690 456 16384 16384
WriteX 12690 520 16384 16384
WriteX 12690 584 16384 16384
WriteX 12690 648 16384 16384
WriteX 12690 712 16384 16384
WriteX 12690 776 16384 16384
WriteX 12690 840 16384 16384
WriteX 12690 904 16384 16384
WriteX 12690 968 16384 16384
WriteX 12690 1032 16384 16384
WriteX 12690 1096 16384 16384
WriteX 12690 1160 16384 16384
WriteX 12690 1224 16384 16384
WriteX 12690 1288 16384 16384
WriteX 12690 1352 16384 16384
WriteX 12690 1416 16384 16384
WriteX 12690 1480 16384 16384
WriteX 12690 1544 16384 16384
WriteX 12690 1608 16384 16384
WriteX 12690 1672 16384 16384
WriteX 12690 1736 16384 16384
WriteX 12690 1800 16384 16384
WriteX 12690 1864 16384 16384
WriteX 12690 1928 16384 16384
WriteX 12690 1992 16384 16384
WriteX 12690 2056 16384 16384
WriteX 12690 2120 16384 16384
WriteX 12690 2184 16384 16384
WriteX 12690 2248 16384 16384
WriteX 12690 2312 16384 16384
WriteX 12690 2376 16384 16384
WriteX 12690 2440 16384 16384
WriteX 12690 0 88 88
Close 12690
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12691
ReadX 12691 0 511 511
ReadX 12691 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12691
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12692
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12693
ReadX 12693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12694
ReadX 12694 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12695
ReadX 12695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12696
ReadX 12696 0 53 53
ReadX 12696 53 2 2
ReadX 12696 55 480 480
ReadX 12696 535 2 2
Close 12696
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12697
ReadX 12697 0 511 511
ReadX 12697 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12698
ReadX 12698 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12699
ReadX 12699 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12700
ReadX 12700 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12701
ReadX 12701 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12702
ReadX 12702 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12703
ReadX 12703 0 41 41
ReadX 12697 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12704
ReadX 12704 0 53 53
ReadX 12704 53 2 2
ReadX 12704 55 2 2
ReadX 12704 57 184 184
ReadX 12704 241 298 298
Close 12704
ReadX 12692 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12705
ReadX 12705 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12706
ReadX 12706 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12707
ReadX 12707 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12708
ReadX 12708 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12709
ReadX 12709 0 53 53
ReadX 12709 53 28 28
ReadX 12709 81 28 28
ReadX 12709 109 28 28
ReadX 12709 137 28 28
ReadX 12709 165 28 28
ReadX 12709 193 28 28
ReadX 12709 221 28 28
ReadX 12709 249 4 4
ReadX 12709 253 4 4
ReadX 12709 257 4 4
ReadX 12709 261 28 28
ReadX 12709 289 2 2
ReadX 12709 291 2 2
ReadX 12709 293 2 2
Close 12709
ReadX 12705 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12710
ReadX 12710 0 53 53
ReadX 12710 53 2 2
ReadX 12710 55 2 2
ReadX 12710 57 184 184
ReadX 12710 241 298 298
Close 12710
ReadX 12694 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12711
ReadX 12711 0 53 53
ReadX 12711 53 2 2
ReadX 12711 55 480 480
ReadX 12711 535 2 2
Close 12711
Close 12705
Close 12706
Close 12707
Close 12708
Close 12703
Close 12697
Close 12698
Close 12701
Close 12702
Close 12699
Close 12700
Close 12692
Close 12693
Close 12694
Close 12695
Close 12621
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12712
QUERY_FILE_INFORMATION 12712
Close 12712
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12639
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12713
QUERY_FILE_INFORMATION 12713
Close 12713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12668
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12714
QUERY_FILE_INFORMATION 12714
Close 12714
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
Close 12715
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12716
ReadX 12716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12717
ReadX 12717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12718
ReadX 12718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12719
ReadX 12719 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12720
ReadX 12720 0 53 53
ReadX 12720 53 28 28
ReadX 12720 81 28 28
ReadX 12720 109 28 28
ReadX 12720 137 28 28
ReadX 12720 165 28 28
ReadX 12720 193 28 28
ReadX 12720 221 28 28
ReadX 12720 249 4 4
ReadX 12720 253 4 4
ReadX 12720 257 4 4
ReadX 12720 261 28 28
ReadX 12720 289 2 2
ReadX 12720 291 2 2
ReadX 12720 293 2 2
Close 12720
ReadX 12716 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12716 384 2048 2048
ReadX 12716 768 16384 16384
ReadX 12716 1792 14336 14336
ReadX 12719 2048 2048 2048
ReadX 12718 2048 2048 2048
WriteX 12716 1152 2048 2048
WriteX 12719 2048 2048 2048
WriteX 12718 2048 2048 2048
WriteX 12716 0 88 88
WriteX 12717 0 88 88
WriteX 12718 0 88 88
WriteX 12719 0 88 88
Close 12716
Close 12717
Close 12718
Close 12719
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12721
Close 12721
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12722
ReadX 12722 0 511 511
ReadX 12722 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12723
ReadX 12723 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12724
ReadX 12724 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12725
ReadX 12725 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12726
ReadX 12726 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12727
ReadX 12727 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12728
ReadX 12728 0 53 53
ReadX 12728 53 2 2
ReadX 12728 55 2 2
ReadX 12728 57 184 184
ReadX 12728 241 298 298
Close 12728
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12729
ReadX 12729 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12730
ReadX 12730 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12731
ReadX 12731 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12732
ReadX 12732 0 511 511
ReadX 12731 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12733
ReadX 12733 0 53 53
ReadX 12733 53 2 2
ReadX 12733 55 480 480
ReadX 12733 535 2 2
Close 12733
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12734
ReadX 12734 0 41 41
ReadX 12722 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12735
QUERY_FILE_INFORMATION 12735
QUERY_FILE_INFORMATION 12735
ReadX 12735 0 8192 8192
Close 12735
ReadX 12722 1152 2048 2048
ReadX 12722 4096 16384 16384
Close 12729
Close 12730
Close 12731
Close 12732
Close 12734
Close 12722
Close 12723
Close 12726
Close 12727
Close 12724
Close 12725
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12736
Close 12736
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12737
QUERY_FILE_INFORMATION 12737
ReadX 12737 0 64 64
ReadX 12737 144 64 64
ReadX 12737 224 156 156
ReadX 12737 1193 128 128
ReadX 12737 1201 128 128
ReadX 12737 1072 4 4
ReadX 12737 1076 1925 1925
ReadX 12737 758 4 4
ReadX 12737 762 4557 4557
ReadX 12737 1052 4 4
ReadX 12737 1056 314 314
ReadX 12737 1056 11056 11056
Close 12737
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12738
ReadX 12738 0 511 511
ReadX 12738 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12739
ReadX 12739 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12740
ReadX 12740 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12741
ReadX 12741 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12742
ReadX 12742 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12743
ReadX 12743 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12744
ReadX 12744 0 53 53
ReadX 12744 53 2 2
ReadX 12744 55 2 2
ReadX 12744 57 184 184
ReadX 12744 241 298 298
Close 12744
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12745
ReadX 12745 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12746
ReadX 12746 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12747
ReadX 12747 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12748
ReadX 12748 0 511 511
ReadX 12747 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12749
ReadX 12749 0 53 53
ReadX 12749 53 2 2
ReadX 12749 55 480 480
ReadX 12749 535 2 2
Close 12749
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12750
ReadX 12750 0 41 41
ReadX 12738 2048 2048 2048
ReadX 12739 2048 2048 2048
ReadX 12738 1144 2048 2048
ReadX 12738 1152 2048 2048
ReadX 12738 4096 16384 16384
WriteX 12738 2048 2048 2048
WriteX 12739 2048 2048 2048
WriteX 12738 0 88 88
WriteX 12739 0 88 88
Close 12745
Close 12746
Close 12747
Close 12748
Close 12750
Close 12738
Close 12739
Close 12742
Close 12743
Close 12740
Close 12741
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12751
Close 12751
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12752
QUERY_FILE_INFORMATION 12752
ReadX 12752 0 64 64
ReadX 12752 144 64 64
ReadX 12752 224 84 84
ReadX 12752 478 16 16
ReadX 12752 1056 6176 6176
Close 12752
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12753
ReadX 12753 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12754
ReadX 12754 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12755
ReadX 12755 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12756
ReadX 12756 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12757
ReadX 12757 0 53 53
ReadX 12757 53 28 28
ReadX 12757 81 28 28
ReadX 12757 109 28 28
ReadX 12757 137 28 28
ReadX 12757 165 28 28
ReadX 12757 193 28 28
ReadX 12757 221 28 28
ReadX 12757 249 4 4
ReadX 12757 253 4 4
ReadX 12757 257 4 4
ReadX 12757 261 28 28
ReadX 12757 289 2 2
ReadX 12757 291 2 2
ReadX 12757 293 2 2
Close 12757
ReadX 12753 2048 2048 2048
ReadX 12754 2048 2048 2048
ReadX 12753 1280 2048 2048
ReadX 12756 2048 2048 2048
ReadX 12755 2048 2048 2048
WriteX 12753 1280 2048 2048
WriteX 12756 2048 2048 2048
WriteX 12755 2048 2048 2048
WriteX 12754 2048 2048 2048
WriteX 12753 0 88 88
WriteX 12754 0 88 88
WriteX 12755 0 88 88
WriteX 12756 0 88 88
WriteX 12753 1280 2048 2048
WriteX 12756 2048 2048 2048
WriteX 12755 2048 2048 2048
WriteX 12754 2048 2048 2048
WriteX 12753 0 88 88
WriteX 12754 0 88 88
WriteX 12755 0 88 88
WriteX 12756 0 88 88
WriteX 12753 1280 2048 2048
WriteX 12756 2048 2048 2048
WriteX 12755 2048 2048 2048
WriteX 12754 2048 2048 2048
WriteX 12753 0 88 88
WriteX 12754 0 88 88
WriteX 12755 0 88 88
WriteX 12756 0 88 88
Close 12753
Close 12754
Close 12755
Close 12756
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12758
ReadX 12758 0 511 511
ReadX 12758 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12759
ReadX 12759 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12760
ReadX 12760 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12761
ReadX 12761 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12762
ReadX 12762 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12763
ReadX 12763 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12764
ReadX 12764 0 53 53
ReadX 12764 53 2 2
ReadX 12764 55 2 2
ReadX 12764 57 184 184
ReadX 12764 241 298 298
Close 12764
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12765
ReadX 12765 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12766
ReadX 12766 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12767
ReadX 12767 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12768
ReadX 12768 0 511 511
ReadX 12767 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12769
ReadX 12769 0 53 53
ReadX 12769 53 2 2
ReadX 12769 55 480 480
ReadX 12769 535 2 2
Close 12769
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12770
ReadX 12770 0 41 41
ReadX 12758 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12774
FIND_FIRST \clients\client1\~dmtmp\*
Close 12774
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12775
QUERY_FILE_INFORMATION 12775
WriteX 12775 2047 1 1
QUERY_FILE_INFORMATION 12775
WriteX 12775 0 2048 2048
Close 12775
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12776
ReadX 12776 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12776 4095 1 1
QUERY_FILE_INFORMATION 12776
WriteX 12776 2048 2048 2048
WriteX 12776 0 88 88
Close 12776
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12777
ReadX 12777 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12777 2048 2048 2048
Close 12765
Close 12766
Close 12767
Close 12768
Close 12770
Close 12758
Close 12759
Close 12762
Close 12763
Close 12760
Close 12761
WriteX 12777 2048 2048 2048
WriteX 12777 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12778
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12778 0 511 511
ReadX 12778 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12779
ReadX 12779 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12780
ReadX 12780 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12781
ReadX 12781 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12782
ReadX 12782 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12783
ReadX 12783 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12784
ReadX 12784 0 53 53
ReadX 12784 53 2 2
ReadX 12784 55 2 2
ReadX 12784 57 184 184
ReadX 12784 241 298 298
Close 12784
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12785
ReadX 12785 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12786
ReadX 12786 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12787
ReadX 12787 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12788
ReadX 12788 0 511 511
ReadX 12787 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12789
ReadX 12789 0 53 53
ReadX 12789 53 2 2
ReadX 12789 55 480 480
ReadX 12789 535 2 2
Close 12789
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12790
ReadX 12790 0 41 41
ReadX 12778 2048 2048 2048
ReadX 12778 1152 2048 2048
ReadX 12778 4096 16384 16384
ReadX 12778 1280 16384 16384
ReadX 12778 2304 16384 16384
ReadX 12778 3328 16384 16384
ReadX 12778 272 16384 16384
ReadX 12778 336 16384 16384
ReadX 12778 400 16384 16384
ReadX 12778 464 16384 16384
ReadX 12778 528 16384 16384
ReadX 12778 592 16384 16384
ReadX 12778 656 16384 16384
ReadX 12778 720 16384 16384
ReadX 12778 784 16384 16384
ReadX 12778 848 16384 16384
ReadX 12778 912 16384 16384
ReadX 12778 976 16384 16384
ReadX 12778 1040 16384 16384
ReadX 12778 1104 12288 12288
Close 12785
Close 12786
Close 12787
Close 12788
Close 12790
Close 12778
Close 12779
Close 12782
Close 12783
Close 12780
Close 12781
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12791
FIND_FIRST \clients\client1\~dmtmp\*
Close 12791
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12792
QUERY_FILE_INFORMATION 12792
WriteX 12792 0 2048 2048
WriteX 12792 2048 4096 4096
WriteX 12792 0 88 88
Close 12792
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12793
ReadX 12793 0 511 511
ReadX 12793 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12793
WriteX 12777 2048 2048 2048
WriteX 12777 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12794
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12794 0 511 511
ReadX 12794 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12795
ReadX 12795 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12796
ReadX 12796 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12797
ReadX 12797 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12798
ReadX 12798 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12799
ReadX 12799 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12800
ReadX 12800 0 53 53
ReadX 12800 53 2 2
ReadX 12800 55 2 2
ReadX 12800 57 184 184
ReadX 12800 241 298 298
Close 12800
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12801
ReadX 12801 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12802
ReadX 12802 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12803
ReadX 12803 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12804
ReadX 12804 0 511 511
ReadX 12803 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12805
ReadX 12805 0 53 53
ReadX 12805 53 2 2
ReadX 12805 55 480 480
ReadX 12805 535 2 2
Close 12805
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12806
ReadX 12806 0 41 41
ReadX 12794 2048 2048 2048
ReadX 12794 1152 2048 2048
ReadX 12794 4096 16384 16384
ReadX 12794 1280 16384 16384
ReadX 12794 2304 16384 16384
ReadX 12794 3328 16384 16384
ReadX 12794 272 16384 16384
ReadX 12794 336 16384 16384
ReadX 12794 400 16384 16384
ReadX 12794 464 16384 16384
ReadX 12794 528 16384 16384
ReadX 12794 592 16384 16384
ReadX 12794 656 16384 16384
ReadX 12794 720 16384 16384
ReadX 12794 784 16384 16384
ReadX 12794 848 16384 16384
ReadX 12794 912 16384 16384
ReadX 12794 976 16384 16384
ReadX 12794 1040 16384 16384
ReadX 12794 1104 12288 12288
Close 12801
Close 12802
Close 12803
Close 12804
Close 12806
Close 12794
Close 12795
Close 12798
Close 12799
Close 12796
Close 12797
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12807
FIND_FIRST \clients\client1\~dmtmp\*
Close 12807
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12808
QUERY_FILE_INFORMATION 12808
WriteX 12808 0 2048 2048
WriteX 12808 2048 4096 4096
WriteX 12808 0 88 88
Close 12808
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12809
ReadX 12809 0 511 511
ReadX 12809 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12809
Close 12777
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12810
QUERY_FILE_INFORMATION 12810
Close 12810
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12811
Close 12811
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12812
QUERY_FILE_INFORMATION 12812
ReadX 12812 0 64 64
ReadX 12812 144 64 64
ReadX 12812 224 156 156
ReadX 12812 1193 128 128
ReadX 12812 1201 128 128
ReadX 12812 1072 4 4
ReadX 12812 1076 1925 1925
ReadX 12812 758 4 4
ReadX 12812 762 4557 4557
ReadX 12812 1052 4 4
ReadX 12812 1056 314 314
ReadX 12812 1056 11056 11056
Close 12812
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12813
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12813 0 511 511
ReadX 12813 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12814
ReadX 12814 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12815
ReadX 12815 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12816
ReadX 12816 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12817
ReadX 12817 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12818
ReadX 12818 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12819
ReadX 12819 0 53 53
ReadX 12819 53 2 2
ReadX 12819 55 2 2
ReadX 12819 57 184 184
ReadX 12819 241 298 298
Close 12819
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12820
ReadX 12820 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12821
ReadX 12821 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12822
ReadX 12822 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12823
ReadX 12823 0 511 511
ReadX 12822 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12824
ReadX 12824 0 53 53
ReadX 12824 53 2 2
ReadX 12824 55 480 480
ReadX 12824 535 2 2
Close 12824
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12825
ReadX 12825 0 41 41
ReadX 12813 2048 2048 2048
ReadX 12813 1152 2048 2048
ReadX 12813 4096 16384 16384
Close 12820
Close 12821
Close 12822
Close 12823
Close 12825
Close 12813
Close 12814
Close 12817
Close 12818
Close 12815
Close 12816
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12826
ReadX 12826 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12827
ReadX 12827 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12828
ReadX 12828 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12829
ReadX 12829 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12830
ReadX 12830 0 53 53
ReadX 12830 53 2 2
ReadX 12830 55 480 480
ReadX 12830 535 2 2
Close 12830
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12831
ReadX 12831 0 511 511
ReadX 12831 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12832
ReadX 12832 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12833
ReadX 12833 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12834
ReadX 12834 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12835
ReadX 12835 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12836
ReadX 12836 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12837
ReadX 12837 0 41 41
ReadX 12831 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12838
ReadX 12838 0 53 53
ReadX 12838 53 2 2
ReadX 12838 55 2 2
ReadX 12838 57 184 184
ReadX 12838 241 298 298
Close 12838
ReadX 12826 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12842
FIND_FIRST \clients\client1\~dmtmp\*
Close 12842
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12843
QUERY_FILE_INFORMATION 12843
WriteX 12843 2047 1 1
QUERY_FILE_INFORMATION 12843
WriteX 12843 0 2048 2048
Close 12843
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12844
ReadX 12844 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12844 4095 1 1
QUERY_FILE_INFORMATION 12844
WriteX 12844 2048 2048 2048
WriteX 12844 0 88 88
Close 12844
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12845
ReadX 12845 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12845 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12849
Close 12849
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12850
QUERY_FILE_INFORMATION 12850
WriteX 12850 2047 1 1
QUERY_FILE_INFORMATION 12850
WriteX 12850 0 2048 2048
Close 12850
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12851
ReadX 12851 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12851 4095 1 1
QUERY_FILE_INFORMATION 12851
WriteX 12851 2048 2048 2048
WriteX 12851 0 88 88
Close 12851
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12852
ReadX 12852 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12852 2048 2048 2048
Close 12837
Close 12831
Close 12832
Close 12835
Close 12836
Close 12833
Close 12834
Close 12826
Close 12827
Close 12828
Close 12829
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12853
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12853 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12854
ReadX 12854 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12855
ReadX 12855 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12856
ReadX 12856 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12857
ReadX 12857 0 53 53
ReadX 12857 53 2 2
ReadX 12857 55 480 480
ReadX 12857 535 2 2
Close 12857
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12858
ReadX 12858 0 511 511
ReadX 12858 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12859
ReadX 12859 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12860
ReadX 12860 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12861
ReadX 12861 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12862
ReadX 12862 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12863
ReadX 12863 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12864
ReadX 12864 0 41 41
ReadX 12858 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12865
ReadX 12865 0 53 53
ReadX 12865 53 2 2
ReadX 12865 55 2 2
ReadX 12865 57 184 184
ReadX 12865 241 298 298
Close 12865
ReadX 12853 2048 2048 2048
ReadX 12853 384 16384 16384
ReadX 12853 1408 16384 16384
ReadX 12853 2560 16384 16384
ReadX 12853 3584 16384 16384
ReadX 12853 288 16384 16384
ReadX 12853 352 16384 16384
ReadX 12853 416 16384 16384
ReadX 12853 480 16384 16384
ReadX 12853 552 16384 16384
ReadX 12853 616 16384 16384
ReadX 12853 680 16384 16384
ReadX 12853 744 16384 16384
ReadX 12853 808 16384 16384
ReadX 12853 872 16384 16384
ReadX 12853 936 10240 10240
Close 12864
Close 12858
Close 12859
Close 12862
Close 12863
Close 12860
Close 12861
Close 12853
Close 12854
Close 12855
Close 12856
Close 12845
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12866
QUERY_FILE_INFORMATION 12866
Close 12866
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12852
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12867
QUERY_FILE_INFORMATION 12867
Close 12867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12868
ReadX 12868 0 65471 65471
ReadX 12868 65471 63 63
ReadX 12868 65534 65471 65471
ReadX 12868 131005 63 63
ReadX 12868 131068 65471 65471
ReadX 12868 196539 63 63
ReadX 12868 196602 65471 65471
ReadX 12868 262073 63 63
ReadX 12868 262136 65471 65471
ReadX 12868 327607 63 63
ReadX 12868 327670 10 10
Close 12868
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12869
ReadX 12869 0 65471 65471
ReadX 12869 65471 63 63
ReadX 12869 65534 65471 65471
ReadX 12869 131005 63 63
ReadX 12869 131068 65471 65471
ReadX 12869 196539 63 63
ReadX 12869 196602 65471 65471
ReadX 12869 262073 63 63
ReadX 12869 262136 65471 65471
ReadX 12869 327607 63 63
ReadX 12869 327670 65471 65471
ReadX 12869 393141 63 63
ReadX 12869 393204 65471 65471
ReadX 12869 458675 63 63
ReadX 12869 458738 65471 65471
ReadX 12869 524209 63 63
ReadX 12869 524272 65471 65471
ReadX 12869 589743 63 63
ReadX 12869 589806 65471 65471
ReadX 12869 655277 63 63
ReadX 12869 655340 32 32
Close 12869
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12870
ReadX 12870 0 65471 65471
ReadX 12870 65471 63 63
ReadX 12870 65534 65471 65471
ReadX 12870 131005 63 63
ReadX 12870 131068 65471 65471
ReadX 12870 196539 63 63
ReadX 12870 196602 65471 65471
ReadX 12870 262073 63 63
ReadX 12870 262136 65471 65471
ReadX 12870 327607 63 63
ReadX 12870 327670 65471 65471
ReadX 12870 393141 63 63
ReadX 12870 393204 65471 65471
ReadX 12870 458675 63 63
ReadX 12870 458738 65471 65471
ReadX 12870 524209 63 63
ReadX 12870 524272 65471 65471
ReadX 12870 589743 63 63
ReadX 12870 589806 65471 65471
ReadX 12870 655277 63 63
ReadX 12870 655340 65471 65471
ReadX 12870 720811 63 63
ReadX 12870 720874 65471 65471
ReadX 12870 786345 63 63
ReadX 12870 786408 65471 65471
ReadX 12870 851879 63 63
ReadX 12870 851942 65471 65471
ReadX 12870 917413 63 63
ReadX 12870 917476 65471 65471
ReadX 12870 982947 63 63
ReadX 12870 983010 65471 65471
ReadX 12870 1048481 63 63
ReadX 12870 1048544 65471 65471
ReadX 12870 1114015 63 63
ReadX 12870 1114078 65471 65471
ReadX 12870 1179549 63 63
ReadX 12870 1179612 65471 65471
ReadX 12870 1245083 63 63
ReadX 12870 1245146 65471 65471
ReadX 12870 1310617 63 63
ReadX 12870 1310680 65471 65471
ReadX 12870 1376151 63 63
ReadX 12870 1376214 65471 65471
ReadX 12870 1441685 63 63
ReadX 12870 1441748 65471 65471
ReadX 12870 1507219 63 63
ReadX 12870 1507282 65471 65471
ReadX 12870 1572753 63 63
ReadX 12870 1572816 65471 65471
ReadX 12870 1638287 63 63
ReadX 12870 1638350 65471 65471
ReadX 12870 1703821 63 63
ReadX 12870 1703884 65471 65471
ReadX 12870 1769355 63 63
ReadX 12870 1769418 65471 65471
ReadX 12870 1834889 63 63
ReadX 12870 1834952 32824 32824
Close 12870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12871
QUERY_FILE_INFORMATION 12871
ReadX 12871 0 512 512
ReadX 12871 512 512 512
ReadX 12871 1024 512 512
QUERY_FILE_INFORMATION 12871
QUERY_FILE_INFORMATION 12871
ReadX 12871 2560 2048 2048
ReadX 12871 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 12872
WriteX 12872 52 1 1
QUERY_FILE_INFORMATION 12872
WriteX 12872 0 53 53
Close 12872
ReadX 12871 2208 650 650
ReadX 12871 1920 2048 2048
ReadX 12871 2112 2048 2048
ReadX 12871 1856 2048 2048
ReadX 12871 1824 2048 2048
ReadX 12871 1536 512 512
ReadX 12871 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12873
Close 12873
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12871 1568 512 512
ReadX 12871 1536 512 512
ReadX 12871 2176 384 384
ReadX 12871 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12874
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12871 288 2048 2048
ReadX 12871 2336 2048 2048
ReadX 12871 4384 2048 2048
ReadX 12871 6432 2048 2048
ReadX 12871 8480 2048 2048
ReadX 12871 10528 2048 2048
ReadX 12871 12576 2048 2048
WriteX 12874 15359 1 1
QUERY_FILE_INFORMATION 12874
ReadX 12871 14624 2048 2048
ReadX 12871 16672 2048 2048
ReadX 12871 18720 2048 2048
ReadX 12871 1728 2048 2048
WriteX 12874 0 15360 15360
Close 12874
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 12875
QUERY_FILE_INFORMATION 12875
ReadX 12875 0 512 512
ReadX 12875 2048 512 512
ReadX 12875 2560 512 512
QUERY_FILE_INFORMATION 12875
QUERY_FILE_INFORMATION 12875
QUERY_FILE_INFORMATION 12875
QUERY_FILE_INFORMATION 12875
QUERY_FILE_INFORMATION 12875
WriteX 12875 2152 384 384
QUERY_FILE_INFORMATION 12875
WriteX 12875 2150 22 22
WriteX 12875 2144 106 106
QUERY_FILE_INFORMATION 12875
WriteX 12875 2176 496 496
ReadX 12875 2176 496 496
QUERY_FILE_INFORMATION 12875
WriteX 12875 2440 384 384
QUERY_FILE_INFORMATION 12875
WriteX 12875 2152 384 384
WriteX 12875 2432 112 112
QUERY_FILE_INFORMATION 12875
WriteX 12875 2439 16 16
QUERY_FILE_INFORMATION 12875
WriteX 12875 2208 220 220
ReadX 12875 2208 220 220
QUERY_FILE_INFORMATION 12875
QUERY_FILE_INFORMATION 12875
WriteX 12875 2440 220 220
QUERY_FILE_INFORMATION 12875
WriteX 12875 2453 36 36
WriteX 12875 2080 512 512
WriteX 12875 2176 512 512
WriteX 12875 2112 512 512
WriteX 12875 2048 512 512
WriteX 12875 0 512 512
QUERY_FILE_INFORMATION 12871
QUERY_FILE_INFORMATION 12871
WriteX 12875 2080 512 512
Close 12875
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 12876
Close 12876
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12877
QUERY_FILE_INFORMATION 12877
ReadX 12877 0 512 512
ReadX 12877 2048 512 512
ReadX 12877 2560 512 512
QUERY_FILE_INFORMATION 12877
QUERY_FILE_INFORMATION 12877
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 12878
Close 12878
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 12871
ReadX 12877 1408 512 512
ReadX 12877 2048 512 512
ReadX 12877 1536 512 512
ReadX 12877 2560 512 512
ReadX 12877 3072 512 512
ReadX 12877 3584 512 512
ReadX 12877 4096 512 512
ReadX 12877 4608 512 512
ReadX 12877 5120 512 512
ReadX 12877 5632 512 512
ReadX 12877 6144 512 512
ReadX 12877 6656 512 512
ReadX 12877 7168 512 512
ReadX 12877 7680 512 512
ReadX 12877 8192 512 512
ReadX 12877 8704 512 512
ReadX 12877 9216 512 512
ReadX 12877 9728 512 512
ReadX 12877 10240 512 512
ReadX 12877 10752 512 512
ReadX 12877 11264 512 512
ReadX 12877 11776 512 512
ReadX 12877 12288 512 512
ReadX 12877 12800 512 512
ReadX 12877 13312 512 512
ReadX 12877 13824 512 512
ReadX 12877 14336 512 512
ReadX 12877 14848 512 512
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 15360 512 0
ReadX 12877 2560 2048 2048
ReadX 12877 4608 2048 2048
ReadX 12877 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12879
QUERY_FILE_INFORMATION 12879
ReadX 12879 0 512 512
ReadX 12879 512 512 512
ReadX 12879 1024 512 512
QUERY_FILE_INFORMATION 12879
QUERY_FILE_INFORMATION 12879
ReadX 12879 352 2048 2048
ReadX 12879 608 1097 1097
ReadX 12879 576 1609 1609
ReadX 12879 4096 512 512
ReadX 12879 1536 512 512
ReadX 12879 3840 256 256
ReadX 12879 288 576 576
ReadX 12879 512 512 512
ReadX 12879 480 512 512
ReadX 12879 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12880
ReadX 12880 0 4096 4096
ReadX 12880 4096 4096 4096
ReadX 12880 8192 4096 4096
Close 12879
Close 12880
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12881
WriteX 12881 15359 1 1
QUERY_FILE_INFORMATION 12881
WriteX 12881 0 15360 15360
Close 12881
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 12882
QUERY_FILE_INFORMATION 12882
ReadX 12882 0 512 512
ReadX 12882 2048 512 512
ReadX 12882 2560 512 512
QUERY_FILE_INFORMATION 12882
QUERY_FILE_INFORMATION 12882
QUERY_FILE_INFORMATION 12882
QUERY_FILE_INFORMATION 12882
QUERY_FILE_INFORMATION 12882
WriteX 12882 2152 384 384
QUERY_FILE_INFORMATION 12882
WriteX 12882 2150 22 22
WriteX 12882 2144 106 106
QUERY_FILE_INFORMATION 12882
WriteX 12882 2176 476 476
ReadX 12882 2176 476 476
QUERY_FILE_INFORMATION 12882
WriteX 12882 2440 384 384
QUERY_FILE_INFORMATION 12882
WriteX 12882 2152 384 384
WriteX 12882 2432 92 92
QUERY_FILE_INFORMATION 12882
WriteX 12882 2437 36 36
QUERY_FILE_INFORMATION 12882
WriteX 12882 2208 220 220
ReadX 12882 2208 220 220
QUERY_FILE_INFORMATION 12882
QUERY_FILE_INFORMATION 12882
WriteX 12882 2440 220 220
QUERY_FILE_INFORMATION 12882
WriteX 12882 2453 36 36
WriteX 12882 2080 512 512
WriteX 12882 2176 512 512
WriteX 12882 2112 512 512
WriteX 12882 2048 512 512
WriteX 12882 0 512 512
QUERY_FILE_INFORMATION 12877
QUERY_FILE_INFORMATION 12877
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 12877
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12883
Close 12883
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12884
QUERY_FILE_INFORMATION 12884
ReadX 12884 0 512 512
ReadX 12884 2048 512 512
ReadX 12884 2560 512 512
QUERY_FILE_INFORMATION 12884
QUERY_FILE_INFORMATION 12884
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 12885
Close 12885
WriteX 12882 2080 512 512
Close 12882
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 12886
Close 12886
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12887
QUERY_FILE_INFORMATION 12887
ReadX 12887 0 512 512
ReadX 12887 2048 512 512
ReadX 12887 2560 512 512
QUERY_FILE_INFORMATION 12887
QUERY_FILE_INFORMATION 12887
ReadX 12887 1312 512 512
ReadX 12887 1536 512 512
ReadX 12887 2048 512 512
ReadX 12887 576 512 512
ReadX 12887 1088 512 512
ReadX 12887 1056 512 512
ReadX 12887 1120 512 512
ReadX 12887 1184 512 512
ReadX 12887 2560 2048 2048
ReadX 12887 4608 2048 2048
ReadX 12887 6656 2048 2048
ReadX 12887 8704 2048 2048
ReadX 12887 10752 2048 2048
ReadX 12887 12800 2048 2048
ReadX 12887 14848 2048 512
ReadX 12887 15360 1536 0
ReadX 12887 1088 2048 2048
ReadX 12887 3136 2048 2048
ReadX 12887 1665 5835 5835
ReadX 12887 1856 2048 2048
ReadX 12887 2112 512 512
ReadX 12887 2152 384 384
ReadX 12887 2432 92 92
ReadX 12887 2176 512 512
ReadX 12887 2440 220 220
QUERY_FILE_INFORMATION 12887
QUERY_FILE_INFORMATION 12887
ReadX 12887 2432 512 512
WriteX 12887 2272 512 512
ReadX 12887 2144 512 512
WriteX 12887 2304 512 512
WriteX 12887 2272 92 92
WriteX 12887 2208 512 512
WriteX 12887 2720 512 512
WriteX 12887 0 512 512
QUERY_FILE_INFORMATION 12887
QUERY_FILE_INFORMATION 12887
ReadX 12887 1312 4096 4096
ReadX 12887 5408 4096 4096
ReadX 12887 9504 3305 3305
ReadX 12887 512 4096 4096
QUERY_FILE_INFORMATION 12887
QUERY_FILE_INFORMATION 12887
QUERY_FILE_INFORMATION 12887
WriteX 12887 3132 50 50
WriteX 12887 3182 4096 4096
WriteX 12887 7278 4096 4096
WriteX 12887 15469 1 1
QUERY_FILE_INFORMATION 12887
WriteX 12887 11374 4096 4096
WriteX 12887 15470 3584 3584
WriteX 12887 2144 512 512
WriteX 12887 2336 4096 4096
WriteX 12887 6432 4096 4096
WriteX 12887 10528 4096 4096
WriteX 12887 14624 462 462
WriteX 12887 2048 512 512
WriteX 12887 2560 512 512
WriteX 12887 0 512 512
QUERY_FILE_INFORMATION 12887
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12888
QUERY_FILE_INFORMATION 12888
ReadX 12888 0 512 512
ReadX 12888 1152 512 512
ReadX 12888 1664 512 512
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
ReadX 12888 512 2048 2048
ReadX 12888 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 12889
WriteX 12889 52 1 1
QUERY_FILE_INFORMATION 12889
WriteX 12889 0 53 53
Close 12889
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
ReadX 12888 1120 504 504
ReadX 12888 896 2048 2048
ReadX 12888 1056 1528 1528
ReadX 12888 864 2048 2048
ReadX 12888 832 2048 2048
ReadX 12888 736 2048 2048
ReadX 12888 1216 512 512
ReadX 12888 1256 384 384
ReadX 12888 1536 140 140
ReadX 12888 1280 512 512
ReadX 12888 1548 252 252
ReadX 12887 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12890
Close 12890
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12888 2560 2048 2048
ReadX 12888 4608 2048 2048
ReadX 12888 6656 2048 2048
ReadX 12888 8704 2048 2048
ReadX 12888 10752 2048 2048
WriteX 12891 12005 1 1
QUERY_FILE_INFORMATION 12891
WriteX 12891 0 12006 12006
Close 12891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 12892
QUERY_FILE_INFORMATION 12892
ReadX 12892 0 512 512
ReadX 12892 1152 512 512
ReadX 12892 1664 512 512
QUERY_FILE_INFORMATION 12892
QUERY_FILE_INFORMATION 12892
QUERY_FILE_INFORMATION 12892
QUERY_FILE_INFORMATION 12892
QUERY_FILE_INFORMATION 12892
QUERY_FILE_INFORMATION 12892
QUERY_FILE_INFORMATION 12892
WriteX 12892 1256 384 384
QUERY_FILE_INFORMATION 12892
WriteX 12892 1254 22 22
WriteX 12892 1248 106 106
QUERY_FILE_INFORMATION 12892
WriteX 12892 1280 508 508
ReadX 12892 1280 508 508
QUERY_FILE_INFORMATION 12892
WriteX 12892 1544 384 384
QUERY_FILE_INFORMATION 12892
WriteX 12892 1256 384 384
WriteX 12892 1536 124 124
QUERY_FILE_INFORMATION 12892
WriteX 12892 1543 4 4
QUERY_FILE_INFORMATION 12892
WriteX 12892 1312 252 252
ReadX 12892 1312 252 252
QUERY_FILE_INFORMATION 12892
QUERY_FILE_INFORMATION 12892
WriteX 12892 1544 252 252
QUERY_FILE_INFORMATION 12892
WriteX 12892 1559 4 4
WriteX 12892 1184 512 512
WriteX 12892 1280 512 512
WriteX 12892 1216 512 512
WriteX 12892 1152 512 512
WriteX 12892 0 512 512
QUERY_FILE_INFORMATION 12888
QUERY_FILE_INFORMATION 12888
WriteX 12892 1184 512 512
Close 12892
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 12893
Close 12893
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12894
QUERY_FILE_INFORMATION 12894
ReadX 12894 0 512 512
ReadX 12894 1152 512 512
ReadX 12894 1664 512 512
QUERY_FILE_INFORMATION 12894
QUERY_FILE_INFORMATION 12894
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 12895
Close 12895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 12888
ReadX 12894 736 512 512
ReadX 12894 1536 2048 2048
ReadX 12894 3584 2048 2048
ReadX 12894 5632 2048 2048
ReadX 12894 7680 2048 2048
ReadX 12894 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12896
WriteX 12896 11990 1 1
QUERY_FILE_INFORMATION 12896
WriteX 12896 0 11991 11991
Close 12896
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 12897
QUERY_FILE_INFORMATION 12897
ReadX 12897 0 512 512
ReadX 12897 1184 512 512
ReadX 12897 1696 512 512
QUERY_FILE_INFORMATION 12897
QUERY_FILE_INFORMATION 12897
QUERY_FILE_INFORMATION 12897
QUERY_FILE_INFORMATION 12897
QUERY_FILE_INFORMATION 12897
QUERY_FILE_INFORMATION 12897
QUERY_FILE_INFORMATION 12897
WriteX 12897 1288 384 384
QUERY_FILE_INFORMATION 12897
WriteX 12897 1286 22 22
WriteX 12897 1280 106 106
QUERY_FILE_INFORMATION 12897
WriteX 12897 1312 508 508
ReadX 12897 1312 508 508
QUERY_FILE_INFORMATION 12897
WriteX 12897 1576 384 384
QUERY_FILE_INFORMATION 12897
WriteX 12897 1288 384 384
WriteX 12897 1568 124 124
QUERY_FILE_INFORMATION 12897
WriteX 12897 1575 4 4
QUERY_FILE_INFORMATION 12897
WriteX 12897 1344 252 252
ReadX 12897 1344 252 252
QUERY_FILE_INFORMATION 12897
QUERY_FILE_INFORMATION 12897
WriteX 12897 1576 252 252
QUERY_FILE_INFORMATION 12897
WriteX 12897 1591 4 4
WriteX 12897 1216 512 512
WriteX 12897 1312 512 512
WriteX 12897 1248 512 512
WriteX 12897 1184 512 512
WriteX 12897 0 512 512
QUERY_FILE_INFORMATION 12894
QUERY_FILE_INFORMATION 12894
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 12894
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12898
Close 12898
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12899
QUERY_FILE_INFORMATION 12899
ReadX 12899 0 512 512
ReadX 12899 1152 512 512
ReadX 12899 1664 512 512
QUERY_FILE_INFORMATION 12899
QUERY_FILE_INFORMATION 12899
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 12900
Close 12900
WriteX 12897 1216 512 512
Close 12897
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 12901
Close 12901
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12902
QUERY_FILE_INFORMATION 12902
ReadX 12902 0 512 512
ReadX 12902 1184 512 512
ReadX 12902 1696 512 512
QUERY_FILE_INFORMATION 12902
QUERY_FILE_INFORMATION 12902
ReadX 12902 1536 512 512
ReadX 12902 736 512 512
ReadX 12902 2048 512 512
ReadX 12902 2560 512 512
ReadX 12902 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12903
Close 12903
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 12902 914 3899 3899
ReadX 12902 1248 512 512
ReadX 12902 1288 384 384
ReadX 12902 1568 124 124
ReadX 12902 1312 512 512
ReadX 12902 1576 252 252
QUERY_FILE_INFORMATION 12902
QUERY_FILE_INFORMATION 12902
ReadX 12902 1568 512 512
WriteX 12902 1408 512 512
ReadX 12902 1280 512 512
WriteX 12902 1440 512 512
WriteX 12902 1408 124 124
WriteX 12902 1344 512 512
WriteX 12902 1856 512 512
WriteX 12902 0 512 512
QUERY_FILE_INFORMATION 12902
QUERY_FILE_INFORMATION 12902
ReadX 12902 544 4096 4096
ReadX 12902 4640 4096 4096
ReadX 12902 8736 1637 1637
ReadX 12902 512 4096 4096
QUERY_FILE_INFORMATION 12902
QUERY_FILE_INFORMATION 12902
WriteX 12902 1280 512 512
WriteX 12902 1472 3584 3584
WriteX 12902 5056 4096 4096
WriteX 12902 13247 1 1
QUERY_FILE_INFORMATION 12902
WriteX 12902 9152 4096 4096
WriteX 12902 13248 1736 1736
WriteX 12902 1184 512 512
WriteX 12902 1696 512 512
WriteX 12902 0 512 512
QUERY_FILE_INFORMATION 12902
ReadX 12902 1632 1024 1024
ReadX 12902 288 1024 1024
ReadX 12902 1312 2048 2048
ReadX 12902 3360 1024 1024
ReadX 12902 1696 1024 1024
ReadX 12902 2720 512 512
ReadX 12902 3232 512 512
ReadX 12902 3744 512 512
ReadX 12902 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12902 2066 3998 3998
ReadX 12902 1448 384 384
ReadX 12902 1408 124 124
ReadX 12902 1416 252 252
QUERY_FILE_INFORMATION 12902
QUERY_FILE_INFORMATION 12902
ReadX 12902 1408 512 512
WriteX 12902 1536 512 512
ReadX 12902 1440 512 512
WriteX 12902 2048 512 512
WriteX 12902 1536 124 124
WriteX 12902 512 512 512
WriteX 12902 1024 512 512
WriteX 12902 0 512 512
QUERY_FILE_INFORMATION 12902
ReadX 12902 1696 4096 4096
ReadX 12902 5792 4096 4096
ReadX 12902 9888 1736 1736
ReadX 12902 1280 512 512
ReadX 12902 1472 3584 3584
QUERY_FILE_INFORMATION 12902
QUERY_FILE_INFORMATION 12902
WriteX 12902 3940 156 156
WriteX 12902 4096 512 512
WriteX 12902 544 3584 3584
WriteX 12902 4128 4096 4096
WriteX 12902 8224 3584 3584
WriteX 12902 1344 512 512
WriteX 12902 1856 1536 1536
WriteX 12902 2336 512 512
WriteX 12902 3584 356 356
WriteX 12902 2560 512 512
WriteX 12902 3072 512 512
WriteX 12902 0 512 512
QUERY_FILE_INFORMATION 12902
Close 12884
Close 12887
Close 12902
Close 12899
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12904
Close 12904
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12905
Close 12905
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12906
WriteX 12906 0 65471 65471
WriteX 12906 65471 63 63
WriteX 12906 65534 65471 65471
WriteX 12906 131005 63 63
Close 12906
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12907
WriteX 12907 0 65471 65471
WriteX 12907 65471 63 63
WriteX 12907 65534 65471 65471
WriteX 12907 131005 63 63
WriteX 12907 131068 65471 65471
WriteX 12907 196539 63 63
WriteX 12907 196602 65471 65471
WriteX 12907 262073 63 63
Close 12907
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12908
WriteX 12908 0 65471 65471
WriteX 12908 65471 63 63
WriteX 12908 65534 65471 65471
WriteX 12908 131005 63 63
WriteX 12908 131068 65471 65471
WriteX 12908 196539 63 63
WriteX 12908 196602 65471 65471
WriteX 12908 262073 63 63
WriteX 12908 262136 65471 65471
WriteX 12908 327607 63 63
WriteX 12908 327670 65471 65471
WriteX 12908 393141 63 63
WriteX 12908 393204 65471 65471
WriteX 12908 458675 63 63
WriteX 12908 458738 65471 65471
WriteX 12908 524209 63 63
Close 12908
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12909
QUERY_FILE_INFORMATION 12909
QUERY_FILE_INFORMATION 12909
ReadX 12909 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 12910
Close 12910
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 12911
WriteX 12911 63 1 1
QUERY_FILE_INFORMATION 12911
WriteX 12911 0 64 64
ReadX 12909 992 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 344 2048 2048
ReadX 12909 1344 2048 2048
ReadX 12909 1352 2048 2048
ReadX 12909 1320 2048 2048
ReadX 12909 1360 2048 2048
ReadX 12909 1344 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2304 2048 2048
ReadX 12909 1472 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 1480 2048 2048
ReadX 12909 1488 2048 2048
ReadX 12909 1496 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 1504 2048 2048
ReadX 12909 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 1000 2048 2048
ReadX 12909 1416 2048 2048
ReadX 12909 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12909 360 2048 2048
ReadX 12909 368 2048 2048
ReadX 12909 360 2048 2048
ReadX 12909 376 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 1232 2048 2048
ReadX 12909 2432 6144 6144
ReadX 12909 2376 2048 2048
ReadX 12909 2360 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 2376 2048 2048
ReadX 12909 2384 2048 2048
ReadX 12909 2368 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 1296 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 12909 0 2048 2048
ReadX 12909 2688 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 2688 2048 2048
WriteX 12909 2688 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 2688 2048 2048
ReadX 12909 2688 2048 2048
ReadX 12909 2688 2048 2048
WriteX 12909 2688 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12909 2688 2048 2048
ReadX 12909 2688 2048 2048
WriteX 12909 2688 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 320 4096 4096
ReadX 12909 0 2048 2048
ReadX 12909 3584 2048 2048
ReadX 12909 3584 2048 2048
ReadX 12909 3584 2048 2048
ReadX 12909 0 2048 2048
WriteX 12909 3584 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2688 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 2688 2048 2048
ReadX 12909 2688 2048 2048
WriteX 12909 2688 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 3200 2048 2048
ReadX 12909 3200 2048 2048
ReadX 12909 3200 2048 2048
WriteX 12909 3200 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 3456 2048 2048
ReadX 12909 3456 2048 2048
ReadX 12909 3456 2048 2048
WriteX 12909 3456 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2496 2048 2048
ReadX 12909 2472 2048 2048
ReadX 12909 2456 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 2472 2048 2048
ReadX 12909 2480 2048 2048
ReadX 12909 2464 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 2488 2048 2048
ReadX 12909 2568 8192 8192
ReadX 12909 1000 2048 2048
ReadX 12909 328 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 2048 2048 2048
ReadX 12909 2560 2048 2048
ReadX 12909 920 2048 2048
WriteX 12909 2048 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 312 2048 2048
WriteX 12909 336 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 328 2048 2048
WriteX 12909 2560 2048 2048
WriteX 12909 3840 2048 2048
WriteX 12909 920 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2432 2048 2048
WriteX 12909 2432 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2456 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 328 2048 2048
ReadX 12909 2560 2048 2048
ReadX 12909 2048 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 336 2048 2048
ReadX 12909 920 2048 2048
WriteX 12909 1536 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 2048 2048 2048
WriteX 12909 2560 2048 2048
WriteX 12909 336 2048 2048
WriteX 12909 920 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2048 2048 2048
ReadX 12909 2432 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 2048 2048 2048
WriteX 12909 2432 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2456 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1536 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 336 2048 2048
ReadX 12909 920 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 1536 2048 2048
WriteX 12909 336 2048 2048
WriteX 12909 920 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2432 2048 2048
WriteX 12909 2432 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2456 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1536 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 336 2048 2048
ReadX 12909 920 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 1536 2048 2048
WriteX 12909 336 2048 2048
WriteX 12909 920 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2432 2048 2048
WriteX 12909 2432 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2456 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1536 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 336 2048 2048
ReadX 12909 920 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 1536 2048 2048
WriteX 12909 336 2048 2048
WriteX 12909 920 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2432 2048 2048
WriteX 12909 2432 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2456 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1536 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 336 2048 2048
ReadX 12909 920 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 1536 2048 2048
WriteX 12909 336 2048 2048
WriteX 12909 920 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2432 2048 2048
WriteX 12909 2432 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
Flush 12909
ReadX 12909 2456 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1536 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 336 2048 2048
ReadX 12909 920 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 1536 2048 2048
WriteX 12909 336 2048 2048
WriteX 12909 920 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2432 2048 2048
WriteX 12909 2432 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2624 6144 6144
ReadX 12909 2616 2048 2048
ReadX 12909 2688 2048 2048
ReadX 12909 2600 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 2616 2048 2048
ReadX 12909 2608 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 344 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 520 2048 2048
ReadX 12909 1392 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 400 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 536 2048 2048
ReadX 12909 824 2048 2048
ReadX 12909 832 2048 2048
ReadX 12909 384 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 408 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 552 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 824 2048 2048
ReadX 12909 840 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 768 2048 2048
ReadX 12909 2048 2048 2048
WriteX 12909 1415 1 1
WriteX 12909 352 2048 2048
WriteX 12909 1112 2048 2048
WriteX 12909 1400 2048 2048
WriteX 12909 1408 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 2048 2048 2048
WriteX 12909 768 2048 2048
WriteX 12909 344 2048 2048
WriteX 12909 1000 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 416 2048 2048
ReadX 12909 424 2048 2048
ReadX 12909 432 2048 2048
ReadX 12909 440 2048 2048
ReadX 12909 576 16384 16384
ReadX 12909 448 2048 2048
ReadX 12909 456 2048 2048
ReadX 12909 464 2048 2048
ReadX 12909 640 16384 16384
ReadX 12909 704 16384 16384
ReadX 12909 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 12909 848 2048 2048
ReadX 12909 560 2048 2048
ReadX 12909 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 2600 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 352 2048 2048
ReadX 12909 1928 8192 8192
ReadX 12909 528 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 824 2048 2048
ReadX 12909 0 2048 2048
Flush 12909
ReadX 12909 2600 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 352 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 824 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 856 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 392 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 472 2048 2048
ReadX 12909 480 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 488 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 928 2048 2048
ReadX 12909 936 2048 2048
ReadX 12909 976 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 392 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 952 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 528 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 528 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 816 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12909 1336 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 528 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 528 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1240 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2200 4096 4096
ReadX 12909 2152 2048 2048
ReadX 12909 2160 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1312 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 1928 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 824 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1416 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 352 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 824 2048 2048
ReadX 12909 384 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 12909 352 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 768 2048 2048
ReadX 12909 2048 2048 2048
ReadX 12909 352 2048 2048
WriteX 12909 1551 1 1
WriteX 12909 1512 2048 2048
WriteX 12909 1520 2048 2048
WriteX 12909 1528 2048 2048
WriteX 12909 1544 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 2048 2048 2048
WriteX 12909 768 2048 2048
WriteX 12909 344 2048 2048
WriteX 12909 1000 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2048 2048 2048
WriteX 12909 2048 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 1000 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1240 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 344 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 384 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 768 2048 2048
WriteX 12909 1567 1 1
WriteX 12909 1552 2048 2048
WriteX 12909 1560 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 768 2048 2048
WriteX 12909 344 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 1328 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1240 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2200 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1240 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 344 2048 2048
ReadX 12909 384 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 2048 2048 2048
ReadX 12909 768 2048 2048
WriteX 12909 1583 1 1
WriteX 12909 1568 2048 2048
WriteX 12909 1576 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 2048 2048 2048
WriteX 12909 768 2048 2048
WriteX 12909 344 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 864 2048 2048
ReadX 12909 872 2048 2048
ReadX 12909 912 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 2688 2048 2048
ReadX 12909 1000 2048 2048
WriteX 12909 2688 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 2944 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 0 2048 2048
Flush 12909
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 2688 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 2688 2048 2048
WriteX 12909 2688 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 392 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 416 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 416 2048 2048
ReadX 12909 864 2048 2048
ReadX 12909 872 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 312 2048 2048
ReadX 12909 888 2048 2048
ReadX 12909 400 2048 2048
ReadX 12909 896 2048 2048
WriteX 12909 1584 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 400 2048 2048
WriteX 12909 416 2048 2048
WriteX 12909 864 2048 2048
WriteX 12909 872 2048 2048
WriteX 12909 888 2048 2048
WriteX 12909 896 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 584 2048 2048
ReadX 12909 392 2048 2048
WriteX 12909 392 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 1328 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 0 2048 2048
ReadX 12909 408 2048 2048
ReadX 12909 1328 2048 2048
ReadX 12909 864 2048 2048
ReadX 12909 912 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 3840 2048 2048
ReadX 12909 312 2048 2048
ReadX 12909 1584 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 408 2048 2048
WriteX 12909 912 2048 2048
WriteX 12909 1584 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 408 2048 2048
ReadX 12909 392 2048 2048
WriteX 12909 392 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 528 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 528 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 552 2048 2048
ReadX 12909 1336 2048 2048
WriteX 12909 552 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 0 2048 2048
ReadX 12909 552 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 2664 2048 2048
ReadX 12909 2648 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 2672 2048 2048
ReadX 12909 2656 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 12909 528 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 1336 2048 2048
ReadX 12909 2680 2048 2048
ReadX 12909 2760 8192 8192
ReadX 12909 544 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 568 2048 2048
ReadX 12909 544 2048 2048
ReadX 12909 0 2048 2048
Flush 12909
ReadX 12909 2816 6144 6144
ReadX 12909 2760 2048 2048
ReadX 12909 2744 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 2752 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 528 2048 2048
ReadX 12909 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12913
Close 12913
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12915
WriteX 12915 4065 1 1
QUERY_FILE_INFORMATION 12915
WriteX 12915 0 62591 62591
Close 12915
ReadX 12909 0 2048 2048
ReadX 12909 2808 2048 2048
ReadX 12909 2792 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 2800 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 384 2048 2048
ReadX 12909 392 2048 2048
ReadX 12909 1384 2048 2048
ReadX 12909 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12917
Close 12917
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12919
WriteX 12919 4094 1 1
QUERY_FILE_INFORMATION 12919
WriteX 12919 0 10845 10845
Close 12919
ReadX 12909 1432 2048 2048
ReadX 12909 1304 2048 2048
ReadX 12909 1368 2048 2048
ReadX 12909 2304 2048 2048
ReadX 12909 1440 2048 2048
ReadX 12909 1424 2048 2048
ReadX 12909 1448 2048 2048
ReadX 12909 1456 2048 2048
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12921
Close 12921
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12923
ReadX 12909 0 2048 2048
WriteX 12923 4081 1 1
QUERY_FILE_INFORMATION 12923
WriteX 12923 0 30118 30118
Close 12923
ReadX 12909 1344 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1152 2048 2048
ReadX 12909 1152 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 1000 2048 2048
ReadX 12909 768 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 344 2048 2048
WriteX 12909 1000 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 1416 2048 2048
ReadX 12909 1416 2048 2048
ReadX 12909 344 2048 2048
ReadX 12909 896 2048 2048
WriteX 12909 1538 2 2
WriteX 12909 344 2048 2048
WriteX 12909 1416 2048 2048
WriteX 12909 1538 2 2
ReadX 12909 2048 2048 2048
WriteX 12909 2048 2048 2048
WriteX 12909 1538 2 2
Close 12909
Close 12911
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12924
ReadX 12924 0 65471 65471
ReadX 12924 65471 63 63
ReadX 12924 65534 65471 65471
ReadX 12924 131005 63 63
ReadX 12924 131068 65471 65471
ReadX 12924 196539 63 63
ReadX 12924 196602 65471 65471
ReadX 12924 262073 63 63
ReadX 12924 262136 65471 65471
ReadX 12924 327607 63 63
ReadX 12924 327670 10 10
Close 12924
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12925
ReadX 12925 0 65471 65471
ReadX 12925 65471 63 63
ReadX 12925 65534 65471 65471
ReadX 12925 131005 63 63
ReadX 12925 131068 65471 65471
ReadX 12925 196539 63 63
ReadX 12925 196602 65471 65471
ReadX 12925 262073 63 63
ReadX 12925 262136 65471 65471
ReadX 12925 327607 63 63
ReadX 12925 327670 65471 65471
ReadX 12925 393141 63 63
ReadX 12925 393204 65471 65471
ReadX 12925 458675 63 63
ReadX 12925 458738 65471 65471
ReadX 12925 524209 63 63
ReadX 12925 524272 65471 65471
ReadX 12925 589743 63 63
ReadX 12925 589806 65471 65471
ReadX 12925 655277 63 63
ReadX 12925 655340 32 32
Close 12925
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12926
ReadX 12926 0 65471 65471
ReadX 12926 65471 63 63
ReadX 12926 65534 65471 65471
ReadX 12926 131005 63 63
ReadX 12926 131068 65471 65471
ReadX 12926 196539 63 63
ReadX 12926 196602 65471 65471
ReadX 12926 262073 63 63
ReadX 12926 262136 65471 65471
ReadX 12926 327607 63 63
ReadX 12926 327670 65471 65471
ReadX 12926 393141 63 63
ReadX 12926 393204 65471 65471
ReadX 12926 458675 63 63
ReadX 12926 458738 65471 65471
ReadX 12926 524209 63 63
ReadX 12926 524272 65471 65471
ReadX 12926 589743 63 63
ReadX 12926 589806 65471 65471
ReadX 12926 655277 63 63
ReadX 12926 655340 65471 65471
ReadX 12926 720811 63 63
ReadX 12926 720874 65471 65471
ReadX 12926 786345 63 63
ReadX 12926 786408 65471 65471
ReadX 12926 851879 63 63
ReadX 12926 851942 65471 65471
ReadX 12926 917413 63 63
ReadX 12926 917476 65471 65471
ReadX 12926 982947 63 63
ReadX 12926 983010 65471 65471
ReadX 12926 1048481 63 63
ReadX 12926 1048544 65471 65471
ReadX 12926 1114015 63 63
ReadX 12926 1114078 65471 65471
ReadX 12926 1179549 63 63
ReadX 12926 1179612 65471 65471
ReadX 12926 1245083 63 63
ReadX 12926 1245146 65471 65471
ReadX 12926 1310617 63 63
ReadX 12926 1310680 65471 65471
ReadX 12926 1376151 63 63
ReadX 12926 1376214 65471 65471
ReadX 12926 1441685 63 63
ReadX 12926 1441748 65471 65471
ReadX 12926 1507219 63 63
ReadX 12926 1507282 65471 65471
ReadX 12926 1572753 63 63
ReadX 12926 1572816 65471 65471
ReadX 12926 1638287 63 63
ReadX 12926 1638350 65471 65471
ReadX 12926 1703821 63 63
ReadX 12926 1703884 65471 65471
ReadX 12926 1769355 63 63
ReadX 12926 1769418 65471 65471
ReadX 12926 1834889 63 63
ReadX 12926 1834952 32824 32824
Close 12926
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12927
Close 12927
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12928
ReadX 12928 0 24 24
Close 12928
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12929
QUERY_FILE_INFORMATION 12929
ReadX 12929 0 512 512
ReadX 12929 464 512 512
ReadX 12929 498 512 512
ReadX 12929 472 512 512
ReadX 12929 466 512 512
ReadX 12929 978 512 512
ReadX 12929 497 57 57
Close 12929
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12930
QUERY_FILE_INFORMATION 12930
ReadX 12930 0 512 512
ReadX 12930 464 512 512
ReadX 12930 498 512 512
ReadX 12930 472 512 512
ReadX 12930 462 512 512
ReadX 12930 468 512 512
ReadX 12930 466 512 512
QUERY_FILE_INFORMATION 12930
WriteX 12930 482 60 60
WriteX 12930 482 4 4
QUERY_FILE_INFORMATION 12930
WriteX 12930 482 11 11
ReadX 12930 497 57 57
ReadX 12930 497 57 57
ReadX 12930 368 4096 4096
ReadX 12930 460 512 512
ReadX 12930 512 4096 4096
ReadX 12930 4608 4096 4096
ReadX 12930 8704 4096 4096
ReadX 12930 12800 4096 4096
ReadX 12930 16896 4096 4096
ReadX 12930 20992 4096 4096
ReadX 12930 25088 4096 4096
ReadX 12930 29184 4096 4096
ReadX 12930 33280 4096 4096
ReadX 12930 37376 4096 4096
ReadX 12930 41472 4096 4096
ReadX 12930 45568 4096 4096
ReadX 12930 49664 4096 4096
ReadX 12930 53760 4096 4096
ReadX 12930 57856 4096 4096
ReadX 12930 61952 4096 4096
ReadX 12930 66048 4096 4096
ReadX 12930 70144 4096 4096
ReadX 12930 497 20 20
ReadX 12930 496 103 103
ReadX 12930 500 448 448
ReadX 12930 470 512 512
ReadX 12930 486 2692 2692
ReadX 12930 290 4096 4096
ReadX 12930 4386 4096 4096
ReadX 12930 8482 4096 4096
ReadX 12930 500 20 20
ReadX 12930 483 108 108
ReadX 12930 482 292 292
ReadX 12930 338 4096 4096
ReadX 12930 4434 3103 3103
ReadX 12930 384 28 28
ReadX 12930 412 20 20
ReadX 12930 432 8 8
ReadX 12930 440 136 136
ReadX 12930 576 8 8
ReadX 12930 584 4 4
ReadX 12930 588 4 4
ReadX 12930 592 39 39
ReadX 12930 384 4 4
ReadX 12930 388 4 4
ReadX 12930 392 23 23
ReadX 12930 385 4 4
ReadX 12930 389 4 4
ReadX 12930 393 12 12
ReadX 12930 405 4 4
ReadX 12930 409 4 4
ReadX 12930 413 1 1
ReadX 12930 385 4 4
ReadX 12930 389 4 4
ReadX 12930 393 1 1
ReadX 12930 385 4 4
ReadX 12930 389 4 4
ReadX 12930 393 12 12
ReadX 12930 405 4 4
ReadX 12930 409 4 4
ReadX 12930 413 2 2
ReadX 12930 385 4 4
ReadX 12930 389 4 4
ReadX 12930 393 25 25
ReadX 12930 385 4 4
ReadX 12930 389 8 8
ReadX 12930 397 4 4
ReadX 12930 401 8 8
ReadX 12930 409 4 4
ReadX 12930 413 8 8
ReadX 12930 421 4 4
ReadX 12930 425 8 8
ReadX 12930 433 4 4
ReadX 12930 437 4 4
ReadX 12930 441 4 4
ReadX 12930 445 4 4
ReadX 12930 449 4 4
ReadX 12930 453 4 4
ReadX 12930 457 4 4
ReadX 12930 461 4 4
ReadX 12930 465 10670 10670
ReadX 12930 428 4096 4096
WriteX 12930 498 512 512
WriteX 12930 472 512 512
WriteX 12930 462 512 512
WriteX 12930 468 512 512
Close 12930
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12931
Close 12931
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12932
QUERY_FILE_INFORMATION 12932
ReadX 12932 0 512 512
ReadX 12932 464 512 512
ReadX 12932 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12933
Close 12933
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12932
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12935
WriteX 12935 4607 1 1
QUERY_FILE_INFORMATION 12935
WriteX 12935 0 65471 65471
WriteX 12935 65471 65 65
WriteX 12935 65536 19979 19979
Close 12935
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12936
QUERY_FILE_INFORMATION 12936
ReadX 12936 0 512 512
ReadX 12936 462 512 512
ReadX 12936 974 512 512
ReadX 12936 1486 512 512
ReadX 12936 460 512 512
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 470 448 448
QUERY_FILE_INFORMATION 12936
WriteX 12936 470 60 60
WriteX 12936 470 4 4
QUERY_FILE_INFORMATION 12936
WriteX 12936 470 11 11
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 464 512 512
WriteX 12936 976 512 512
WriteX 12936 1488 512 512
WriteX 12936 462 512 512
WriteX 12936 0 512 512
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
ReadX 12936 470 512 512
WriteX 12936 482 512 512
WriteX 12936 482 292 292
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 483 20 20
WriteX 12936 483 108 108
QUERY_FILE_INFORMATION 12936
WriteX 12936 484 448 448
QUERY_FILE_INFORMATION 12936
WriteX 12936 484 44 44
WriteX 12936 484 20 20
WriteX 12936 480 512 512
WriteX 12936 472 512 512
WriteX 12936 476 512 512
WriteX 12936 988 512 512
WriteX 12936 474 512 512
Flush 12936
WriteX 12936 0 512 512
Flush 12936
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 480 512 512
WriteX 12936 472 512 512
WriteX 12936 476 512 512
QUERY_FILE_INFORMATION 12936
WriteX 12936 496 320 320
QUERY_FILE_INFORMATION 12936
WriteX 12936 496 60 60
ReadX 12936 484 512 512
WriteX 12936 500 512 512
WriteX 12936 470 512 512
WriteX 12936 486 2692 2692
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 497 25 25
WriteX 12936 496 103 103
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 497 44 44
WriteX 12936 497 20 20
WriteX 12936 498 512 512
WriteX 12936 462 512 512
WriteX 12936 466 512 512
WriteX 12936 978 512 512
WriteX 12936 464 512 512
Flush 12936
WriteX 12936 0 512 512
Flush 12936
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 497 7 7
WriteX 12936 497 57 57
WriteX 12936 498 512 512
WriteX 12936 472 512 512
WriteX 12936 462 512 512
WriteX 12936 466 512 512
WriteX 12936 978 512 512
Flush 12936
WriteX 12936 498 512 512
Flush 12936
Close 12936
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12937
QUERY_FILE_INFORMATION 12937
ReadX 12937 0 512 512
ReadX 12937 464 512 512
ReadX 12937 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 12938
ReadX 12938 0 20 20
ReadX 12938 14 40 40
ReadX 12938 54 64 64
ReadX 12938 118 1152 1152
Close 12938
Close 12937
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12939
Close 12939
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12940
ReadX 12940 0 24 24
Close 12940
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12941
QUERY_FILE_INFORMATION 12941
ReadX 12941 0 512 512
ReadX 12941 464 512 512
ReadX 12941 498 512 512
ReadX 12941 472 512 512
ReadX 12941 462 512 512
ReadX 12941 466 512 512
ReadX 12941 978 512 512
ReadX 12941 497 57 57
Close 12941
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12942
QUERY_FILE_INFORMATION 12942
ReadX 12942 0 512 512
ReadX 12942 464 512 512
ReadX 12942 498 512 512
ReadX 12942 472 512 512
ReadX 12942 468 512 512
ReadX 12942 462 512 512
ReadX 12942 466 512 512
QUERY_FILE_INFORMATION 12942
WriteX 12942 482 60 60
WriteX 12942 482 4 4
QUERY_FILE_INFORMATION 12942
WriteX 12942 482 11 11
WriteX 12942 498 512 512
WriteX 12942 472 512 512
WriteX 12942 462 512 512
WriteX 12942 466 512 512
WriteX 12942 978 512 512
Close 12942
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 12943
Close 12943
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12944
Close 12944
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12946
WriteX 12946 4607 1 1
QUERY_FILE_INFORMATION 12946
WriteX 12946 0 65471 65471
WriteX 12946 65471 65 65
WriteX 12946 65536 17654 17654
Close 12946
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12947
QUERY_FILE_INFORMATION 12947
ReadX 12947 0 512 512
ReadX 12947 474 512 512
ReadX 12947 986 512 512
ReadX 12947 1498 512 512
ReadX 12947 472 512 512
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
WriteX 12947 482 448 448
QUERY_FILE_INFORMATION 12947
WriteX 12947 482 60 60
WriteX 12947 482 4 4
QUERY_FILE_INFORMATION 12947
WriteX 12947 482 11 11
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
WriteX 12947 476 512 512
WriteX 12947 988 512 512
WriteX 12947 1500 512 512
WriteX 12947 474 512 512
WriteX 12947 0 512 512
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
ReadX 12947 482 512 512
WriteX 12947 494 512 512
WriteX 12947 494 292 292
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
WriteX 12947 495 20 20
WriteX 12947 495 108 108
QUERY_FILE_INFORMATION 12947
WriteX 12947 496 448 448
QUERY_FILE_INFORMATION 12947
WriteX 12947 496 44 44
WriteX 12947 496 20 20
WriteX 12947 492 512 512
WriteX 12947 484 512 512
WriteX 12947 488 512 512
WriteX 12947 1000 512 512
WriteX 12947 486 512 512
Flush 12947
WriteX 12947 0 512 512
Flush 12947
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
WriteX 12947 492 512 512
WriteX 12947 484 512 512
WriteX 12947 488 512 512
QUERY_FILE_INFORMATION 12947
WriteX 12947 508 320 320
QUERY_FILE_INFORMATION 12947
WriteX 12947 508 60 60
ReadX 12947 496 512 512
WriteX 12947 512 512 512
WriteX 12947 482 512 512
WriteX 12947 498 2692 2692
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
WriteX 12947 509 25 25
WriteX 12947 508 103 103
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
WriteX 12947 509 44 44
WriteX 12947 509 20 20
WriteX 12947 510 512 512
WriteX 12947 474 512 512
WriteX 12947 478 512 512
WriteX 12947 990 512 512
WriteX 12947 476 512 512
Flush 12947
WriteX 12947 0 512 512
Flush 12947
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
QUERY_FILE_INFORMATION 12947
WriteX 12947 509 7 7
WriteX 12947 509 57 57
WriteX 12947 510 512 512
WriteX 12947 484 512 512
WriteX 12947 474 512 512
WriteX 12947 478 512 512
WriteX 12947 990 512 512
Flush 12947
WriteX 12947 510 512 512
Flush 12947
Close 12947
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12948
Close 12948
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12949
QUERY_FILE_INFORMATION 12949
ReadX 12949 0 512 512
ReadX 12949 476 512 512
ReadX 12949 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 12950
Close 12950
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 12951
QUERY_FILE_INFORMATION 12951
ReadX 12951 0 512 512
ReadX 12951 512 512 512
ReadX 12951 770 512 512
ReadX 12951 1282 512 512
ReadX 12951 1794 512 512
ReadX 12951 2562 512 512
ReadX 12951 3586 512 512
ReadX 12951 3828 512 512
ReadX 12951 288 512 512
ReadX 12951 1024 512 512
ReadX 12951 954 512 512
ReadX 12951 295 512 512
ReadX 12951 320 512 512
ReadX 12951 322 512 512
ReadX 12951 834 512 512
ReadX 12951 1346 512 512
ReadX 12951 1858 512 512
ReadX 12951 323 512 512
ReadX 12951 835 512 512
ReadX 12951 1347 512 512
ReadX 12951 1859 512 512
ReadX 12951 2371 345 345
ReadX 12951 322 167 167
ReadX 12951 489 512 512
ReadX 12951 1001 512 512
ReadX 12951 1513 512 512
ReadX 12951 2025 512 512
ReadX 12951 2537 512 512
ReadX 12951 3049 512 512
ReadX 12951 3561 345 345
ReadX 12951 323 167 167
ReadX 12951 490 512 512
ReadX 12951 1002 512 512
ReadX 12951 1514 512 512
ReadX 12951 2026 512 512
ReadX 12951 2538 512 512
ReadX 12951 3050 512 512
ReadX 12951 3562 512 512
ReadX 12951 4074 512 512
ReadX 12951 4586 512 512
ReadX 12951 5098 512 512
ReadX 12951 5610 512 512
ReadX 12951 6122 512 512
ReadX 12951 6634 512 512
ReadX 12951 7146 512 512
ReadX 12951 7658 512 512
ReadX 12951 8170 512 512
ReadX 12951 8682 512 512
ReadX 12951 9194 512 512
ReadX 12951 9706 512 512
ReadX 12951 10218 512 512
ReadX 12951 10730 345 345
ReadX 12951 11075 512 512
ReadX 12951 11587 167 167
ReadX 12951 11754 512 512
ReadX 12951 12266 512 512
ReadX 12951 12778 512 512
ReadX 12951 13290 512 512
ReadX 12951 13802 512 512
ReadX 12951 14314 512 512
ReadX 12951 14826 512 512
ReadX 12951 15338 512 512
ReadX 12951 337 512 512
ReadX 12951 337 512 512
ReadX 12951 849 34 34
ReadX 12951 352 512 512
ReadX 12951 864 512 512
ReadX 12951 1376 512 512
ReadX 12951 1888 512 512
ReadX 12951 2400 512 512
ReadX 12951 2912 512 512
ReadX 12951 3424 512 512
ReadX 12951 3936 512 512
ReadX 12951 1632 512 512
ReadX 12951 2144 512 512
ReadX 12951 1682 512 512
ReadX 12951 258 512 512
ReadX 12951 360 144 144
ReadX 12951 2517 512 512
ReadX 12951 3029 512 512
ReadX 12951 1751 512 512
ReadX 12951 2263 512 512
ReadX 12951 2775 512 512
ReadX 12951 3287 512 512
ReadX 12951 3799 512 512
ReadX 12951 4311 512 512
ReadX 12951 4823 512 512
ReadX 12951 5335 512 512
ReadX 12951 5847 512 512
ReadX 12951 6359 512 512
ReadX 12951 6871 512 512
ReadX 12951 7383 512 512
ReadX 12951 7895 512 512
ReadX 12951 8407 512 512
ReadX 12951 8919 512 512
ReadX 12951 9431 512 512
ReadX 12951 9943 512 512
ReadX 12951 10455 512 512
ReadX 12951 10967 512 512
ReadX 12951 11479 512 512
ReadX 12951 2556 512 512
ReadX 12951 3068 512 512
ReadX 12951 3580 512 512
ReadX 12951 4092 512 512
ReadX 12951 4604 512 512
ReadX 12951 5116 512 512
ReadX 12951 5628 512 512
ReadX 12951 6140 512 512
ReadX 12951 6652 512 512
ReadX 12951 7164 512 512
ReadX 12951 7676 512 512
ReadX 12951 8188 512 512
ReadX 12951 8700 512 512
ReadX 12951 9212 512 512
ReadX 12951 9724 512 512
ReadX 12951 10236 512 512
ReadX 12951 10748 512 512
ReadX 12951 11260 512 512
ReadX 12951 11772 512 512
ReadX 12951 12284 512 512
ReadX 12951 12796 49 49
ReadX 12951 260 463 463
ReadX 12951 723 512 512
ReadX 12951 1235 512 512
ReadX 12951 1747 512 512
ReadX 12951 2259 512 512
ReadX 12951 2771 512 512
ReadX 12951 3283 512 512
ReadX 12951 3795 512 512
ReadX 12951 4307 512 512
ReadX 12951 4819 512 512
ReadX 12951 5331 512 512
ReadX 12951 5843 512 512
ReadX 12951 6355 512 512
ReadX 12951 6867 512 512
ReadX 12951 7379 512 512
ReadX 12951 7891 512 512
ReadX 12951 8403 512 512
ReadX 12951 8915 512 512
ReadX 12951 9427 512 512
ReadX 12951 9939 512 512
ReadX 12951 10451 512 512
ReadX 12951 10963 402 402
ReadX 12951 593 240 240
ReadX 12951 2048 272 272
ReadX 12951 2320 512 512
ReadX 12951 2832 512 512
ReadX 12951 3344 512 512
ReadX 12951 3856 512 512
ReadX 12951 4368 512 512
ReadX 12951 4880 512 512
ReadX 12951 5392 240 240
ReadX 12951 608 272 272
ReadX 12951 880 512 512
ReadX 12951 1392 512 512
ReadX 12951 1904 512 512
ReadX 12951 2416 512 512
ReadX 12951 2928 512 512
ReadX 12951 3440 512 512
ReadX 12951 3952 512 512
ReadX 12951 4464 512 512
ReadX 12951 4976 512 512
ReadX 12951 5488 512 512
ReadX 12951 6000 512 512
ReadX 12951 6512 512 512
ReadX 12951 7024 512 512
ReadX 12951 7536 512 512
ReadX 12951 8048 512 512
ReadX 12951 8560 512 512
ReadX 12951 9072 512 512
ReadX 12951 9584 512 512
ReadX 12951 10096 512 512
ReadX 12951 1683 512 512
ReadX 12951 514 512 512
ReadX 12951 620 512 512
ReadX 12951 770 512 512
ReadX 12951 1282 512 512
ReadX 12951 1794 512 512
ReadX 12951 2000 512 512
ReadX 12951 1434 512 512
ReadX 12951 2050 512 512
ReadX 12951 2118 512 512
ReadX 12951 1715 512 512
ReadX 12951 1024 512 512
ReadX 12951 954 512 512
ReadX 12951 1880 512 512
ReadX 12951 1286 512 512
ReadX 12951 1510 512 512
ReadX 12951 2562 512 512
ReadX 12951 2610 512 512
ReadX 12951 3586 512 512
ReadX 12951 3812 512 512
ReadX 12951 3828 512 512
ReadX 12951 4046 512 512
ReadX 12951 4066 512 512
ReadX 12951 1747 512 512
ReadX 12951 1026 512 512
ReadX 12951 1538 512 512
ReadX 12951 514 512 512
ReadX 12951 751 512 512
ReadX 12951 1263 512 512
ReadX 12951 620 512 512
ReadX 12951 1132 512 512
ReadX 12951 1644 512 512
ReadX 12951 2156 512 512
ReadX 12951 2668 512 512
ReadX 12951 3180 512 512
ReadX 12951 3692 512 512
ReadX 12951 4204 394 394
ReadX 12951 606 118 118
ReadX 12951 724 512 512
ReadX 12951 1236 512 512
ReadX 12951 1748 512 512
ReadX 12951 2260 512 512
ReadX 12951 2772 512 512
ReadX 12951 3284 512 512
ReadX 12951 3796 394 394
ReadX 12951 636 118 118
ReadX 12951 754 512 512
ReadX 12951 1266 512 512
ReadX 12951 1778 512 512
ReadX 12951 2290 512 512
ReadX 12951 2802 512 512
ReadX 12951 3314 512 512
ReadX 12951 3826 512 512
ReadX 12951 4338 512 512
ReadX 12951 4850 512 512
ReadX 12951 5362 512 512
ReadX 12951 5874 512 512
ReadX 12951 6386 512 512
ReadX 12951 6898 512 512
ReadX 12951 7410 512 512
ReadX 12951 7922 512 512
ReadX 12951 8434 512 512
ReadX 12951 8946 512 512
ReadX 12951 9458 512 512
ReadX 12951 9970 512 512
ReadX 12951 10482 512 512
ReadX 12951 723 512 512
ReadX 12951 1235 512 512
ReadX 12951 725 512 512
ReadX 12951 729 512 512
ReadX 12951 1241 512 512
ReadX 12951 1753 512 512
ReadX 12951 2265 512 512
ReadX 12951 2777 512 512
ReadX 12951 3289 512 512
ReadX 12951 3801 512 512
ReadX 12951 4313 512 512
ReadX 12951 4825 512 512
ReadX 12951 5337 512 512
ReadX 12951 5849 512 512
ReadX 12951 6361 512 512
ReadX 12951 755 512 512
ReadX 12951 1267 512 512
ReadX 12951 1779 512 512
ReadX 12951 2291 512 512
ReadX 12951 2803 512 512
ReadX 12951 3315 512 512
ReadX 12951 3827 512 512
ReadX 12951 4339 244 244
ReadX 12951 4583 512 512
ReadX 12951 5095 268 268
ReadX 12951 5363 512 512
ReadX 12951 5875 512 512
ReadX 12951 6387 512 512
ReadX 12951 6899 512 512
ReadX 12951 7411 512 512
ReadX 12951 7923 512 512
ReadX 12951 8435 512 512
ReadX 12951 8947 512 512
ReadX 12951 9459 512 512
ReadX 12951 9971 512 512
ReadX 12951 10483 512 512
ReadX 12951 10995 512 512
ReadX 12951 11507 512 512
ReadX 12951 12019 512 512
ReadX 12951 12531 512 512
ReadX 12951 13043 512 512
ReadX 12951 13555 512 512
ReadX 12951 14067 512 512
ReadX 12951 14579 512 512
ReadX 12951 15091 512 512
ReadX 12951 15603 342 342
ReadX 12951 725 512 512
ReadX 12951 2000 512 512
ReadX 12951 3918 512 512
ReadX 12951 727 512 512
ReadX 12951 258 512 512
ReadX 12951 376 512 512
ReadX 12951 1109 512 512
ReadX 12951 1028 512 512
ReadX 12951 1540 512 512
ReadX 12951 2052 512 512
ReadX 12951 2564 512 512
ReadX 12951 3076 512 512
ReadX 12951 3588 512 512
ReadX 12951 4100 512 512
ReadX 12951 4612 412 412
ReadX 12951 1012 100 100
ReadX 12951 1112 512 512
ReadX 12951 1624 512 512
ReadX 12951 2136 512 512
ReadX 12951 2648 512 512
ReadX 12951 3160 512 512
ReadX 12951 3672 512 512
ReadX 12951 4184 412 412
ReadX 12951 1044 100 100
ReadX 12951 1144 512 512
ReadX 12951 1656 512 512
ReadX 12951 2168 512 512
ReadX 12951 2680 512 512
ReadX 12951 3192 512 512
ReadX 12951 3704 512 512
ReadX 12951 4216 512 512
ReadX 12951 4728 512 512
ReadX 12951 5240 512 512
ReadX 12951 5752 512 512
ReadX 12951 6264 512 512
ReadX 12951 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 12951 7288 512 512
ReadX 12951 7800 512 512
ReadX 12951 8312 512 512
ReadX 12951 8824 512 512
ReadX 12951 9336 512 512
ReadX 12951 9848 512 512
ReadX 12951 10360 512 512
ReadX 12951 10872 512 512
ReadX 12951 11384 512 512
ReadX 12951 11896 512 512
ReadX 12951 12408 512 512
ReadX 12951 1088 512 512
ReadX 12951 1600 512 512
ReadX 12951 1090 512 512
ReadX 12951 1094 512 512
ReadX 12951 1606 512 512
ReadX 12951 2118 512 512
ReadX 12951 2630 512 512
ReadX 12951 3142 512 512
ReadX 12951 3654 512 512
ReadX 12951 4166 512 512
ReadX 12951 4678 512 512
ReadX 12951 1111 512 512
ReadX 12951 1623 512 512
ReadX 12951 2135 512 512
ReadX 12951 2647 512 512
ReadX 12951 3159 512 512
ReadX 12951 3671 512 512
ReadX 12951 4183 512 512
ReadX 12951 4695 512 512
ReadX 12951 5207 512 512
ReadX 12951 5719 512 512
ReadX 12951 6231 512 512
ReadX 12951 6743 512 512
ReadX 12951 7255 512 512
ReadX 12951 7767 512 512
ReadX 12951 8279 512 512
ReadX 12951 8791 512 512
ReadX 12951 9303 512 512
ReadX 12951 9815 512 512
ReadX 12951 10327 512 512
ReadX 12951 10839 512 512
ReadX 12951 11351 294 294
ReadX 12951 1091 512 512
ReadX 12951 970 512 512
ReadX 12951 1093 512 512
ReadX 12951 1434 512 512
ReadX 12951 2050 512 512
ReadX 12951 2158 512 512
ReadX 12951 2118 512 512
ReadX 12951 2630 512 512
ReadX 12951 3142 512 512
ReadX 12951 3654 512 512
ReadX 12951 4166 512 512
ReadX 12951 4678 512 512
ReadX 12951 5190 512 512
ReadX 12951 5702 382 382
ReadX 12951 2104 130 130
ReadX 12951 2234 512 512
ReadX 12951 2746 512 512
ReadX 12951 3258 512 512
ReadX 12951 3770 512 512
ReadX 12951 4282 512 512
ReadX 12951 4794 512 512
ReadX 12951 5306 382 382
ReadX 12951 2134 130 130
ReadX 12951 2264 512 512
ReadX 12951 2776 512 512
ReadX 12951 3288 512 512
ReadX 12951 3800 512 512
ReadX 12951 4312 512 512
ReadX 12951 4824 512 512
ReadX 12951 5336 512 512
ReadX 12951 2147 512 512
ReadX 12951 2149 512 512
ReadX 12951 2152 512 512
ReadX 12951 2664 512 512
ReadX 12951 3176 512 512
ReadX 12951 3688 512 512
ReadX 12951 2159 512 512
ReadX 12951 2671 512 512
ReadX 12951 3183 512 512
ReadX 12951 3695 512 512
ReadX 12951 4207 512 512
ReadX 12951 4719 512 512
ReadX 12951 5231 512 512
ReadX 12951 5743 512 512
ReadX 12951 6255 512 512
ReadX 12951 6767 512 512
ReadX 12951 7279 512 512
ReadX 12951 7791 512 512
ReadX 12951 8303 512 512
ReadX 12951 8815 512 512
ReadX 12951 9327 512 512
ReadX 12951 9839 512 512
ReadX 12951 10351 512 512
ReadX 12951 10863 512 512
ReadX 12951 11375 512 512
ReadX 12951 11887 512 512
ReadX 12951 12399 38 38
ReadX 12951 2149 512 512
ReadX 12951 1794 512 512
ReadX 12951 2016 512 512
ReadX 12951 2151 512 512
ReadX 12951 1918 512 512
ReadX 12951 1880 512 512
ReadX 12951 2392 512 512
ReadX 12951 2904 512 512
ReadX 12951 3416 512 512
ReadX 12951 3928 512 512
ReadX 12951 4440 512 512
ReadX 12951 4952 512 512
ReadX 12951 5464 416 416
ReadX 12951 1866 96 96
ReadX 12951 1962 512 512
ReadX 12951 2474 512 512
ReadX 12951 2986 512 512
ReadX 12951 3498 512 512
ReadX 12951 4010 512 512
ReadX 12951 4522 512 512
ReadX 12951 5034 416 416
ReadX 12951 1896 96 96
ReadX 12951 1992 512 512
ReadX 12951 2504 512 512
ReadX 12951 3016 512 512
ReadX 12951 3528 512 512
ReadX 12951 1903 512 512
ReadX 12951 1905 512 512
ReadX 12951 1908 512 512
ReadX 12951 2420 512 512
ReadX 12951 2932 512 512
ReadX 12951 3444 512 512
ReadX 12951 3956 512 512
ReadX 12951 1919 512 512
ReadX 12951 2431 512 512
ReadX 12951 2943 512 512
ReadX 12951 3455 512 512
ReadX 12951 3967 512 512
ReadX 12951 4479 512 512
ReadX 12951 4991 512 512
ReadX 12951 5503 512 512
ReadX 12951 6015 512 512
ReadX 12951 6527 512 512
ReadX 12951 7039 512 512
ReadX 12951 7551 512 512
ReadX 12951 8063 512 512
ReadX 12951 8575 512 512
ReadX 12951 9087 512 512
ReadX 12951 9599 512 512
ReadX 12951 10111 512 512
ReadX 12951 10623 512 512
ReadX 12951 11135 512 512
ReadX 12951 11647 512 512
ReadX 12951 12159 322 322
ReadX 12951 1905 512 512
ReadX 12951 1846 512 512
ReadX 12951 1907 512 512
ReadX 12951 1860 268 268
ReadX 12951 1832 244 244
ReadX 12951 1846 512 512
ReadX 12951 2358 512 512
ReadX 12951 2870 512 512
ReadX 12951 3382 512 512
ReadX 12951 3894 512 512
ReadX 12951 4406 512 512
ReadX 12951 4918 512 512
ReadX 12951 1858 512 512
ReadX 12951 1859 512 512
ReadX 12951 1860 488 488
ReadX 12951 1832 24 24
ReadX 12951 1861 228 228
ReadX 12951 1832 284 284
ReadX 12951 2116 512 512
ReadX 12951 2628 512 512
ReadX 12951 3140 512 512
ReadX 12951 3652 512 512
ReadX 12951 4164 512 512
ReadX 12951 4676 512 512
ReadX 12951 5188 228 228
ReadX 12951 1862 284 284
ReadX 12951 2146 512 512
ReadX 12951 2658 38 38
ReadX 12951 1859 512 512
ReadX 12951 2047 512 512
ReadX 12951 2016 512 512
ReadX 12951 2528 512 512
ReadX 12951 3040 512 512
ReadX 12951 3552 512 512
ReadX 12951 4064 512 512
ReadX 12951 4576 512 512
ReadX 12951 5088 512 512
ReadX 12951 5600 424 424
ReadX 12951 2002 88 88
ReadX 12951 2090 512 512
ReadX 12951 2602 512 512
ReadX 12951 3114 512 512
ReadX 12951 3626 512 512
ReadX 12951 4138 512 512
ReadX 12951 4650 512 512
ReadX 12951 5162 424 424
ReadX 12951 2032 88 88
ReadX 12951 2120 512 512
ReadX 12951 2632 512 512
ReadX 12951 3144 512 512
ReadX 12951 3656 512 512
ReadX 12951 4168 512 512
ReadX 12951 4680 512 512
ReadX 12951 5192 512 512
ReadX 12951 2044 512 512
ReadX 12951 2045 512 512
ReadX 12951 2046 512 512
ReadX 12951 2047 512 512
ReadX 12951 2559 110 110
ReadX 12951 2052 402 402
ReadX 12951 2454 512 512
ReadX 12951 2966 512 512
ReadX 12951 3478 512 512
ReadX 12951 3990 512 512
ReadX 12951 4502 512 512
ReadX 12951 5014 512 512
ReadX 12951 5526 512 512
ReadX 12951 6038 512 512
ReadX 12951 6550 512 512
ReadX 12951 7062 512 512
ReadX 12951 7574 512 512
ReadX 12951 8086 512 512
ReadX 12951 8598 512 512
ReadX 12951 9110 512 512
ReadX 12951 9622 512 512
ReadX 12951 10134 512 512
ReadX 12951 10646 512 512
ReadX 12951 11158 512 512
ReadX 12951 11670 512 512
ReadX 12951 12182 512 512
ReadX 12951 12694 118 118
ReadX 12951 2045 512 512
ReadX 12951 1282 512 512
ReadX 12951 1343 512 512
ReadX 12951 1286 512 512
ReadX 12951 1798 512 512
ReadX 12951 2310 512 512
ReadX 12951 2822 512 512
ReadX 12951 3334 512 512
ReadX 12951 3846 512 512
ReadX 12951 4358 512 512
ReadX 12951 4870 416 416
ReadX 12951 1270 96 96
ReadX 12951 1366 512 512
ReadX 12951 1878 512 512
ReadX 12951 2390 512 512
ReadX 12951 2902 512 512
ReadX 12951 3414 512 512
ReadX 12951 3926 416 416
ReadX 12951 1284 96 96
ReadX 12951 1380 416 416
ReadX 12951 1302 96 96
ReadX 12951 1398 512 512
ReadX 12951 1910 512 512
ReadX 12951 2422 512 512
ReadX 12951 2934 512 512
ReadX 12951 3446 512 512
ReadX 12951 3958 512 512
ReadX 12951 4470 512 512
ReadX 12951 4982 512 512
ReadX 12951 5494 512 512
ReadX 12951 6006 512 512
ReadX 12951 6518 512 512
ReadX 12951 7030 512 512
ReadX 12951 7542 512 512
ReadX 12951 1328 512 512
ReadX 12951 1330 512 512
ReadX 12951 1333 512 512
ReadX 12951 1845 512 512
ReadX 12951 2357 512 512
ReadX 12951 2869 512 512
ReadX 12951 3381 512 512
ReadX 12951 1344 512 512
ReadX 12951 1856 512 512
ReadX 12951 2368 512 512
ReadX 12951 2880 512 512
ReadX 12951 3392 512 512
ReadX 12951 3904 512 512
ReadX 12951 4416 512 512
ReadX 12951 4928 512 512
ReadX 12951 5440 512 512
ReadX 12951 5952 512 512
ReadX 12951 6464 512 512
ReadX 12951 6976 512 512
ReadX 12951 7488 512 512
ReadX 12951 8000 512 512
ReadX 12951 8512 512 512
ReadX 12951 9024 512 512
ReadX 12951 9536 512 512
ReadX 12951 10048 512 512
ReadX 12951 10560 512 512
ReadX 12951 11072 512 512
ReadX 12951 11584 426 426
ReadX 12951 1330 512 512
ReadX 12951 1842 512 512
ReadX 12951 1250 512 512
ReadX 12951 1264 268 268
ReadX 12951 1236 244 244
ReadX 12951 1250 512 512
ReadX 12951 1762 512 512
ReadX 12951 2274 512 512
ReadX 12951 2786 512 512
ReadX 12951 3298 512 512
ReadX 12951 3810 512 512
ReadX 12951 4322 512 512
ReadX 12951 1262 512 512
ReadX 12951 1263 512 512
ReadX 12951 1264 488 488
ReadX 12951 1236 24 24
ReadX 12951 1265 228 228
ReadX 12951 1236 284 284
ReadX 12951 1520 512 512
ReadX 12951 2032 512 512
ReadX 12951 2544 512 512
ReadX 12951 3056 512 512
ReadX 12951 3568 512 512
ReadX 12951 4080 512 512
ReadX 12951 4592 228 228
ReadX 12951 1266 284 284
ReadX 12951 1550 512 512
ReadX 12951 2062 42 42
ReadX 12951 1263 512 512
ReadX 12951 1538 512 512
ReadX 12951 1640 512 512
ReadX 12951 1510 512 512
ReadX 12951 2022 512 512
ReadX 12951 2534 512 512
ReadX 12951 3046 512 512
ReadX 12951 3558 512 512
ReadX 12951 4070 512 512
ReadX 12951 4582 512 512
ReadX 12951 5094 408 408
ReadX 12951 1496 104 104
ReadX 12951 1600 512 512
ReadX 12951 2112 512 512
ReadX 12951 2624 512 512
ReadX 12951 3136 512 512
ReadX 12951 3648 512 512
ReadX 12951 4160 512 512
ReadX 12951 4672 408 408
ReadX 12951 1526 104 104
ReadX 12951 1630 512 512
ReadX 12951 2142 512 512
ReadX 12951 2654 512 512
ReadX 12951 3166 512 512
ReadX 12951 3678 512 512
ReadX 12951 4190 408 408
ReadX 12951 1540 104 104
ReadX 12951 1644 512 512
ReadX 12951 2156 512 512
ReadX 12951 2668 512 512
ReadX 12951 3180 512 512
ReadX 12951 3692 512 512
ReadX 12951 4204 512 512
ReadX 12951 4716 512 512
ReadX 12951 5228 512 512
ReadX 12951 5740 512 512
ReadX 12951 6252 512 512
ReadX 12951 6764 512 512
ReadX 12951 7276 512 512
ReadX 12951 7788 512 512
ReadX 12951 8300 512 512
ReadX 12951 8812 512 512
ReadX 12951 9324 512 512
ReadX 12951 9836 512 512
ReadX 12951 10348 512 512
ReadX 12951 10860 512 512
ReadX 12951 11372 512 512
ReadX 12951 1615 512 512
ReadX 12951 2127 512 512
ReadX 12951 1617 512 512
ReadX 12951 1621 512 512
ReadX 12951 2133 512 512
ReadX 12951 2645 512 512
ReadX 12951 3157 512 512
ReadX 12951 3669 512 512
ReadX 12951 4181 512 512
ReadX 12951 4693 512 512
ReadX 12951 5205 512 512
ReadX 12951 5717 512 512
ReadX 12951 6229 512 512
ReadX 12951 1641 512 512
ReadX 12951 2153 512 512
ReadX 12951 2665 512 512
ReadX 12951 3177 512 512
ReadX 12951 3689 512 512
ReadX 12951 4201 512 512
ReadX 12951 4713 512 512
ReadX 12951 5225 512 512
ReadX 12951 5737 512 512
ReadX 12951 6249 512 512
ReadX 12951 6761 512 512
ReadX 12951 7273 512 512
ReadX 12951 7785 512 512
ReadX 12951 8297 512 512
ReadX 12951 8809 512 512
ReadX 12951 9321 512 512
ReadX 12951 9833 512 512
ReadX 12951 10345 512 512
ReadX 12951 10857 512 512
ReadX 12951 11369 512 512
ReadX 12951 11881 2 2
ReadX 12951 1796 510 510
ReadX 12951 2306 512 512
ReadX 12951 2818 512 512
ReadX 12951 3330 512 512
ReadX 12951 3842 512 512
ReadX 12951 4354 512 512
ReadX 12951 4866 512 512
ReadX 12951 5378 512 512
ReadX 12951 5890 512 512
ReadX 12951 6402 512 512
ReadX 12951 6914 512 512
ReadX 12951 7426 512 512
ReadX 12951 7938 512 512
ReadX 12951 8450 512 512
ReadX 12951 8962 512 512
ReadX 12951 9474 512 512
ReadX 12951 9986 512 512
ReadX 12951 10498 326 326
ReadX 12951 1617 512 512
ReadX 12951 2129 512 512
ReadX 12951 1450 512 512
ReadX 12951 1621 512 512
ReadX 12951 1446 512 512
ReadX 12951 1450 512 512
ReadX 12951 1962 512 512
ReadX 12951 2474 512 512
ReadX 12951 2986 512 512
ReadX 12951 3498 512 512
ReadX 12951 4010 512 512
ReadX 12951 4522 512 512
ReadX 12951 5034 424 424
ReadX 12951 1436 88 88
ReadX 12951 1524 512 512
ReadX 12951 2036 512 512
ReadX 12951 2548 512 512
ReadX 12951 3060 512 512
ReadX 12951 1442 512 512
ReadX 12951 1443 512 512
ReadX 12951 1444 512 512
ReadX 12951 1446 512 512
ReadX 12951 1958 386 386
ReadX 12951 1466 126 126
ReadX 12951 1592 512 512
ReadX 12951 2104 512 512
ReadX 12951 2616 512 512
ReadX 12951 3128 512 512
ReadX 12951 3640 512 512
ReadX 12951 4152 512 512
ReadX 12951 4664 512 512
ReadX 12951 5176 512 512
ReadX 12951 5688 512 512
ReadX 12951 6200 512 512
ReadX 12951 6712 512 512
ReadX 12951 7224 512 512
ReadX 12951 7736 512 512
ReadX 12951 8248 512 512
ReadX 12951 8760 294 294
ReadX 12951 1443 512 512
ReadX 12951 964 512 512
ReadX 12951 970 512 512
ReadX 12951 1482 512 512
ReadX 12951 1994 512 512
ReadX 12951 2506 512 512
ReadX 12951 3018 512 512
ReadX 12951 3530 512 512
ReadX 12951 4042 512 512
ReadX 12951 4554 424 424
ReadX 12951 956 88 88
ReadX 12951 1044 512 512
ReadX 12951 1556 512 512
ReadX 12951 2068 512 512
ReadX 12951 2580 512 512
ReadX 12951 962 512 512
ReadX 12951 963 512 512
ReadX 12951 964 512 512
ReadX 12951 965 512 512
ReadX 12951 1477 512 512
ReadX 12951 1989 228 228
ReadX 12951 986 284 284
ReadX 12951 1270 512 512
ReadX 12951 1782 512 512
ReadX 12951 2294 512 512
ReadX 12951 2806 512 512
ReadX 12951 3318 512 512
ReadX 12951 3830 512 512
ReadX 12951 4342 512 512
ReadX 12951 4854 512 512
ReadX 12951 5366 512 512
ReadX 12951 5878 512 512
ReadX 12951 6390 512 512
ReadX 12951 6902 512 512
ReadX 12951 7414 42 42
ReadX 12951 963 512 512
ReadX 12951 2610 512 512
ReadX 12951 3812 512 512
ReadX 12951 3828 512 512
ReadX 12951 3969 512 512
ReadX 12951 3918 512 512
ReadX 12951 4430 512 512
ReadX 12951 4942 512 512
ReadX 12951 5454 512 512
ReadX 12951 5966 512 512
ReadX 12951 6478 512 512
ReadX 12951 6990 512 512
ReadX 12951 7502 424 424
ReadX 12951 3904 88 88
ReadX 12951 3992 512 512
ReadX 12951 4504 512 512
ReadX 12951 5016 512 512
ReadX 12951 5528 512 512
ReadX 12951 6040 512 512
ReadX 12951 6552 512 512
ReadX 12951 7064 424 424
ReadX 12951 3934 88 88
ReadX 12951 4022 512 512
ReadX 12951 4534 512 512
ReadX 12951 5046 512 512
ReadX 12951 5558 512 512
ReadX 12951 6070 512 512
ReadX 12951 6582 512 512
ReadX 12951 7094 512 512
ReadX 12951 7606 512 512
ReadX 12951 8118 512 512
ReadX 12951 8630 512 512
ReadX 12951 3953 512 512
ReadX 12951 4465 512 512
ReadX 12951 3956 512 512
ReadX 12951 3964 512 512
ReadX 12951 4476 512 512
ReadX 12951 4988 512 512
ReadX 12951 3970 512 512
ReadX 12951 4482 512 512
ReadX 12951 4994 512 512
ReadX 12951 5506 512 512
ReadX 12951 6018 512 512
ReadX 12951 6530 512 512
ReadX 12951 7042 512 512
ReadX 12951 7554 512 512
ReadX 12951 8066 512 512
ReadX 12951 8578 512 512
ReadX 12951 9090 512 512
ReadX 12951 9602 512 512
ReadX 12951 10114 512 512
ReadX 12951 10626 512 512
ReadX 12951 11138 512 512
ReadX 12951 11650 512 512
ReadX 12951 12162 512 512
ReadX 12951 12674 512 512
ReadX 12951 13186 512 512
ReadX 12951 13698 512 512
ReadX 12951 14210 134 134
ReadX 12951 3956 512 512
ReadX 12951 4468 512 512
ReadX 12951 4980 512 512
ReadX 12951 5492 512 512
ReadX 12951 3074 512 512
ReadX 12951 3246 512 512
ReadX 12951 3964 512 512
ReadX 12951 3330 512 512
ReadX 12951 3465 512 512
ReadX 12951 3246 512 512
ReadX 12951 3758 512 512
ReadX 12951 4270 512 512
ReadX 12951 4782 512 512
ReadX 12951 5294 512 512
ReadX 12951 5806 512 512
ReadX 12951 6318 512 512
ReadX 12951 6830 368 368
ReadX 12951 3232 144 144
ReadX 12951 3376 512 512
ReadX 12951 3888 512 512
ReadX 12951 4400 512 512
ReadX 12951 4912 512 512
ReadX 12951 5424 512 512
ReadX 12951 5936 512 512
ReadX 12951 6448 368 368
ReadX 12951 3262 144 144
ReadX 12951 3406 512 512
ReadX 12951 3918 512 512
ReadX 12951 4430 512 512
ReadX 12951 4942 512 512
ReadX 12951 5454 512 512
ReadX 12951 5966 512 512
ReadX 12951 6478 512 512
ReadX 12951 6990 512 512
ReadX 12951 7502 512 512
ReadX 12951 8014 512 512
ReadX 12951 8526 512 512
ReadX 12951 9038 512 512
ReadX 12951 9550 512 512
ReadX 12951 10062 512 512
ReadX 12951 10574 512 512
ReadX 12951 11086 512 512
ReadX 12951 11598 512 512
ReadX 12951 12110 512 512
ReadX 12951 12622 512 512
ReadX 12951 13134 512 512
ReadX 12951 13646 368 368
ReadX 12951 3332 144 144
ReadX 12951 3476 512 512
ReadX 12951 3988 512 512
ReadX 12951 4500 512 512
ReadX 12951 5012 512 512
ReadX 12951 5524 512 512
ReadX 12951 6036 512 512
ReadX 12951 6548 512 512
ReadX 12951 7060 512 512
ReadX 12951 7572 512 512
ReadX 12951 8084 512 512
ReadX 12951 8596 512 512
ReadX 12951 9108 512 512
ReadX 12951 9620 512 512
ReadX 12951 10132 512 512
ReadX 12951 10644 512 512
ReadX 12951 11156 512 512
ReadX 12951 11668 512 512
ReadX 12951 12180 512 512
ReadX 12951 12692 512 512
ReadX 12951 13204 512 512
ReadX 12951 3430 512 512
ReadX 12951 3942 512 512
ReadX 12951 3434 512 512
ReadX 12951 3435 512 512
ReadX 12951 3947 512 512
ReadX 12951 4459 512 512
ReadX 12951 4971 512 512
ReadX 12951 5483 512 512
ReadX 12951 5995 512 512
ReadX 12951 6507 512 512
ReadX 12951 7019 512 512
ReadX 12951 7531 512 512
ReadX 12951 8043 512 512
ReadX 12951 8555 512 512
ReadX 12951 9067 512 512
ReadX 12951 9579 512 512
ReadX 12951 10091 512 512
ReadX 12951 10603 512 512
ReadX 12951 11115 512 512
ReadX 12951 3467 512 512
ReadX 12951 3979 512 512
ReadX 12951 4491 512 512
ReadX 12951 5003 512 512
ReadX 12951 5515 512 512
ReadX 12951 6027 512 512
ReadX 12951 6539 512 512
ReadX 12951 7051 512 512
ReadX 12951 7563 512 512
ReadX 12951 8075 512 512
ReadX 12951 8587 512 512
ReadX 12951 9099 512 512
ReadX 12951 9611 512 512
ReadX 12951 10123 512 512
ReadX 12951 10635 512 512
ReadX 12951 11147 512 512
ReadX 12951 11659 512 512
ReadX 12951 12171 512 512
ReadX 12951 12683 512 512
ReadX 12951 13195 512 512
ReadX 12951 13707 56 56
ReadX 12951 13763 512 512
ReadX 12951 14275 456 456
ReadX 12951 14731 512 512
ReadX 12951 15243 512 512
ReadX 12951 15755 512 512
ReadX 12951 16267 512 512
ReadX 12951 16779 512 512
ReadX 12951 17291 512 512
ReadX 12951 17803 512 512
ReadX 12951 18315 512 512
ReadX 12951 18827 512 512
ReadX 12951 19339 512 512
ReadX 12951 19851 512 512
ReadX 12951 20363 512 512
ReadX 12951 20875 512 512
ReadX 12951 21387 512 512
ReadX 12951 21899 512 512
ReadX 12951 22411 512 512
ReadX 12951 22923 512 512
ReadX 12951 23435 512 512
ReadX 12951 23947 512 512
ReadX 12951 24459 512 512
ReadX 12951 24971 282 282
ReadX 12951 3434 512 512
ReadX 12951 2818 512 512
ReadX 12951 2870 512 512
ReadX 12951 3026 512 512
ReadX 12951 3538 512 512
ReadX 12951 2870 512 512
ReadX 12951 3382 512 512
ReadX 12951 3894 512 512
ReadX 12951 4406 512 512
ReadX 12951 4918 512 512
ReadX 12951 5430 512 512
ReadX 12951 5942 512 512
ReadX 12951 6454 374 374
ReadX 12951 2856 138 138
ReadX 12951 2994 512 512
ReadX 12951 3506 512 512
ReadX 12951 4018 512 512
ReadX 12951 4530 512 512
ReadX 12951 5042 512 512
ReadX 12951 5554 512 512
ReadX 12951 6066 374 374
ReadX 12951 2886 138 138
ReadX 12951 3024 512 512
ReadX 12951 3536 512 512
ReadX 12951 4048 512 512
ReadX 12951 4560 512 512
ReadX 12951 5072 512 512
ReadX 12951 5584 512 512
ReadX 12951 6096 512 512
ReadX 12951 6608 512 512
ReadX 12951 7120 512 512
ReadX 12951 7632 512 512
ReadX 12951 8144 512 512
ReadX 12951 8656 512 512
ReadX 12951 9168 512 512
ReadX 12951 9680 512 512
ReadX 12951 10192 512 512
ReadX 12951 10704 512 512
ReadX 12951 11216 512 512
ReadX 12951 11728 512 512
ReadX 12951 12240 512 512
ReadX 12951 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 12951 13264 512 512
ReadX 12951 13776 512 512
ReadX 12951 14288 512 512
ReadX 12951 14800 512 512
ReadX 12951 15312 512 512
ReadX 12951 15824 512 512
ReadX 12951 16336 512 512
ReadX 12951 16848 512 512
ReadX 12951 17360 512 512
ReadX 12951 17872 512 512
ReadX 12951 18384 512 512
ReadX 12951 18896 512 512
ReadX 12951 19408 512 512
ReadX 12951 19920 512 512
ReadX 12951 20432 512 512
ReadX 12951 20944 512 512
ReadX 12951 21456 512 512
ReadX 12951 21968 512 512
ReadX 12951 22480 512 512
ReadX 12951 22992 512 512
ReadX 12951 2998 512 512
ReadX 12951 3510 512 512
ReadX 12951 3001 512 512
ReadX 12951 3003 512 512
ReadX 12951 3515 512 512
ReadX 12951 4027 512 512
ReadX 12951 4539 512 512
ReadX 12951 5051 512 512
ReadX 12951 5563 512 512
ReadX 12951 6075 512 512
ReadX 12951 6587 512 512
ReadX 12951 7099 512 512
ReadX 12951 7611 512 512
ReadX 12951 8123 512 512
ReadX 12951 8635 512 512
ReadX 12951 3029 512 512
ReadX 12951 3541 512 512
ReadX 12951 4053 512 512
ReadX 12951 4565 512 512
ReadX 12951 5077 512 512
ReadX 12951 5589 512 512
ReadX 12951 6101 512 512
ReadX 12951 6613 512 512
ReadX 12951 7125 512 512
ReadX 12951 7637 512 512
ReadX 12951 8149 512 512
ReadX 12951 8661 512 512
ReadX 12951 9173 512 512
ReadX 12951 9685 512 512
ReadX 12951 10197 512 512
ReadX 12951 10709 512 512
ReadX 12951 11221 512 512
ReadX 12951 11733 512 512
ReadX 12951 12245 512 512
ReadX 12951 12757 512 512
ReadX 12951 13269 40 40
ReadX 12951 3076 472 472
ReadX 12951 3548 512 512
ReadX 12951 4060 512 512
ReadX 12951 4572 512 512
ReadX 12951 5084 512 512
ReadX 12951 5596 512 512
ReadX 12951 6108 512 512
ReadX 12951 6620 512 512
ReadX 12951 7132 512 512
ReadX 12951 7644 512 512
ReadX 12951 8156 512 512
ReadX 12951 8668 512 512
ReadX 12951 9180 512 512
ReadX 12951 9692 512 512
ReadX 12951 10204 512 512
ReadX 12951 10716 512 512
ReadX 12951 11228 512 512
ReadX 12951 11740 512 512
ReadX 12951 12252 512 512
ReadX 12951 12764 512 512
ReadX 12951 13276 310 310
ReadX 12951 3001 512 512
ReadX 12951 2562 512 512
ReadX 12951 2626 512 512
ReadX 12951 3003 512 512
ReadX 12951 2721 512 512
ReadX 12951 2626 512 512
ReadX 12951 3138 512 512
ReadX 12951 3650 512 512
ReadX 12951 4162 512 512
ReadX 12951 4674 512 512
ReadX 12951 5186 512 512
ReadX 12951 5698 512 512
ReadX 12951 6210 424 424
ReadX 12951 2612 88 88
ReadX 12951 2700 512 512
ReadX 12951 3212 512 512
ReadX 12951 3724 512 512
ReadX 12951 4236 512 512
ReadX 12951 4748 512 512
ReadX 12951 5260 512 512
ReadX 12951 5772 424 424
ReadX 12951 2642 88 88
ReadX 12951 2730 512 512
ReadX 12951 3242 512 512
ReadX 12951 3754 512 512
ReadX 12951 4266 512 512
ReadX 12951 4778 512 512
ReadX 12951 5290 512 512
ReadX 12951 5802 512 512
ReadX 12951 6314 512 512
ReadX 12951 6826 512 512
ReadX 12951 7338 512 512
ReadX 12951 7850 512 512
ReadX 12951 8362 512 512
ReadX 12951 8874 512 512
ReadX 12951 9386 512 512
ReadX 12951 9898 512 512
ReadX 12951 10410 512 512
ReadX 12951 10922 512 512
ReadX 12951 11434 512 512
ReadX 12951 11946 512 512
ReadX 12951 12458 512 512
ReadX 12951 2716 512 512
ReadX 12951 2717 512 512
ReadX 12951 2718 512 512
ReadX 12951 3230 512 512
ReadX 12951 2721 512 512
ReadX 12951 3233 512 512
ReadX 12951 3745 512 512
ReadX 12951 4257 512 512
ReadX 12951 4769 512 512
ReadX 12951 5281 512 512
ReadX 12951 5793 512 512
ReadX 12951 6305 512 512
ReadX 12951 6817 512 512
ReadX 12951 7329 512 512
ReadX 12951 7841 512 512
ReadX 12951 8353 512 512
ReadX 12951 8865 512 512
ReadX 12951 9377 512 512
ReadX 12951 9889 512 512
ReadX 12951 10401 512 512
ReadX 12951 10913 512 512
ReadX 12951 11425 512 512
ReadX 12951 11937 512 512
ReadX 12951 12449 512 512
ReadX 12951 12961 512 512
ReadX 12951 13473 512 512
ReadX 12951 13985 106 106
ReadX 12951 2820 406 406
ReadX 12951 3226 512 512
ReadX 12951 3738 512 512
ReadX 12951 4250 512 512
ReadX 12951 4762 512 512
ReadX 12951 5274 512 512
ReadX 12951 5786 512 512
ReadX 12951 6298 512 512
ReadX 12951 6810 512 512
ReadX 12951 7322 512 512
ReadX 12951 7834 512 512
ReadX 12951 8346 512 512
ReadX 12951 8858 512 512
ReadX 12951 9370 512 512
ReadX 12951 9882 512 512
ReadX 12951 10394 512 512
ReadX 12951 10906 512 512
ReadX 12951 11418 182 182
ReadX 12951 2717 512 512
ReadX 12951 258 512 512
ReadX 12951 470 512 512
ReadX 12951 376 512 512
ReadX 12951 888 512 512
ReadX 12951 1400 512 512
ReadX 12951 1912 512 512
ReadX 12951 2424 512 512
ReadX 12951 2936 512 512
ReadX 12951 3448 512 512
ReadX 12951 3960 424 424
ReadX 12951 362 88 88
ReadX 12951 450 512 512
ReadX 12951 962 512 512
ReadX 12951 1474 512 512
ReadX 12951 1986 512 512
ReadX 12951 2498 512 512
ReadX 12951 3010 512 512
ReadX 12951 3522 424 424
ReadX 12951 392 88 88
ReadX 12951 480 512 512
ReadX 12951 992 512 512
ReadX 12951 1504 512 512
ReadX 12951 2016 512 512
ReadX 12951 2528 512 512
ReadX 12951 3040 512 512
ReadX 12951 3552 512 512
ReadX 12951 4064 512 512
ReadX 12951 4576 512 512
ReadX 12951 5088 512 512
ReadX 12951 5600 512 512
ReadX 12951 6112 512 512
ReadX 12951 6624 512 512
ReadX 12951 7136 512 512
ReadX 12951 7648 512 512
ReadX 12951 8160 512 512
ReadX 12951 8672 512 512
ReadX 12951 9184 512 512
ReadX 12951 9696 512 512
ReadX 12951 10208 512 512
ReadX 12951 464 512 512
ReadX 12951 465 512 512
ReadX 12951 466 512 512
ReadX 12951 978 512 512
ReadX 12951 470 512 512
ReadX 12951 982 512 512
ReadX 12951 1494 512 512
ReadX 12951 2006 512 512
ReadX 12951 2518 512 512
ReadX 12951 3030 512 512
ReadX 12951 3542 512 512
ReadX 12951 4054 512 512
ReadX 12951 4566 512 512
ReadX 12951 5078 512 512
ReadX 12951 5590 512 512
ReadX 12951 6102 512 512
ReadX 12951 6614 512 512
ReadX 12951 7126 512 512
ReadX 12951 7638 512 512
ReadX 12951 8150 512 512
ReadX 12951 8662 512 512
ReadX 12951 9174 512 512
ReadX 12951 9686 512 512
ReadX 12951 10198 512 512
ReadX 12951 10710 333 333
ReadX 12951 11043 512 512
ReadX 12951 11555 179 179
ReadX 12951 11734 512 512
ReadX 12951 12246 512 512
ReadX 12951 12758 512 512
ReadX 12951 13270 512 512
ReadX 12951 13782 512 512
ReadX 12951 14294 512 512
ReadX 12951 14806 512 512
ReadX 12951 15318 512 512
ReadX 12951 15830 512 512
ReadX 12951 16342 512 512
ReadX 12951 16854 512 512
ReadX 12951 17366 512 512
ReadX 12951 17878 512 512
ReadX 12951 18390 512 512
ReadX 12951 18902 512 512
ReadX 12951 19414 512 512
ReadX 12951 19926 512 512
ReadX 12951 20438 512 512
ReadX 12951 20950 512 512
ReadX 12951 21462 512 512
ReadX 12951 21974 350 350
ReadX 12951 465 512 512
ReadX 12951 3812 512 512
ReadX 12951 4046 512 512
ReadX 12951 3828 512 512
ReadX 12951 256 512 512
ReadX 12951 260 512 512
ReadX 12951 4066 512 512
ReadX 12951 4578 512 512
ReadX 12951 5090 512 512
ReadX 12951 5602 512 512
ReadX 12951 6114 512 512
ReadX 12951 6626 512 512
ReadX 12951 7138 512 512
ReadX 12951 7650 394 394
ReadX 12951 4052 118 118
ReadX 12951 4170 512 512
ReadX 12951 4682 512 512
ReadX 12951 5194 512 512
ReadX 12951 5706 512 512
ReadX 12951 6218 512 512
ReadX 12951 6730 512 512
ReadX 12951 7242 394 394
ReadX 12951 4082 118 118
ReadX 12951 4200 512 512
ReadX 12951 4712 512 512
ReadX 12951 5224 512 512
ReadX 12951 5736 512 512
ReadX 12951 6248 512 512
ReadX 12951 6760 512 512
ReadX 12951 7272 512 512
ReadX 12951 7784 394 394
ReadX 12951 256 118 118
ReadX 12951 374 512 512
ReadX 12951 886 512 512
ReadX 12951 1398 512 512
ReadX 12951 1910 512 512
ReadX 12951 2422 512 512
ReadX 12951 2934 512 512
ReadX 12951 3446 512 512
ReadX 12951 3958 512 512
ReadX 12951 4470 512 512
ReadX 12951 4982 512 512
ReadX 12951 5494 512 512
ReadX 12951 6006 512 512
ReadX 12951 6518 512 512
ReadX 12951 7030 512 512
ReadX 12951 7542 512 512
ReadX 12951 8054 512 512
ReadX 12951 8566 512 512
ReadX 12951 9078 512 512
ReadX 12951 9590 512 512
ReadX 12951 10102 512 512
ReadX 12951 259 512 512
ReadX 12951 771 512 512
ReadX 12951 259 512 512
ReadX 12951 259 512 512
ReadX 12951 771 512 512
ReadX 12951 1283 512 512
ReadX 12951 1795 512 512
ReadX 12951 2307 512 512
ReadX 12951 2819 512 512
ReadX 12951 3331 512 512
ReadX 12951 3843 512 512
ReadX 12951 4355 512 512
ReadX 12951 4867 512 512
ReadX 12951 260 512 512
ReadX 12951 772 512 512
ReadX 12951 1284 512 512
ReadX 12951 1796 512 512
ReadX 12951 2308 512 512
ReadX 12951 2820 512 512
ReadX 12951 3332 512 512
ReadX 12951 3844 512 512
ReadX 12951 4356 512 512
ReadX 12951 4868 512 512
ReadX 12951 5380 512 512
ReadX 12951 5892 512 512
ReadX 12951 6404 512 512
ReadX 12951 6916 512 512
ReadX 12951 7428 512 512
ReadX 12951 7940 512 512
ReadX 12951 8452 512 512
ReadX 12951 8964 512 512
ReadX 12951 9476 512 512
ReadX 12951 9988 512 512
ReadX 12951 10500 378 378
ReadX 12951 10878 512 512
ReadX 12951 11390 134 134
ReadX 12951 11524 512 512
ReadX 12951 12036 512 512
ReadX 12951 12548 512 512
ReadX 12951 13060 512 512
ReadX 12951 13572 138 138
ReadX 12951 259 512 512
ReadX 12951 273 512 512
ReadX 12951 276 512 512
ReadX 12951 295 512 512
ReadX 12951 288 512 512
ReadX 12951 296 512 512
ReadX 12951 259 512 512
ReadX 12951 273 512 512
ReadX 12951 273 512 512
ReadX 12951 785 512 512
ReadX 12951 1297 512 512
ReadX 12951 1809 512 512
ReadX 12951 2321 512 512
ReadX 12951 274 512 512
ReadX 12951 274 512 512
ReadX 12951 274 497 497
ReadX 12951 272 15 15
ReadX 12951 287 512 512
ReadX 12951 799 512 512
ReadX 12951 273 512 512
ReadX 12951 785 512 512
ReadX 12951 1297 512 512
ReadX 12951 1809 512 512
ReadX 12951 2321 512 512
ReadX 12951 2833 317 317
ReadX 12951 274 195 195
ReadX 12951 469 512 512
ReadX 12951 981 512 512
ReadX 12951 1493 512 512
ReadX 12951 2005 512 512
ReadX 12951 2517 512 512
ReadX 12951 3029 512 512
ReadX 12951 3541 512 512
ReadX 12951 4053 512 512
ReadX 12951 4565 250 250
ReadX 12951 274 512 512
ReadX 12951 283 512 512
ReadX 12951 795 512 512
ReadX 12951 276 512 512
ReadX 12951 788 512 512
ReadX 12951 1300 512 512
ReadX 12951 1812 512 512
ReadX 12951 2324 512 512
ReadX 12951 2836 512 512
ReadX 12951 3348 512 512
ReadX 12951 3860 420 420
ReadX 12951 275 92 92
ReadX 12951 367 512 512
ReadX 12951 879 512 512
ReadX 12951 1391 512 512
ReadX 12951 1903 512 512
ReadX 12951 2415 512 512
ReadX 12951 2927 512 512
ReadX 12951 3439 420 420
ReadX 12951 277 92 92
ReadX 12951 369 512 512
ReadX 12951 881 512 512
ReadX 12951 1393 512 512
ReadX 12951 1905 512 512
ReadX 12951 2417 512 512
ReadX 12951 2929 512 512
ReadX 12951 3441 512 512
ReadX 12951 3953 512 512
ReadX 12951 4465 512 512
ReadX 12951 4977 512 512
ReadX 12951 5489 512 512
ReadX 12951 6001 512 512
ReadX 12951 6513 512 512
ReadX 12951 7025 512 512
ReadX 12951 7537 512 512
ReadX 12951 8049 512 512
ReadX 12951 8561 512 512
ReadX 12951 9073 512 512
ReadX 12951 9585 512 512
ReadX 12951 10097 512 512
ReadX 12951 282 512 512
ReadX 12951 794 512 512
ReadX 12951 1306 512 512
ReadX 12951 1818 512 512
ReadX 12951 2330 512 512
ReadX 12951 2842 512 512
ReadX 12951 3354 512 512
ReadX 12951 3866 512 512
ReadX 12951 4378 512 512
ReadX 12951 284 512 512
ReadX 12951 796 512 512
ReadX 12951 1308 512 512
ReadX 12951 1820 512 512
ReadX 12951 2332 512 512
ReadX 12951 2844 512 512
ReadX 12951 3356 512 512
ReadX 12951 3868 512 512
ReadX 12951 4380 512 512
ReadX 12951 4892 512 512
ReadX 12951 5404 512 512
ReadX 12951 5916 512 512
ReadX 12951 6428 512 512
ReadX 12951 6940 512 512
ReadX 12951 7452 512 512
ReadX 12951 7964 512 512
ReadX 12951 8476 512 512
ReadX 12951 8988 512 512
ReadX 12951 9500 512 512
ReadX 12951 10012 512 512
ReadX 12951 10524 472 472
ReadX 12951 288 40 40
ReadX 12951 328 512 512
ReadX 12951 840 512 512
ReadX 12951 1352 512 512
ReadX 12951 1864 512 512
ReadX 12951 2376 512 512
ReadX 12951 2888 512 512
ReadX 12951 3400 512 512
ReadX 12951 3912 512 512
ReadX 12951 4424 512 512
ReadX 12951 4936 512 512
ReadX 12951 5448 512 512
ReadX 12951 5960 512 512
ReadX 12951 6472 512 512
ReadX 12951 6984 512 512
ReadX 12951 7496 512 512
ReadX 12951 8008 512 512
ReadX 12951 8520 512 512
ReadX 12951 9032 512 512
ReadX 12951 9544 512 512
ReadX 12951 10056 512 512
ReadX 12951 10568 506 506
ReadX 12951 282 512 512
ReadX 12951 794 512 512
ReadX 12951 301 512 512
ReadX 12951 296 512 512
ReadX 12951 808 512 512
ReadX 12951 1320 512 512
ReadX 12951 1832 512 512
ReadX 12951 2344 512 512
ReadX 12951 2856 512 512
ReadX 12951 3368 512 512
ReadX 12951 3880 424 424
ReadX 12951 295 88 88
ReadX 12951 383 512 512
ReadX 12951 895 512 512
ReadX 12951 1407 512 512
ReadX 12951 1919 512 512
ReadX 12951 2431 512 512
ReadX 12951 2943 512 512
ReadX 12951 3455 424 424
ReadX 12951 297 88 88
ReadX 12951 385 512 512
ReadX 12951 897 512 512
ReadX 12951 1409 512 512
ReadX 12951 1921 512 512
ReadX 12951 2433 512 512
ReadX 12951 2945 512 512
ReadX 12951 3457 512 512
ReadX 12951 3969 512 512
ReadX 12951 4481 512 512
ReadX 12951 4993 512 512
ReadX 12951 5505 512 512
ReadX 12951 6017 512 512
ReadX 12951 6529 512 512
ReadX 12951 7041 512 512
ReadX 12951 7553 512 512
ReadX 12951 8065 512 512
ReadX 12951 8577 512 512
ReadX 12951 9089 512 512
ReadX 12951 9601 512 512
ReadX 12951 10113 512 512
ReadX 12951 301 512 512
ReadX 12951 301 512 512
ReadX 12951 301 512 512
ReadX 12951 813 512 512
ReadX 12951 301 512 512
ReadX 12951 813 512 512
ReadX 12951 1325 512 512
ReadX 12951 1837 512 512
ReadX 12951 2349 512 512
ReadX 12951 2861 512 512
ReadX 12951 3373 512 512
ReadX 12951 3885 512 512
ReadX 12951 4397 512 512
ReadX 12951 4909 512 512
ReadX 12951 5421 512 512
ReadX 12951 5933 512 512
ReadX 12951 6445 512 512
ReadX 12951 6957 512 512
ReadX 12951 7469 512 512
ReadX 12951 7981 512 512
ReadX 12951 8493 512 512
ReadX 12951 9005 512 512
ReadX 12951 9517 463 463
ReadX 12951 9980 512 512
ReadX 12951 10492 49 49
ReadX 12951 10541 512 512
ReadX 12951 11053 512 512
ReadX 12951 11565 512 512
ReadX 12951 12077 512 512
ReadX 12951 12589 512 512
ReadX 12951 13101 512 512
ReadX 12951 13613 512 512
ReadX 12951 14125 512 512
ReadX 12951 14637 512 512
ReadX 12951 15149 512 512
ReadX 12951 15661 512 512
ReadX 12951 16173 512 512
ReadX 12951 16685 512 512
ReadX 12951 17197 512 512
ReadX 12951 17709 512 512
ReadX 12951 18221 512 512
ReadX 12951 18733 512 512
ReadX 12951 19245 512 512
ReadX 12951 19757 512 512
ReadX 12951 20269 512 512
ReadX 12951 20781 326 326
ReadX 12951 301 512 512
QUERY_FS_INFORMATION 259
Close 12949
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12952
Close 12952
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12953
ReadX 12953 0 24 24
Close 12953
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12954
QUERY_FILE_INFORMATION 12954
ReadX 12954 0 512 512
ReadX 12954 476 512 512
ReadX 12954 510 512 512
ReadX 12954 484 512 512
ReadX 12954 474 512 512
ReadX 12954 478 512 512
ReadX 12954 990 512 512
ReadX 12954 509 57 57
Close 12954
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12955
QUERY_FILE_INFORMATION 12955
ReadX 12955 0 512 512
ReadX 12955 476 512 512
ReadX 12955 510 512 512
ReadX 12955 484 512 512
ReadX 12955 480 512 512
ReadX 12955 474 512 512
ReadX 12955 478 512 512
QUERY_FILE_INFORMATION 12955
WriteX 12955 494 60 60
WriteX 12955 494 4 4
QUERY_FILE_INFORMATION 12955
WriteX 12955 494 11 11
WriteX 12955 510 512 512
WriteX 12955 484 512 512
WriteX 12955 474 512 512
WriteX 12955 478 512 512
WriteX 12955 990 512 512
Close 12955
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 12956
Close 12956
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 12957
Close 12957
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12959
WriteX 12959 4607 1 1
QUERY_FILE_INFORMATION 12959
WriteX 12959 0 65471 65471
WriteX 12959 65471 65 65
WriteX 12959 65536 19490 19490
Close 12959
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12960
QUERY_FILE_INFORMATION 12960
ReadX 12960 0 512 512
ReadX 12960 482 512 512
ReadX 12960 994 512 512
ReadX 12960 1506 512 512
ReadX 12960 480 512 512
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 490 448 448
QUERY_FILE_INFORMATION 12960
WriteX 12960 490 60 60
WriteX 12960 490 4 4
QUERY_FILE_INFORMATION 12960
WriteX 12960 490 11 11
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 484 512 512
WriteX 12960 996 512 512
WriteX 12960 1508 512 512
WriteX 12960 482 512 512
WriteX 12960 0 512 512
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
ReadX 12960 490 512 512
WriteX 12960 502 512 512
WriteX 12960 502 292 292
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 503 20 20
WriteX 12960 503 108 108
QUERY_FILE_INFORMATION 12960
WriteX 12960 504 448 448
QUERY_FILE_INFORMATION 12960
WriteX 12960 504 44 44
WriteX 12960 504 20 20
WriteX 12960 500 512 512
WriteX 12960 492 512 512
WriteX 12960 496 512 512
WriteX 12960 1008 512 512
WriteX 12960 494 512 512
Flush 12960
WriteX 12960 0 512 512
Flush 12960
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 500 512 512
WriteX 12960 492 512 512
WriteX 12960 496 512 512
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 518 320 320
QUERY_FILE_INFORMATION 12960
WriteX 12960 518 60 60
ReadX 12960 504 512 512
WriteX 12960 522 512 512
WriteX 12960 506 3204 3204
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 519 25 25
WriteX 12960 518 103 103
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 519 44 44
WriteX 12960 519 20 20
WriteX 12960 520 512 512
WriteX 12960 482 512 512
WriteX 12960 486 512 512
WriteX 12960 998 512 512
WriteX 12960 484 512 512
WriteX 12960 490 512 512
Flush 12960
WriteX 12960 0 512 512
Flush 12960
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
QUERY_FILE_INFORMATION 12960
WriteX 12960 519 7 7
WriteX 12960 519 57 57
WriteX 12960 520 512 512
WriteX 12960 492 512 512
WriteX 12960 482 512 512
WriteX 12960 486 512 512
WriteX 12960 998 512 512
Flush 12960
WriteX 12960 520 512 512
Flush 12960
Close 12960
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12961
Close 12961
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 12962
QUERY_FILE_INFORMATION 12962
ReadX 12962 0 512 512
ReadX 12962 490 512 512
ReadX 12962 484 512 512
ReadX 12962 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 12963
Close 12963
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12962
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12964
Close 12964
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12965
ReadX 12965 0 24 24
Close 12965
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12966
QUERY_FILE_INFORMATION 12966
ReadX 12966 0 512 512
ReadX 12966 366 512 512
ReadX 12966 878 512 512
ReadX 12966 1390 512 512
ReadX 12966 1902 512 512
ReadX 12966 374 57 57
Close 12966
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12967
QUERY_FILE_INFORMATION 12967
ReadX 12967 0 512 512
ReadX 12967 366 512 512
ReadX 12967 878 512 512
ReadX 12967 1390 512 512
ReadX 12967 1902 512 512
QUERY_FILE_INFORMATION 12967
WriteX 12967 374 60 60
WriteX 12967 374 4 4
QUERY_FILE_INFORMATION 12967
WriteX 12967 374 11 11
ReadX 12967 374 57 57
ReadX 12967 374 57 57
ReadX 12967 292 4096 4096
ReadX 12967 364 512 512
ReadX 12967 512 4096 4096
ReadX 12967 4608 4096 4096
ReadX 12967 8704 4096 4096
ReadX 12967 12800 4096 4096
ReadX 12967 16896 4096 4096
ReadX 12967 20992 4096 4096
ReadX 12967 25088 4096 4096
ReadX 12967 29184 4096 4096
ReadX 12967 33280 4096 4096
ReadX 12967 37376 4096 4096
ReadX 12967 41472 4096 4096
ReadX 12967 45568 4096 4096
ReadX 12967 49664 4096 4096
ReadX 12967 53760 4096 4096
ReadX 12967 57856 4096 4096
ReadX 12967 61952 4096 4096
ReadX 12967 66048 4096 4096
ReadX 12967 70144 4096 4096
ReadX 12967 74240 162 162
ReadX 12967 308 4096 4096
ReadX 12967 4404 4096 4096
WriteX 12967 368 512 512
WriteX 12967 880 512 512
WriteX 12967 1392 512 512
Close 12967
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12968
Close 12968
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12969
QUERY_FILE_INFORMATION 12969
ReadX 12969 0 512 512
ReadX 12969 366 512 512
ReadX 12969 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12970
Close 12970
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12969
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12972
WriteX 12972 4607 1 1
QUERY_FILE_INFORMATION 12972
WriteX 12972 0 65471 65471
WriteX 12972 65471 65 65
WriteX 12972 65536 8866 8866
Close 12972
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12973
QUERY_FILE_INFORMATION 12973
ReadX 12973 0 512 512
ReadX 12973 366 512 512
ReadX 12973 878 512 512
ReadX 12973 1390 512 512
ReadX 12973 364 512 512
QUERY_FILE_INFORMATION 12973
QUERY_FILE_INFORMATION 12973
QUERY_FILE_INFORMATION 12973
WriteX 12973 374 448 448
QUERY_FILE_INFORMATION 12973
WriteX 12973 374 60 60
WriteX 12973 374 4 4
QUERY_FILE_INFORMATION 12973
WriteX 12973 374 11 11
QUERY_FILE_INFORMATION 12973
QUERY_FILE_INFORMATION 12973
WriteX 12973 374 7 7
WriteX 12973 374 57 57
WriteX 12973 368 512 512
WriteX 12973 880 512 512
WriteX 12973 1392 512 512
WriteX 12973 366 512 512
WriteX 12973 0 512 512
Flush 12973
WriteX 12973 368 512 512
Flush 12973
Close 12973
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12974
QUERY_FILE_INFORMATION 12974
ReadX 12974 0 512 512
ReadX 12974 366 512 512
ReadX 12974 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 12974
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12975
Close 12975
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12976
ReadX 12976 0 24 24
Close 12976
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12977
QUERY_FILE_INFORMATION 12977
ReadX 12977 0 512 512
ReadX 12977 366 512 512
ReadX 12977 878 512 512
ReadX 12977 1390 512 512
ReadX 12977 1902 512 512
ReadX 12977 374 57 57
Close 12977
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12978
QUERY_FILE_INFORMATION 12978
ReadX 12978 0 512 512
ReadX 12978 366 512 512
ReadX 12978 878 512 512
ReadX 12978 1390 512 512
ReadX 12978 1902 512 512
QUERY_FILE_INFORMATION 12978
WriteX 12978 374 60 60
WriteX 12978 374 4 4
QUERY_FILE_INFORMATION 12978
WriteX 12978 374 11 11
WriteX 12978 368 512 512
WriteX 12978 880 512 512
WriteX 12978 1392 512 512
Close 12978
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 12979
Close 12979
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12980
Close 12980
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12982
WriteX 12982 4607 1 1
QUERY_FILE_INFORMATION 12982
WriteX 12982 0 65471 65471
WriteX 12982 65471 65 65
WriteX 12982 65536 9298 9298
Close 12982
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12983
QUERY_FILE_INFORMATION 12983
ReadX 12983 0 512 512
ReadX 12983 368 512 512
ReadX 12983 880 512 512
ReadX 12983 1392 512 512
ReadX 12983 366 512 512
QUERY_FILE_INFORMATION 12983
QUERY_FILE_INFORMATION 12983
QUERY_FILE_INFORMATION 12983
WriteX 12983 376 448 448
QUERY_FILE_INFORMATION 12983
WriteX 12983 376 60 60
WriteX 12983 376 4 4
QUERY_FILE_INFORMATION 12983
WriteX 12983 376 11 11
QUERY_FILE_INFORMATION 12983
QUERY_FILE_INFORMATION 12983
WriteX 12983 376 7 7
WriteX 12983 376 57 57
WriteX 12983 370 512 512
WriteX 12983 882 512 512
WriteX 12983 1394 512 512
WriteX 12983 368 512 512
WriteX 12983 0 512 512
Flush 12983
WriteX 12983 370 512 512
Flush 12983
Close 12983
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12984
Close 12984
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12985
QUERY_FILE_INFORMATION 12985
ReadX 12985 0 512 512
ReadX 12985 368 512 512
ReadX 12985 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 12986
Close 12986
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12988
Close 12988
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12989
ReadX 12989 0 24 24
Close 12989
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12990
QUERY_FILE_INFORMATION 12990
ReadX 12990 0 512 512
ReadX 12990 512 512 512
ReadX 12990 1024 512 512
ReadX 12990 2016 512 512
ReadX 12990 1056 512 512
ReadX 12990 1096 57 57
Close 12990
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12991
QUERY_FILE_INFORMATION 12991
ReadX 12991 0 512 512
ReadX 12991 512 512 512
ReadX 12991 1024 512 512
ReadX 12991 2016 512 512
ReadX 12991 1056 512 512
ReadX 12991 1096 57 57
ReadX 12991 1096 57 57
ReadX 12991 1088 62 62
ReadX 12991 1536 4096 4096
ReadX 12991 5632 4096 4096
ReadX 12991 9728 4096 4096
ReadX 12991 13824 2859 2859
ReadX 12991 1120 28 28
ReadX 12991 1148 20 20
ReadX 12991 1168 8 8
ReadX 12991 1176 88 88
ReadX 12991 1264 8 8
ReadX 12991 1272 4 4
ReadX 12991 1276 4 4
ReadX 12991 1280 1 1
ReadX 12991 1130 4 4
ReadX 12991 1134 4 4
ReadX 12991 1138 1 1
ReadX 12991 1131 4 4
ReadX 12991 1135 4 4
ReadX 12991 1139 1 1
ReadX 12991 1131 4 4
ReadX 12991 1135 4 4
ReadX 12991 1139 2 2
ReadX 12991 1132 4 4
ReadX 12991 1136 4 4
ReadX 12991 1140 25 25
ReadX 12991 1134 4 4
ReadX 12991 1138 8 8
ReadX 12991 1146 4 4
ReadX 12991 1150 8 8
ReadX 12991 1158 4 4
ReadX 12991 1162 8 8
ReadX 12991 1170 4 4
ReadX 12991 1174 4 4
ReadX 12991 1178 4 4
ReadX 12991 1182 4 4
ReadX 12991 1186 4 4
ReadX 12991 1190 4 4
ReadX 12991 1194 13900 13900
ReadX 12991 2048 4096 4096
Close 12991
QUERY_FS_INFORMATION 259
Close 12985
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12992
Close 12992
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12993
ReadX 12993 0 24 24
Close 12993
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12994
QUERY_FILE_INFORMATION 12994
ReadX 12994 0 512 512
ReadX 12994 368 512 512
ReadX 12994 880 512 512
ReadX 12994 1392 512 512
ReadX 12994 1904 512 512
ReadX 12994 376 57 57
Close 12994
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 12995
QUERY_FILE_INFORMATION 12995
ReadX 12995 0 512 512
ReadX 12995 368 512 512
ReadX 12995 880 512 512
ReadX 12995 1392 512 512
ReadX 12995 1904 512 512
QUERY_FILE_INFORMATION 12995
WriteX 12995 376 60 60
WriteX 12995 376 4 4
QUERY_FILE_INFORMATION 12995
WriteX 12995 376 11 11
WriteX 12995 370 512 512
WriteX 12995 882 512 512
WriteX 12995 1394 512 512
Close 12995
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 12996
Close 12996
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 12997
Close 12997
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12999
WriteX 12999 4607 1 1
QUERY_FILE_INFORMATION 12999
WriteX 12999 0 65471 65471
WriteX 12999 65471 65 65
WriteX 12999 65536 11540 11540
Close 12999
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13000
QUERY_FILE_INFORMATION 13000
ReadX 13000 0 512 512
ReadX 13000 398 512 512
ReadX 13000 910 512 512
ReadX 13000 1422 512 512
ReadX 13000 396 512 512
QUERY_FILE_INFORMATION 13000
QUERY_FILE_INFORMATION 13000
QUERY_FILE_INFORMATION 13000
WriteX 13000 406 448 448
QUERY_FILE_INFORMATION 13000
WriteX 13000 406 60 60
WriteX 13000 406 4 4
QUERY_FILE_INFORMATION 13000
WriteX 13000 406 11 11
QUERY_FILE_INFORMATION 13000
QUERY_FILE_INFORMATION 13000
WriteX 13000 406 7 7
WriteX 13000 406 57 57
WriteX 13000 400 512 512
WriteX 13000 912 512 512
WriteX 13000 1424 512 512
WriteX 13000 398 512 512
WriteX 13000 0 512 512
Flush 13000
WriteX 13000 400 512 512
Flush 13000
Close 13000
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13001
Close 13001
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13002
QUERY_FILE_INFORMATION 13002
ReadX 13002 0 512 512
ReadX 13002 398 512 512
ReadX 13002 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13003
Close 13003
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13002
ReadX 12951 1434 512 512
Close 12951
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13004
WriteX 13004 0 65471 65471
WriteX 13004 65471 63 63
WriteX 13004 65534 65471 65471
WriteX 13004 131005 63 63
Close 13004
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13005
WriteX 13005 0 65471 65471
WriteX 13005 65471 63 63
WriteX 13005 65534 65471 65471
WriteX 13005 131005 63 63
WriteX 13005 131068 65471 65471
WriteX 13005 196539 63 63
WriteX 13005 196602 65471 65471
WriteX 13005 262073 63 63
Close 13005
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13006
WriteX 13006 0 65471 65471
WriteX 13006 65471 63 63
WriteX 13006 65534 65471 65471
WriteX 13006 131005 63 63
WriteX 13006 131068 65471 65471
WriteX 13006 196539 63 63
WriteX 13006 196602 65471 65471
WriteX 13006 262073 63 63
WriteX 13006 262136 65471 65471
WriteX 13006 327607 63 63
WriteX 13006 327670 65471 65471
WriteX 13006 393141 63 63
WriteX 13006 393204 65471 65471
WriteX 13006 458675 63 63
WriteX 13006 458738 65471 65471
WriteX 13006 524209 63 63
Close 13006
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13007
Close 13007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13008
ReadX 13008 0 512 512
ReadX 13008 512 511 511
ReadX 13008 1023 512 512
ReadX 13008 1535 512 512
Close 13008
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13009
ReadX 13009 0 512 512
ReadX 13009 512 510 510
ReadX 13009 1022 512 512
ReadX 13009 1534 510 510
ReadX 13009 2044 510 510
Close 13009
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13010
ReadX 13010 0 512 512
ReadX 13010 512 512 512
ReadX 13010 1024 512 512
ReadX 13010 1536 512 512
ReadX 13010 2048 512 512
ReadX 13010 2560 512 512
ReadX 13010 3072 512 512
ReadX 13010 3584 512 512
ReadX 13010 4096 512 512
ReadX 13010 4608 512 512
ReadX 13010 5120 512 512
ReadX 13010 5632 512 512
ReadX 13010 6144 512 512
ReadX 13010 6656 512 512
ReadX 13010 7168 512 512
ReadX 13010 7680 512 512
ReadX 13010 8192 512 512
ReadX 13010 8704 512 512
Close 13010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13011
Close 13011
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13012
QUERY_FILE_INFORMATION 13012
Close 13012
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13013
ReadX 13013 0 8192 8192
Close 13013
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13014
Close 13014
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13015
QUERY_FILE_INFORMATION 13015
Close 13015
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13016
ReadX 13016 0 8192 8192
Close 13016
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13017
Close 13017
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13018
QUERY_FILE_INFORMATION 13018
Close 13018
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13019
ReadX 13019 0 8192 8192
Close 13019
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13020
ReadX 13020 0 8192 8192
ReadX 13020 8192 8192 8192
ReadX 13020 16384 8192 8192
ReadX 13020 24576 8192 8192
Close 13020
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13022
Close 13022
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13024
WriteX 13024 8191 1 1
QUERY_FILE_INFORMATION 13024
WriteX 13024 0 10438 10438
Close 13024
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13025
Close 13025
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13026
QUERY_FILE_INFORMATION 13026
QUERY_FILE_INFORMATION 13026
Close 13026
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13027
QUERY_FILE_INFORMATION 13027
QUERY_FILE_INFORMATION 13027
Close 13027
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13028
Close 13028
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13029
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
Close 13029
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13030
QUERY_FILE_INFORMATION 13030
QUERY_FILE_INFORMATION 13030
Close 13030
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13031
Close 13031
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13032
QUERY_FILE_INFORMATION 13032
QUERY_FILE_INFORMATION 13032
Close 13032
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13033
QUERY_FILE_INFORMATION 13033
QUERY_FILE_INFORMATION 13033
Close 13033
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13034
Close 13034
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13035
QUERY_FILE_INFORMATION 13035
QUERY_FILE_INFORMATION 13035
Close 13035
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13036
ReadX 13036 0 8 8
ReadX 13036 8 4 4
ReadX 13036 12 8 8
ReadX 13036 22 8 8
ReadX 13036 520 8 8
ReadX 13036 525 8 8
ReadX 13036 533 4 4
ReadX 13036 543 8 8
ReadX 13036 551 4 4
ReadX 13036 1058 8 8
ReadX 13036 1066 4 4
ReadX 13036 1081 8 8
ReadX 13036 1089 4 4
ReadX 13036 660 8 8
Close 13036
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13037
ReadX 13037 0 8192 8192
Close 13037
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13038
ReadX 13038 0 8192 8192
ReadX 13038 520 8192 8192
ReadX 13038 8712 8192 8192
ReadX 13038 16904 8192 8192
ReadX 13038 25096 8192 8192
ReadX 13038 33288 8192 8192
ReadX 13038 41480 8192 8192
ReadX 13038 49672 8192 8192
ReadX 13038 57864 8192 8192
ReadX 13038 66056 8192 8192
ReadX 13038 74248 8192 8192
ReadX 13038 82440 8192 8192
ReadX 13038 90632 8192 8192
ReadX 13038 98824 8192 8192
ReadX 13038 107016 8192 8192
ReadX 13038 115208 8192 8192
ReadX 13038 123400 8192 8192
ReadX 13038 131592 8192 8192
ReadX 13038 139784 8192 8192
ReadX 13038 147976 8192 8192
ReadX 13038 156168 8192 8192
Close 13038
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13039
QUERY_FILE_INFORMATION 13039
Close 13039
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13040
Close 13040
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13042
WriteX 13042 8191 1 1
QUERY_FILE_INFORMATION 13042
WriteX 13042 0 28489 28489
Close 13042
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13043
Close 13043
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13044
Close 13044
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13045
QUERY_FILE_INFORMATION 13045
Close 13045
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13046
ReadX 13046 0 8192 8192
Close 13046
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13047
Close 13047
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13048
QUERY_FILE_INFORMATION 13048
Close 13048
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13049
ReadX 13049 0 8192 8192
Close 13049
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13050
ReadX 13050 0 8192 8192
ReadX 13050 8192 8192 8192
ReadX 13050 16384 8192 8192
ReadX 13050 24576 8192 8192
ReadX 13050 32768 16384 16384
ReadX 13050 49152 8192 8192
ReadX 13050 57344 8192 8192
ReadX 13050 65536 8192 8192
Close 13050
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13052
Close 13052
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13054
WriteX 13054 8191 1 1
QUERY_FILE_INFORMATION 13054
WriteX 13054 0 29253 29253
Close 13054
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13055
Close 13055
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13056
QUERY_FILE_INFORMATION 13056
QUERY_FILE_INFORMATION 13056
Close 13056
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13057
QUERY_FILE_INFORMATION 13057
QUERY_FILE_INFORMATION 13057
Close 13057
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13058
QUERY_FILE_INFORMATION 13058
Close 13058
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13059
Close 13059
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13061
WriteX 13061 8191 1 1
QUERY_FILE_INFORMATION 13061
WriteX 13061 0 30183 30183
Close 13061
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13062
Close 13062
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13063
WriteX 13063 0 510 510
WriteX 13063 510 512 512
WriteX 13063 1022 510 510
WriteX 13063 1532 510 510
WriteX 13063 2042 168 168
Close 13063
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13064
Close 13064
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13065
WriteX 13065 0 511 511
WriteX 13065 511 512 512
WriteX 13065 1023 512 512
WriteX 13065 1535 488 488
Close 13065
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13066
ReadX 13066 0 65471 65471
ReadX 13066 65471 63 63
ReadX 13066 65534 65471 65471
ReadX 13066 131005 63 63
ReadX 13066 131068 65471 65471
ReadX 13066 196539 63 63
ReadX 13066 196602 65471 65471
ReadX 13066 262073 63 63
ReadX 13066 262136 65471 65471
ReadX 13066 327607 63 63
ReadX 13066 327670 10 10
Close 13066
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13067
ReadX 13067 0 65471 65471
ReadX 13067 65471 63 63
ReadX 13067 65534 65471 65471
ReadX 13067 131005 63 63
ReadX 13067 131068 65471 65471
ReadX 13067 196539 63 63
ReadX 13067 196602 65471 65471
ReadX 13067 262073 63 63
ReadX 13067 262136 65471 65471
ReadX 13067 327607 63 63
ReadX 13067 327670 65471 65471
ReadX 13067 393141 63 63
ReadX 13067 393204 65471 65471
ReadX 13067 458675 63 63
ReadX 13067 458738 65471 65471
ReadX 13067 524209 63 63
ReadX 13067 524272 65471 65471
ReadX 13067 589743 63 63
ReadX 13067 589806 65471 65471
ReadX 13067 655277 63 63
ReadX 13067 655340 32 32
Close 13067
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13068
ReadX 13068 0 65471 65471
ReadX 13068 65471 63 63
ReadX 13068 65534 65471 65471
ReadX 13068 131005 63 63
ReadX 13068 131068 65471 65471
ReadX 13068 196539 63 63
ReadX 13068 196602 65471 65471
ReadX 13068 262073 63 63
ReadX 13068 262136 65471 65471
ReadX 13068 327607 63 63
ReadX 13068 327670 65471 65471
ReadX 13068 393141 63 63
ReadX 13068 393204 65471 65471
ReadX 13068 458675 63 63
ReadX 13068 458738 65471 65471
ReadX 13068 524209 63 63
ReadX 13068 524272 65471 65471
ReadX 13068 589743 63 63
ReadX 13068 589806 65471 65471
ReadX 13068 655277 63 63
ReadX 13068 655340 65471 65471
ReadX 13068 720811 63 63
ReadX 13068 720874 65471 65471
ReadX 13068 786345 63 63
ReadX 13068 786408 65471 65471
ReadX 13068 851879 63 63
ReadX 13068 851942 65471 65471
ReadX 13068 917413 63 63
ReadX 13068 917476 65471 65471
ReadX 13068 982947 63 63
ReadX 13068 983010 65471 65471
ReadX 13068 1048481 63 63
ReadX 13068 1048544 65471 65471
ReadX 13068 1114015 63 63
ReadX 13068 1114078 65471 65471
ReadX 13068 1179549 63 63
ReadX 13068 1179612 65471 65471
ReadX 13068 1245083 63 63
ReadX 13068 1245146 65471 65471
ReadX 13068 1310617 63 63
ReadX 13068 1310680 65471 65471
ReadX 13068 1376151 63 63
ReadX 13068 1376214 65471 65471
ReadX 13068 1441685 63 63
ReadX 13068 1441748 65471 65471
ReadX 13068 1507219 63 63
ReadX 13068 1507282 65471 65471
ReadX 13068 1572753 63 63
ReadX 13068 1572816 65471 65471
ReadX 13068 1638287 63 63
ReadX 13068 1638350 65471 65471
ReadX 13068 1703821 63 63
ReadX 13068 1703884 65471 65471
ReadX 13068 1769355 63 63
ReadX 13068 1769418 65471 65471
ReadX 13068 1834889 63 63
ReadX 13068 1834952 32824 32824
Close 13068
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13069
QUERY_FILE_INFORMATION 13069
ReadX 13069 0 512 512
ReadX 13069 512 512 512
ReadX 13069 1024 512 512
QUERY_FILE_INFORMATION 13069
QUERY_FILE_INFORMATION 13069
ReadX 13069 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13069
QUERY_FILE_INFORMATION 13069
ReadX 13069 512 4096 4096
QUERY_FILE_INFORMATION 13069
QUERY_FILE_INFORMATION 13069
QUERY_FILE_INFORMATION 13069
WriteX 13069 512 4096 4096
WriteX 13069 1024 512 512
ReadX 13069 502 512 512
QUERY_FILE_INFORMATION 13069
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13069 2560 512 512
ReadX 13069 1536 512 512
ReadX 13069 2176 384 384
ReadX 13069 3072 128 128
ReadX 13069 3107 512 512
ReadX 13069 3619 512 512
ReadX 13069 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13069 286 123 123
ReadX 13069 292 24 24
ReadX 13069 512 2048 2048
ReadX 13069 512 2048 2048
ReadX 13069 2560 2048 2048
ReadX 13069 416 1536 1536
ReadX 13069 768 512 512
ReadX 13069 1280 2048 2048
ReadX 13069 3328 2048 2048
ReadX 13069 5376 2048 2048
ReadX 13069 7424 2048 2048
ReadX 13069 9472 2048 2048
ReadX 13069 11520 2048 2048
ReadX 13069 13568 2048 2048
ReadX 13069 15616 2048 2048
ReadX 13069 17664 2048 2048
ReadX 13069 19712 2048 2048
ReadX 13069 21760 2048 2048
ReadX 13069 23808 2048 2048
ReadX 13069 25856 2048 2048
ReadX 13069 27904 2048 2048
ReadX 13069 29952 2048 2048
ReadX 13069 32000 2048 2048
ReadX 13069 34048 2048 2048
ReadX 13069 36096 2048 2048
ReadX 13069 38144 2048 2048
ReadX 13069 40192 2048 2048
ReadX 13069 42240 512 512
ReadX 13069 42752 2048 2048
ReadX 13069 44800 2048 2048
ReadX 13069 46848 2048 2048
ReadX 13069 48896 2048 2048
ReadX 13069 50944 2048 2048
ReadX 13069 52992 2048 2048
ReadX 13069 55040 2048 2048
ReadX 13069 57088 2048 2048
ReadX 13069 316 2048 2048
ReadX 13069 2364 2048 2048
ReadX 13069 4412 2048 2048
ReadX 13069 6460 2048 2048
ReadX 13069 8508 2048 2048
ReadX 13069 10556 2048 2048
ReadX 13069 12604 2048 2048
ReadX 13069 14652 2048 2048
ReadX 13069 16700 2048 2048
ReadX 13069 18748 2048 2048
ReadX 13069 20796 2048 2048
ReadX 13069 22844 2048 2048
ReadX 13069 24892 2048 2048
ReadX 13069 26940 2048 2048
ReadX 13069 28988 2048 2048
ReadX 13069 31036 2048 2048
ReadX 13069 436 2048 2048
ReadX 13069 2484 2048 2048
ReadX 13069 4532 2048 2048
ReadX 13069 6580 2048 2048
ReadX 13069 8628 2048 2048
ReadX 13069 10676 2048 2048
ReadX 13069 476 2048 2048
ReadX 13069 476 2048 2048
ReadX 13069 476 2048 2048
ReadX 13069 2524 2048 2048
ReadX 13069 484 2048 2048
ReadX 13069 484 2048 2048
ReadX 13069 484 2048 2048
ReadX 13069 2532 665 665
ReadX 13069 492 665 665
ReadX 13069 492 665 665
ReadX 13069 492 665 665
ReadX 13069 296 512 512
ReadX 13069 318 512 512
ReadX 13069 300 512 512
ReadX 13069 312 512 512
ReadX 13069 320 512 512
ReadX 13069 832 354 354
ReadX 13069 504 4096 4096
ReadX 13069 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13070
Close 13070
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13071
WriteX 13071 1535 1 1
QUERY_FILE_INFORMATION 13071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13069 296 1251 1251
ReadX 13069 2176 384 384
ReadX 13069 3072 1634 1634
QUERY_FILE_INFORMATION 13071
WriteX 13071 0 57088 57088
WriteX 13071 0 4096 4096
Flush 13071
Close 13069
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13072
Close 13072
WriteX 13071 0 4096 4096
Close 13071
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13073
Close 13073
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13074
QUERY_FILE_INFORMATION 13074
ReadX 13074 0 512 512
ReadX 13074 512 512 512
ReadX 13074 1024 512 512
QUERY_FILE_INFORMATION 13074
QUERY_FILE_INFORMATION 13074
ReadX 13074 512 2048 2048
QUERY_FILE_INFORMATION 13074
QUERY_FILE_INFORMATION 13074
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13074 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13075
WriteX 13075 1535 1 1
QUERY_FILE_INFORMATION 13075
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13074 1536 512 512
ReadX 13074 288 1251 1251
ReadX 13074 2048 2018 2018
QUERY_FILE_INFORMATION 13075
WriteX 13075 0 51456 51456
WriteX 13075 0 4096 4096
Flush 13075
QUERY_FILE_INFORMATION 13074
QUERY_FILE_INFORMATION 13074
Close 13074
WriteX 13075 0 4096 4096
Close 13075
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13076
Close 13076
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13077
QUERY_FILE_INFORMATION 13077
ReadX 13077 0 512 512
ReadX 13077 512 512 512
ReadX 13077 1024 512 512
QUERY_FILE_INFORMATION 13077
QUERY_FILE_INFORMATION 13077
ReadX 13077 512 2048 2048
QUERY_FILE_INFORMATION 13077
QUERY_FILE_INFORMATION 13077
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13077 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13079
Close 13079
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13081
WriteX 13081 4045 1 1
QUERY_FILE_INFORMATION 13081
WriteX 13081 0 53077 53077
Close 13081
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13082
WriteX 13082 1535 1 1
QUERY_FILE_INFORMATION 13082
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13077 1536 512 512
ReadX 13077 288 1251 1251
ReadX 13077 2048 2018 2018
QUERY_FILE_INFORMATION 13082
WriteX 13082 0 65471 65471
WriteX 13082 65471 65 65
WriteX 13082 65536 1856 1856
WriteX 13082 0 4096 4096
Flush 13082
QUERY_FILE_INFORMATION 13077
QUERY_FILE_INFORMATION 13077
Close 13077
WriteX 13082 0 4096 4096
Close 13082
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13083
Close 13083
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13084
QUERY_FILE_INFORMATION 13084
ReadX 13084 0 512 512
ReadX 13084 512 512 512
ReadX 13084 1024 512 512
QUERY_FILE_INFORMATION 13084
QUERY_FILE_INFORMATION 13084
ReadX 13084 576 2048 2048
QUERY_FILE_INFORMATION 13084
QUERY_FILE_INFORMATION 13084
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13086
Close 13086
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13088
WriteX 13088 4076 1 1
QUERY_FILE_INFORMATION 13088
WriteX 13088 0 7983 7983
Close 13088
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13090
Close 13090
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13092
WriteX 13092 4095 1 1
QUERY_FILE_INFORMATION 13092
WriteX 13092 0 65471 65471
WriteX 13092 65471 65 65
WriteX 13092 65536 65471 65471
WriteX 13092 131007 65 65
WriteX 13092 131072 65471 65471
WriteX 13092 196543 65 65
WriteX 13092 196608 65471 65471
WriteX 13092 262079 65 65
WriteX 13092 262144 65471 65471
WriteX 13092 327615 65 65
WriteX 13092 327680 65471 65471
WriteX 13092 393151 65 65
WriteX 13092 393216 65471 65471
WriteX 13092 458687 65 65
WriteX 13092 458752 46731 46731
Close 13092
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13093
WriteX 13093 1535 1 1
QUERY_FILE_INFORMATION 13093
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13084 1536 512 512
ReadX 13084 2048 2018 2018
ReadX 13084 4096 512 512
ReadX 13084 4608 2197 2197
QUERY_FILE_INFORMATION 13093
WriteX 13093 0 65471 65471
WriteX 13093 65471 65 65
WriteX 13093 65536 22848 22848
WriteX 13093 0 4096 4096
Flush 13093
QUERY_FILE_INFORMATION 13084
QUERY_FILE_INFORMATION 13084
Close 13084
WriteX 13093 0 4096 4096
Close 13093
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13094
Close 13094
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13095
QUERY_FILE_INFORMATION 13095
ReadX 13095 0 512 512
ReadX 13095 512 512 512
ReadX 13095 1024 512 512
QUERY_FILE_INFORMATION 13095
QUERY_FILE_INFORMATION 13095
ReadX 13095 576 2048 2048
QUERY_FILE_INFORMATION 13095
QUERY_FILE_INFORMATION 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13095 4096 512 512
Close 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13096
QUERY_FILE_INFORMATION 13096
ReadX 13096 0 512 512
ReadX 13096 512 512 512
ReadX 13096 1024 512 512
QUERY_FILE_INFORMATION 13096
QUERY_FILE_INFORMATION 13096
ReadX 13096 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13096
QUERY_FILE_INFORMATION 13096
ReadX 13096 288 4096 4096
QUERY_FILE_INFORMATION 13096
QUERY_FILE_INFORMATION 13096
QUERY_FILE_INFORMATION 13096
WriteX 13096 288 4096 4096
WriteX 13096 1024 512 512
ReadX 13096 1536 512 512
QUERY_FILE_INFORMATION 13096
ReadX 13096 288 2048 2048
ReadX 13096 2336 2048 2048
ReadX 13096 3072 1536 1536
ReadX 13096 544 512 512
ReadX 13096 1056 2048 2048
ReadX 13096 3104 2048 2048
ReadX 13096 5152 2048 2048
ReadX 13096 7200 2048 2048
ReadX 13096 9248 2048 2048
ReadX 13096 11296 2048 2048
ReadX 13096 13344 2048 2048
ReadX 13096 15392 2048 2048
ReadX 13096 17440 2048 2048
ReadX 13096 19488 2048 2048
ReadX 13096 21536 2048 2048
ReadX 13096 23584 2048 2048
ReadX 13096 25632 2048 2048
ReadX 13096 27680 2048 2048
ReadX 13096 29728 2048 2048
ReadX 13096 31776 2048 2048
ReadX 13096 33824 2048 2048
ReadX 13096 35872 2048 2048
ReadX 13096 37920 2048 2048
ReadX 13096 39968 2048 2048
ReadX 13096 42016 512 512
ReadX 13096 42528 512 512
ReadX 13096 43040 1536 1536
ReadX 13096 44576 2048 2048
ReadX 13096 46624 2048 2048
ReadX 13096 48672 2048 2048
ReadX 13096 50720 2048 2048
ReadX 13096 52768 2048 2048
ReadX 13096 54816 2048 2048
ReadX 13096 56864 2048 2048
ReadX 13096 58912 2048 2048
ReadX 13096 60960 2048 2048
ReadX 13096 63008 2048 2048
ReadX 13096 65056 2048 2048
ReadX 13096 67104 2048 2048
ReadX 13096 69152 2048 2048
ReadX 13096 71200 2048 2048
ReadX 13096 73248 2048 2048
ReadX 13096 75296 2048 2048
ReadX 13096 77344 2048 2048
ReadX 13096 79392 2048 2048
ReadX 13096 81440 2048 2048
ReadX 13096 83488 2048 2048
ReadX 13096 85536 512 512
ReadX 13096 86048 512 512
ReadX 13096 86560 1536 1536
ReadX 13096 88096 2048 2048
ReadX 13096 90144 2048 2048
ReadX 13096 92192 2048 2048
ReadX 13096 94240 2048 2048
ReadX 13096 96288 2048 2048
ReadX 13096 552 2048 2048
ReadX 13096 2600 2048 2048
ReadX 13096 4648 2048 2048
ReadX 13096 6696 2048 2048
ReadX 13096 8744 2048 2048
ReadX 13096 10792 2048 2048
ReadX 13096 12840 2048 2048
ReadX 13096 14888 2048 2048
ReadX 13096 16936 2048 2048
ReadX 13096 18984 2048 2048
ReadX 13096 21032 2048 2048
ReadX 13096 23080 2048 2048
ReadX 13096 25128 2048 2048
ReadX 13096 27176 2048 2048
ReadX 13096 29224 2048 2048
ReadX 13096 31272 2048 2048
ReadX 13096 33320 2048 2048
ReadX 13096 35368 2048 2048
ReadX 13096 37416 2048 2048
ReadX 13096 39464 2048 2048
ReadX 13096 41512 512 512
ReadX 13096 42024 512 512
ReadX 13096 42536 1536 1536
ReadX 13096 44072 2048 2048
ReadX 13096 46120 2048 2048
ReadX 13096 48168 2048 2048
ReadX 13096 50216 2048 2048
ReadX 13096 52264 2048 2048
ReadX 13096 54312 2048 2048
ReadX 13096 56360 2048 2048
ReadX 13096 58408 2048 2048
ReadX 13096 60456 2048 2048
ReadX 13096 62504 2048 2048
ReadX 13096 64552 2048 2048
ReadX 13096 66600 2048 2048
ReadX 13096 68648 2048 2048
ReadX 13096 70696 2048 2048
ReadX 13096 72744 2048 2048
ReadX 13096 74792 2048 2048
ReadX 13096 76840 2048 2048
ReadX 13096 78888 2048 2048
ReadX 13096 80936 2048 2048
ReadX 13096 82984 2048 2048
ReadX 13096 85032 512 512
ReadX 13096 85544 2048 2048
ReadX 13096 87592 2048 2048
ReadX 13096 89640 2048 2048
ReadX 13096 91688 2048 2048
ReadX 13096 93736 2048 2048
ReadX 13096 95784 2048 2048
ReadX 13096 97832 2048 2048
ReadX 13096 99880 2048 2048
ReadX 13096 101928 2048 2048
ReadX 13096 103976 2048 2048
ReadX 13096 106024 2048 2048
ReadX 13096 108072 2048 2048
ReadX 13096 110120 2048 2048
ReadX 13096 112168 2048 2048
ReadX 13096 114216 2048 2048
ReadX 13096 116264 2048 2048
ReadX 13096 118312 2048 2048
ReadX 13096 120360 2048 2048
ReadX 13096 122408 2048 2048
ReadX 13096 124456 512 512
ReadX 13096 124968 512 512
ReadX 13096 125480 1536 1536
ReadX 13096 127016 2048 2048
ReadX 13096 129064 2048 2048
ReadX 13096 131112 2048 2048
ReadX 13096 133160 2048 2048
ReadX 13096 135208 2048 2048
ReadX 13096 137256 2048 2048
ReadX 13096 139304 2048 2048
ReadX 13096 141352 2048 2048
ReadX 13096 143400 2048 2048
ReadX 13096 145448 2048 2048
ReadX 13096 147496 2048 2048
ReadX 13096 149544 2048 2048
ReadX 13096 151592 2048 2048
ReadX 13096 153640 2048 2048
ReadX 13096 155688 2048 2048
ReadX 13096 157736 2048 2048
ReadX 13096 159784 2048 2048
ReadX 13096 161832 2048 2048
ReadX 13096 163880 2048 2048
ReadX 13096 165928 2048 2048
ReadX 13096 167976 2048 2048
ReadX 13096 170024 512 512
ReadX 13096 1538 1536 1536
ReadX 13096 3074 2048 2048
ReadX 13096 5122 2048 2048
ReadX 13096 7170 2048 2048
ReadX 13096 9218 2048 2048
ReadX 13096 11266 2048 2048
ReadX 13096 13314 2048 2048
ReadX 13096 15362 2048 2048
ReadX 13096 17410 2048 2048
ReadX 13096 19458 2048 2048
ReadX 13096 21506 2048 2048
ReadX 13096 23554 2048 2048
ReadX 13096 25602 2048 2048
ReadX 13096 27650 2048 2048
ReadX 13096 29698 2048 2048
ReadX 13096 31746 2048 2048
ReadX 13096 33794 2048 2048
ReadX 13096 35842 2048 2048
ReadX 13096 37890 2048 2048
ReadX 13096 39938 2048 2048
ReadX 13096 41986 2048 2048
ReadX 13096 44034 875 875
ReadX 13096 1730 4096 4096
ReadX 13096 1724 1536 1536
ReadX 13096 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13097
Close 13097
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13098
WriteX 13098 2047 1 1
QUERY_FILE_INFORMATION 13098
Close 13096
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13099
Close 13099
WriteX 13098 0 42388 42388
Close 13098
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13100
Close 13100
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13101
QUERY_FILE_INFORMATION 13101
ReadX 13101 0 512 512
ReadX 13101 1756 512 512
ReadX 13101 2268 512 512
QUERY_FILE_INFORMATION 13101
QUERY_FILE_INFORMATION 13101
ReadX 13101 1744 512 512
ReadX 13101 2256 512 512
ReadX 13101 2768 512 512
ReadX 13101 3280 512 512
ReadX 13101 3792 512 512
ReadX 13101 4304 512 512
ReadX 13101 512 2048 2048
QUERY_FILE_INFORMATION 13101
QUERY_FILE_INFORMATION 13101
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13102
WriteX 13102 2047 1 1
QUERY_FILE_INFORMATION 13102
QUERY_FILE_INFORMATION 13101
QUERY_FILE_INFORMATION 13101
Close 13101
WriteX 13102 0 42652 42652
Close 13102
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13103
Close 13103
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13104
QUERY_FILE_INFORMATION 13104
ReadX 13104 0 512 512
ReadX 13104 1762 512 512
ReadX 13104 2274 512 512
QUERY_FILE_INFORMATION 13104
QUERY_FILE_INFORMATION 13104
ReadX 13104 1750 512 512
ReadX 13104 2262 512 512
ReadX 13104 2774 512 512
ReadX 13104 3286 512 512
ReadX 13104 3798 512 512
ReadX 13104 4310 512 512
ReadX 13104 512 2048 2048
QUERY_FILE_INFORMATION 13104
QUERY_FILE_INFORMATION 13104
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13106
Close 13106
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13108
WriteX 13108 4080 1 1
QUERY_FILE_INFORMATION 13108
WriteX 13108 0 65471 65471
WriteX 13108 65471 65 65
WriteX 13108 65536 49 49
Close 13108
Close 13104
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13109
WriteX 13109 0 65471 65471
WriteX 13109 65471 63 63
WriteX 13109 65534 65471 65471
WriteX 13109 131005 63 63
Close 13109
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13110
WriteX 13110 0 65471 65471
WriteX 13110 65471 63 63
WriteX 13110 65534 65471 65471
WriteX 13110 131005 63 63
WriteX 13110 131068 65471 65471
WriteX 13110 196539 63 63
WriteX 13110 196602 65471 65471
WriteX 13110 262073 63 63
Close 13110
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13111
WriteX 13111 0 65471 65471
WriteX 13111 65471 63 63
WriteX 13111 65534 65471 65471
WriteX 13111 131005 63 63
WriteX 13111 131068 65471 65471
WriteX 13111 196539 63 63
WriteX 13111 196602 65471 65471
WriteX 13111 262073 63 63
WriteX 13111 262136 65471 65471
WriteX 13111 327607 63 63
WriteX 13111 327670 65471 65471
WriteX 13111 393141 63 63
WriteX 13111 393204 65471 65471
WriteX 13111 458675 63 63
WriteX 13111 458738 65471 65471
WriteX 13111 524209 63 63
Close 13111
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13112
Close 13112
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13113
Close 13113
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13116
Close 13116
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13118
Close 13118
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13119
Close 13119
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13122
Close 13122
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13124
Close 13124
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13125
Close 13125
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13128
Close 13128
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13132
Close 13132
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13136
Close 13136
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13140
Close 13140
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13144
Close 13144
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13148
Close 13148
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13152
Close 13152
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13156
Close 13156
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13158
Close 13158
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13160
Close 13160
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13162
WriteX 13162 4095 1 1
QUERY_FILE_INFORMATION 13162
QUERY_FS_INFORMATION 259
WriteX 13162 0 65471 65471
WriteX 13162 65471 65 65
WriteX 13162 65536 65471 65471
WriteX 13162 131007 65 65
WriteX 13162 131072 65471 65471
WriteX 13162 196543 65 65
WriteX 13162 196608 65471 65471
WriteX 13162 262079 65 65
WriteX 13162 262144 26634 26634
Close 13162
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13167
QUERY_FILE_INFORMATION 13167
QUERY_FILE_INFORMATION 13167
Close 13167
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13168
Close 13168
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13169
Close 13169
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13170
QUERY_FILE_INFORMATION 13170
ReadX 13170 0 512 512
ReadX 13170 288 512 512
ReadX 13170 800 512 512
Close 13170
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13171
ReadX 13171 0 24 24
Close 13171
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13172
ReadX 13172 0 24 24
Close 13172
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13173
QUERY_FILE_INFORMATION 13173
ReadX 13173 0 512 512
ReadX 13173 288 512 512
ReadX 13173 800 512 512
ReadX 13173 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13173 1759 2849 2849
Close 13173
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13174
Close 13174
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13177
Close 13177
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13179
Close 13179
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13180
Close 13180
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13183
Close 13183
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13185
Close 13185
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13186
Close 13186
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13189
Close 13189
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13193
Close 13193
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13197
Close 13197
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13201
Close 13201
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13205
Close 13205
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13209
Close 13209
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13212
Close 13212
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13216
Close 13216
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13220
Close 13220
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13222
Close 13222
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13223
Close 13223
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13232
QUERY_FILE_INFORMATION 13232
QUERY_FILE_INFORMATION 13232
Close 13232
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13233
Close 13233
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13234
Close 13234
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13235
QUERY_FILE_INFORMATION 13235
ReadX 13235 0 512 512
ReadX 13235 288 512 512
ReadX 13235 800 512 512
Close 13235
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13236
ReadX 13236 0 24 24
Close 13236
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13237
QUERY_FILE_INFORMATION 13237
ReadX 13237 0 512 512
ReadX 13237 288 512 512
ReadX 13237 800 512 512
ReadX 13237 512 36 36
Close 13237
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13238
QUERY_FILE_INFORMATION 13238
ReadX 13238 0 512 512
ReadX 13238 288 512 512
ReadX 13238 800 512 512
ReadX 13238 512 682 682
ReadX 13238 3584 106 106
ReadX 13238 3712 10 10
ReadX 13238 3722 10 10
ReadX 13238 512 2048 2048
ReadX 13238 3072 512 512
ReadX 13238 276 84 84
ReadX 13238 273 49 49
ReadX 13238 2560 512 512
Close 13238
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13248
QUERY_FILE_INFORMATION 13248
QUERY_FILE_INFORMATION 13248
Close 13248
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13249
Close 13249
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13250
Close 13250
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13251
QUERY_FILE_INFORMATION 13251
ReadX 13251 0 512 512
ReadX 13251 288 512 512
ReadX 13251 800 512 512
Close 13251
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13252
ReadX 13252 0 24 24
Close 13252
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13253
QUERY_FILE_INFORMATION 13253
ReadX 13253 0 512 512
ReadX 13253 288 512 512
ReadX 13253 800 512 512
ReadX 13253 512 36 36
Close 13253
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13254
QUERY_FILE_INFORMATION 13254
ReadX 13254 0 512 512
ReadX 13254 288 512 512
ReadX 13254 800 512 512
ReadX 13254 512 682 682
ReadX 13254 3072 106 106
ReadX 13254 3200 10 10
ReadX 13254 3210 10 10
ReadX 13254 512 2048 2048
ReadX 13254 2560 512 512
ReadX 13254 3887 84 84
ReadX 13254 3838 49 49
ReadX 13254 2048 512 512
Close 13254
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13255
Close 13255
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13256
QUERY_FILE_INFORMATION 13256
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 13256
QUERY_FILE_INFORMATION 13256
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13257
QUERY_FILE_INFORMATION 13257
QUERY_FILE_INFORMATION 13257
QUERY_FILE_INFORMATION 13257
ReadX 13257 2156 24 24
ReadX 13257 2139 276 276
ReadX 13257 2136 14 14
ReadX 13257 2136 7 7
ReadX 13257 2138 12 12
ReadX 13257 2137 8 8
ReadX 13257 2135 15 15
ReadX 13257 0 16 16
ReadX 13257 16 2048 2048
ReadX 13257 2064 2048 2048
ReadX 13257 257 2048 2048
ReadX 13257 385 2048 2048
ReadX 13257 513 2048 2048
ReadX 13257 641 2048 2048
ReadX 13257 769 2048 2048
ReadX 13257 897 2048 2048
ReadX 13257 1025 2048 2048
ReadX 13257 1153 2048 2048
ReadX 13257 1281 2048 2048
ReadX 13257 1409 2048 2048
ReadX 13257 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13259
Close 13259
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13261
WriteX 13261 15 1 1
QUERY_FILE_INFORMATION 13261
WriteX 13261 0 10575 10575
Flush 13261
Close 13261
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13262
Close 13262
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13263
QUERY_FILE_INFORMATION 13263
QUERY_FILE_INFORMATION 13263
QUERY_FILE_INFORMATION 13263
ReadX 13263 2157 24 24
ReadX 13263 2139 276 276
ReadX 13263 2137 14 14
ReadX 13263 2137 7 7
ReadX 13263 2139 12 12
ReadX 13263 2138 8 8
ReadX 13263 2136 15 15
Close 13257
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13264
Close 13264
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13265
QUERY_FILE_INFORMATION 13265
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13266
QUERY_FILE_INFORMATION 13266
ReadX 13266 0 512 512
ReadX 13266 512 512 512
ReadX 13266 1024 512 512
QUERY_FILE_INFORMATION 13266
QUERY_FILE_INFORMATION 13266
Close 13266
QUERY_FILE_INFORMATION 13265
ReadX 13265 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13267
QUERY_FILE_INFORMATION 13267
ReadX 13267 0 512 512
ReadX 13267 512 512 512
ReadX 13267 1024 512 512
ReadX 13267 288 20 20
ReadX 13267 308 2084 2084
ReadX 13267 388 2084 2084
ReadX 13267 388 2084 2084
ReadX 13256 2157 1386 1386
ReadX 13267 2472 399 399
ReadX 13267 3072 1536 1536
ReadX 13267 544 149 149
ReadX 13267 693 485 485
Close 13267
ReadX 13256 2157 4096 4096
ReadX 13256 6253 4096 4096
ReadX 13256 10349 4096 4096
ReadX 13256 14445 4096 4096
ReadX 13256 18541 4096 4096
ReadX 13256 22637 256 256
ReadX 13256 22893 4096 4096
ReadX 13256 26989 4096 4096
ReadX 13256 31085 4096 4096
ReadX 13256 35181 4096 4096
ReadX 13256 39277 4096 4096
ReadX 13256 43373 4096 4096
ReadX 13256 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13256 2157 1024 1024
ReadX 13256 1667 4688 4688
ReadX 13256 6355 3516 3516
ReadX 13256 9871 16384 16384
ReadX 13256 26255 3771 3771
ReadX 13256 30026 2048 2048
ReadX 13256 32074 1024 1024
ReadX 13256 33098 6652 6652
ReadX 13256 39750 16384 16384
ReadX 13256 56134 10496 10496
ReadX 13256 66630 1784 1784
ReadX 13256 68414 90 90
ReadX 13256 68504 273 273
ReadX 13256 68777 1600 1600
ReadX 13256 70377 640 640
ReadX 13256 71017 1280 1280
ReadX 13256 72297 8464 8464
ReadX 13256 80761 158 158
ReadX 13256 80919 912 912
ReadX 13256 81831 1980 1980
ReadX 13256 83811 2256 2256
ReadX 13256 86067 400 400
ReadX 13256 86467 252 252
ReadX 13256 86719 42 42
ReadX 13256 86761 725 725
ReadX 13256 2009 512 512
ReadX 13256 3895 9 9
ReadX 13256 3781 46 46
ReadX 13256 4059 92 92
ReadX 13256 3781 92 92
ReadX 13256 3986 184 184
ReadX 13256 3987 16384 16384
ReadX 13256 3902 16384 16384
ReadX 13256 3781 10240 10240
ReadX 13256 3821 16384 16384
ReadX 13256 3891 935 935
ReadX 13256 4060 10240 10240
ReadX 13256 4059 184 184
ReadX 13256 256 184 184
ReadX 13256 256 1026 1026
ReadX 13256 3901 326 326
ReadX 13256 3899 652 652
ReadX 13256 256 2 2
ReadX 13256 258 4948 4948
Close 13256
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13269
Close 13269
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13271
WriteX 13271 4055 1 1
QUERY_FILE_INFORMATION 13271
WriteX 13271 0 65471 65471
WriteX 13271 65471 65 65
WriteX 13271 65536 65471 65471
WriteX 13271 131007 65 65
WriteX 13271 131072 65471 65471
WriteX 13271 196543 65 65
WriteX 13271 196608 65471 65471
WriteX 13271 262079 65 65
WriteX 13271 262144 65471 65471
WriteX 13271 327615 65 65
WriteX 13271 327680 65471 65471
WriteX 13271 393151 65 65
WriteX 13271 393216 65471 65471
WriteX 13271 458687 65 65
WriteX 13271 458752 65471 65471
WriteX 13271 524223 65 65
WriteX 13271 524288 65471 65471
WriteX 13271 589759 65 65
WriteX 13271 589824 35257 35257
Close 13271
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13273
Close 13273
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13275
WriteX 13275 4055 1 1
QUERY_FILE_INFORMATION 13275
WriteX 13275 0 65471 65471
WriteX 13275 65471 65 65
WriteX 13275 65536 65471 65471
WriteX 13275 131007 65 65
WriteX 13275 131072 65471 65471
WriteX 13275 196543 65 65
WriteX 13275 196608 65471 65471
WriteX 13275 262079 65 65
WriteX 13275 262144 65471 65471
WriteX 13275 327615 65 65
WriteX 13275 327680 65471 65471
WriteX 13275 393151 65 65
WriteX 13275 393216 65471 65471
WriteX 13275 458687 65 65
WriteX 13275 458752 65471 65471
WriteX 13275 524223 65 65
WriteX 13275 524288 65471 65471
WriteX 13275 589759 65 65
WriteX 13275 589824 57598 57598
Close 13275
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13277
WriteX 13277 15 1 1
QUERY_FILE_INFORMATION 13277
WriteX 13277 0 12543 12543
Flush 13277
Close 13277
Close 13263
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13278
Close 13278
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13279
QUERY_FILE_INFORMATION 13279
QUERY_FILE_INFORMATION 13279
QUERY_FILE_INFORMATION 13279
ReadX 13279 288 24 24
ReadX 13279 287 276 276
ReadX 13279 286 14 14
ReadX 13279 286 7 7
ReadX 13279 287 12 12
ReadX 13279 287 8 8
ReadX 13279 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13280
Close 13280
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13281
QUERY_FILE_INFORMATION 13281
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 13281
QUERY_FILE_INFORMATION 13281
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13282
QUERY_FILE_INFORMATION 13282
QUERY_FILE_INFORMATION 13282
QUERY_FILE_INFORMATION 13282
ReadX 13282 1938 24 24
ReadX 13282 1920 276 276
ReadX 13282 1918 14 14
ReadX 13282 1918 7 7
ReadX 13282 1919 12 12
ReadX 13282 1919 8 8
ReadX 13282 1917 15 15
ReadX 13282 0 16 16
ReadX 13282 16 2048 2048
ReadX 13282 2064 2048 2048
ReadX 13282 257 2048 2048
ReadX 13282 385 2048 2048
ReadX 13282 513 2048 2048
ReadX 13282 641 2048 2048
ReadX 13282 769 2048 2048
ReadX 13282 897 2048 2048
ReadX 13282 1025 2048 2048
ReadX 13282 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13284
Close 13284
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13286
WriteX 13286 15 1 1
QUERY_FILE_INFORMATION 13286
WriteX 13286 0 11588 11588
Flush 13286
Close 13286
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13287
Close 13287
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13288
QUERY_FILE_INFORMATION 13288
QUERY_FILE_INFORMATION 13288
QUERY_FILE_INFORMATION 13288
ReadX 13288 1909 24 24
ReadX 13288 1892 276 276
ReadX 13288 1889 14 14
ReadX 13288 1889 7 7
ReadX 13288 1891 12 12
ReadX 13288 1890 8 8
ReadX 13288 1888 15 15
Close 13282
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13290
WriteX 13290 15 1 1
QUERY_FILE_INFORMATION 13290
WriteX 13290 0 11615 11615
Flush 13290
Close 13290
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13288
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13291
Close 13291
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13292
QUERY_FILE_INFORMATION 13292
QUERY_FILE_INFORMATION 13292
QUERY_FILE_INFORMATION 13292
ReadX 13292 1947 24 24
ReadX 13292 1929 276 276
ReadX 13292 1927 14 14
ReadX 13292 1927 7 7
ReadX 13292 1929 12 12
ReadX 13292 1928 8 8
ReadX 13292 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13294
Close 13294
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13296
WriteX 13296 4088 1 1
QUERY_FILE_INFORMATION 13296
WriteX 13296 0 65471 65471
WriteX 13296 65471 65 65
WriteX 13296 65536 16050 16050
Close 13296
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13281 1939 64 64
ReadX 13281 128 248 248
ReadX 13281 128 568 568
ReadX 13281 3872 1536 1536
ReadX 13281 3456 2560 2560
ReadX 13281 3136 512 512
ReadX 13281 2880 4096 4096
ReadX 13281 3264 3072 3072
ReadX 13281 320 4096 4096
ReadX 13281 1024 4096 4096
ReadX 13281 3616 4096 4096
ReadX 13281 1939 64 64
ReadX 13281 128 248 248
ReadX 13281 128 608 608
ReadX 13281 2858 1024 1024
ReadX 13281 2810 4096 4096
ReadX 13281 2826 4096 4096
ReadX 13281 2580 2048 2048
ReadX 13281 2800 2560 2560
ReadX 13281 2100 4096 4096
ReadX 13281 2084 4096 4096
ReadX 13281 868 4096 4096
ReadX 13281 2324 4096 4096
ReadX 13281 884 4096 4096
ReadX 13281 2604 1024 1024
ReadX 13281 580 4096 4096
ReadX 13281 596 4096 4096
ReadX 13281 2752 4096 4096
ReadX 13281 2842 1024 1024
ReadX 13281 660 4096 4096
ReadX 13281 2720 4096 4096
ReadX 13281 2736 4096 4096
ReadX 13281 628 4096 4096
ReadX 13281 2704 4096 4096
ReadX 13281 1556 4096 4096
ReadX 13281 576 4096 4096
ReadX 13281 3168 1536 1536
ReadX 13281 832 4096 4096
ReadX 13281 1088 4096 4096
ReadX 13281 1344 4096 4096
ReadX 13281 1600 4096 4096
ReadX 13281 1856 4096 4096
ReadX 13281 2112 4096 4096
ReadX 13281 1892 4096 4096
ReadX 13281 820 4096 4096
ReadX 13281 788 4096 4096
ReadX 13281 1604 4096 4096
ReadX 13281 3648 4096 4096
ReadX 13281 2608 4096 4096
ReadX 13281 548 4096 4096
ReadX 13281 740 4096 4096
ReadX 13281 1344 4096 4096
ReadX 13281 3392 4096 4096
ReadX 13281 3904 4096 4096
ReadX 13281 644 4096 4096
ReadX 13281 676 4096 4096
ReadX 13281 2688 4096 4096
ReadX 13281 320 4096 4096
ReadX 13281 900 4096 4096
ReadX 13281 1908 4096 4096
ReadX 13281 852 4096 4096
ReadX 13281 724 4096 4096
ReadX 13281 2292 4096 4096
ReadX 13281 612 4096 4096
ReadX 13281 388 4096 4096
ReadX 13281 2368 4096 4096
ReadX 13281 2624 4096 4096
ReadX 13281 500 4096 4096
ReadX 13281 356 4096 4096
ReadX 13281 1024 4096 4096
ReadX 13281 576 4096 4096
ReadX 13281 340 4096 4096
ReadX 13281 420 4096 4096
ReadX 13281 1600 4096 4096
ReadX 13281 404 4096 4096
ReadX 13281 1428 4096 4096
ReadX 13281 2656 4096 4096
ReadX 13281 2624 4096 4096
ReadX 13281 452 4096 4096
ReadX 13281 692 4096 4096
ReadX 13281 564 4096 4096
ReadX 13281 372 4096 4096
ReadX 13281 468 4096 4096
ReadX 13281 484 4096 4096
ReadX 13281 1088 4096 4096
ReadX 13281 1924 4096 4096
ReadX 13281 2768 4096 4096
ReadX 13281 832 4096 4096
ReadX 13281 836 4096 4096
ReadX 13281 1856 4096 4096
ReadX 13281 2640 4096 4096
ReadX 13281 436 4096 4096
ReadX 13281 1828 4096 4096
ReadX 13281 804 4096 4096
ReadX 13281 1860 4096 4096
ReadX 13281 1812 4096 4096
ReadX 13281 756 4096 4096
ReadX 13281 1636 4096 4096
ReadX 13281 772 4096 4096
ReadX 13281 2036 4096 4096
ReadX 13281 1220 4096 4096
ReadX 13281 1652 4096 4096
ReadX 13281 2588 4096 4096
ReadX 13281 916 4096 4096
ReadX 13281 260 4096 4096
ReadX 13281 932 4096 4096
ReadX 13281 2624 4096 4096
ReadX 13281 308 4096 4096
ReadX 13281 292 4096 4096
ReadX 13281 1140 4096 4096
ReadX 13281 276 4096 4096
ReadX 13281 2020 4096 4096
ReadX 13281 2880 4096 4096
ReadX 13281 516 4096 4096
ReadX 13281 1844 4096 4096
ReadX 13281 1124 4096 4096
ReadX 13281 3136 4096 4096
ReadX 13281 324 4096 4096
ReadX 13281 1156 4096 4096
ReadX 13281 1172 4096 4096
ReadX 13281 2112 4096 4096
ReadX 13281 2368 4096 4096
ReadX 13281 964 4096 4096
ReadX 13281 980 4096 4096
ReadX 13281 1012 4096 4096
ReadX 13281 532 4096 4096
ReadX 13281 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13281 1620 4096 4096
ReadX 13281 1604 4096 4096
ReadX 13281 2116 4096 4096
ReadX 13281 2132 4096 4096
ReadX 13281 2148 4096 4096
ReadX 13281 2276 4096 4096
ReadX 13281 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13298
Close 13298
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13300
QUERY_FILE_INFORMATION 13265
WriteX 13300 4088 1 1
QUERY_FILE_INFORMATION 13300
QUERY_FILE_INFORMATION 13265
Close 13265
WriteX 13300 0 65471 65471
WriteX 13300 65471 65 65
WriteX 13300 65536 64850 64850
Close 13300
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13302
WriteX 13302 15 1 1
QUERY_FILE_INFORMATION 13302
ReadX 13281 2068 4096 4096
ReadX 13281 1588 4096 4096
ReadX 13281 1572 4096 4096
WriteX 13302 0 18630 18630
Flush 13302
Close 13302
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13292
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13303
Close 13303
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13304
QUERY_FILE_INFORMATION 13304
QUERY_FILE_INFORMATION 13304
QUERY_FILE_INFORMATION 13304
ReadX 13304 661 24 24
ReadX 13304 659 356 356
ReadX 13304 659 14 14
ReadX 13304 659 7 7
ReadX 13304 659 12 12
ReadX 13304 659 8 8
ReadX 13304 659 15 15
ReadX 13304 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13281 612 4096 4096
ReadX 13281 564 4096 4096
ReadX 13281 1876 4096 4096
ReadX 13281 628 4096 4096
ReadX 13281 740 4096 4096
ReadX 13281 724 4096 4096
ReadX 13281 644 4096 4096
ReadX 13281 2324 4096 4096
ReadX 13281 660 4096 4096
ReadX 13281 852 4096 4096
ReadX 13281 868 4096 4096
Close 13304
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 13279
ReadX 13281 2368 4096 4096
ReadX 13281 1024 4096 4096
ReadX 13281 320 4096 4096
ReadX 13281 580 4096 4096
ReadX 13281 3136 512 512
ReadX 13281 2880 4096 4096
Close 13281
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13305
WriteX 13305 0 65471 65471
WriteX 13305 65471 63 63
WriteX 13305 65534 65471 65471
WriteX 13305 131005 63 63
Close 13305
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13306
WriteX 13306 0 65471 65471
WriteX 13306 65471 63 63
WriteX 13306 65534 65471 65471
WriteX 13306 131005 63 63
WriteX 13306 131068 65471 65471
WriteX 13306 196539 63 63
WriteX 13306 196602 65471 65471
WriteX 13306 262073 63 63
Close 13306
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13307
WriteX 13307 0 65471 65471
WriteX 13307 65471 63 63
WriteX 13307 65534 65471 65471
WriteX 13307 131005 63 63
WriteX 13307 131068 65471 65471
WriteX 13307 196539 63 63
WriteX 13307 196602 65471 65471
WriteX 13307 262073 63 63
WriteX 13307 262136 65471 65471
WriteX 13307 327607 63 63
WriteX 13307 327670 65471 65471
WriteX 13307 393141 63 63
WriteX 13307 393204 65471 65471
WriteX 13307 458675 63 63
WriteX 13307 458738 65471 65471
WriteX 13307 524209 63 63
Close 13307
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13308
Close 13308
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13309
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13309 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13310
ReadX 13310 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13311
ReadX 13311 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13312
ReadX 13312 0 511 511
ReadX 13309 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13309
Close 13310
Close 13311
Close 13312
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13313
ReadX 13313 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13314
ReadX 13314 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13315
ReadX 13315 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13316
ReadX 13316 0 511 511
ReadX 13313 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13317
FIND_FIRST \clients\client1\~dmtmp\*
Close 13317
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13318
QUERY_FILE_INFORMATION 13318
WriteX 13318 2047 1 1
QUERY_FILE_INFORMATION 13318
WriteX 13318 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13319
Close 13319
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13320
WriteX 13320 52 1 1
QUERY_FILE_INFORMATION 13320
WriteX 13320 0 53 53
WriteX 13320 53 28 28
WriteX 13320 81 4 4
WriteX 13320 85 28 28
WriteX 13320 113 38 38
WriteX 13320 151 28 28
WriteX 13320 179 2 2
WriteX 13320 181 28 28
WriteX 13320 209 3 3
WriteX 13320 212 279 279
WriteX 13320 9 4 4
Close 13320
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13321
ReadX 13321 0 53 53
ReadX 13321 53 28 28
ReadX 13321 81 4 4
ReadX 13321 85 28 28
ReadX 13321 113 38 38
ReadX 13321 151 28 28
ReadX 13321 179 2 2
ReadX 13321 181 28 28
ReadX 13321 209 3 3
Close 13321
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13313
Close 13314
Close 13315
Close 13316
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13322
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13322 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13323
ReadX 13323 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13324
ReadX 13324 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13325
ReadX 13325 0 511 511
ReadX 13322 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13327
Close 13327
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13328
WriteX 13328 52 1 1
QUERY_FILE_INFORMATION 13328
WriteX 13328 0 53 53
WriteX 13328 53 28 28
WriteX 13328 81 28 28
WriteX 13328 109 28 28
WriteX 13328 137 28 28
WriteX 13328 165 28 28
WriteX 13328 193 28 28
WriteX 13328 221 28 28
WriteX 13328 249 4 4
WriteX 13328 253 4 4
WriteX 13328 257 4 4
WriteX 13328 261 28 28
WriteX 13328 289 2 2
WriteX 13328 291 2 2
WriteX 13328 293 2 2
WriteX 13328 295 248 248
WriteX 13328 9 4 4
Close 13328
Close 13322
Close 13323
Close 13324
Close 13325
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13329
ReadX 13329 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13330
ReadX 13330 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13331
ReadX 13331 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13332
ReadX 13332 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13333
ReadX 13333 0 53 53
ReadX 13333 53 28 28
ReadX 13333 81 28 28
ReadX 13333 109 28 28
ReadX 13333 137 28 28
ReadX 13333 165 28 28
ReadX 13333 193 28 28
ReadX 13333 221 28 28
ReadX 13333 249 4 4
ReadX 13333 253 4 4
ReadX 13333 257 4 4
ReadX 13333 261 28 28
ReadX 13333 289 2 2
ReadX 13333 291 2 2
ReadX 13333 293 2 2
Close 13333
ReadX 13329 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13329
Close 13330
Close 13331
Close 13332
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13318
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13334
Close 13334
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13335
ReadX 13335 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13336
ReadX 13336 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13337
ReadX 13337 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13338
ReadX 13338 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13339
ReadX 13339 0 53 53
ReadX 13339 53 28 28
ReadX 13339 81 28 28
ReadX 13339 109 28 28
ReadX 13339 137 28 28
ReadX 13339 165 28 28
ReadX 13339 193 28 28
ReadX 13339 221 28 28
ReadX 13339 249 4 4
ReadX 13339 253 4 4
ReadX 13339 257 4 4
ReadX 13339 261 28 28
ReadX 13339 289 2 2
ReadX 13339 291 2 2
ReadX 13339 293 2 2
Close 13339
ReadX 13335 2048 2048 2048
Close 13335
Close 13336
Close 13337
Close 13338
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13340
ReadX 13340 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13341
ReadX 13341 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13342
ReadX 13342 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13343
ReadX 13343 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13344
ReadX 13344 0 53 53
ReadX 13344 53 28 28
ReadX 13344 81 28 28
ReadX 13344 109 28 28
ReadX 13344 137 28 28
ReadX 13344 165 28 28
ReadX 13344 193 28 28
ReadX 13344 221 28 28
ReadX 13344 249 4 4
ReadX 13344 253 4 4
ReadX 13344 257 4 4
ReadX 13344 261 28 28
ReadX 13344 289 2 2
ReadX 13344 291 2 2
ReadX 13344 293 2 2
Close 13344
ReadX 13340 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13348
FIND_FIRST \clients\client1\~dmtmp\*
Close 13348
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13349
QUERY_FILE_INFORMATION 13349
WriteX 13349 2047 1 1
QUERY_FILE_INFORMATION 13349
WriteX 13349 0 2048 2048
Close 13349
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13350
ReadX 13350 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13350
Close 13340
Close 13341
Close 13342
Close 13343
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13351
ReadX 13351 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13351 4095 1 1
QUERY_FILE_INFORMATION 13351
WriteX 13351 2048 2048 2048
QUERY_FILE_INFORMATION 13351
Flush 13351
WriteX 13351 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13352
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13352 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13353
ReadX 13353 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13354
ReadX 13354 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13355
ReadX 13355 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13356
ReadX 13356 0 53 53
ReadX 13356 53 28 28
ReadX 13356 81 28 28
ReadX 13356 109 28 28
ReadX 13356 137 28 28
ReadX 13356 165 28 28
ReadX 13356 193 28 28
ReadX 13356 221 28 28
ReadX 13356 249 4 4
ReadX 13356 253 4 4
ReadX 13356 257 4 4
ReadX 13356 261 28 28
ReadX 13356 289 2 2
ReadX 13356 291 2 2
ReadX 13356 293 2 2
Close 13356
ReadX 13352 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13360
FIND_FIRST \clients\client1\~dmtmp\*
Close 13360
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13361
QUERY_FILE_INFORMATION 13361
WriteX 13361 2047 1 1
QUERY_FILE_INFORMATION 13361
WriteX 13361 0 2048 2048
Close 13361
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13362
ReadX 13362 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13366
Close 13366
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13367
QUERY_FILE_INFORMATION 13367
WriteX 13367 2047 1 1
QUERY_FILE_INFORMATION 13367
WriteX 13367 0 2048 2048
Close 13367
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13368
ReadX 13368 0 511 511
ReadX 13352 384 2048 2048
ReadX 13352 768 16384 16384
ReadX 13352 1792 14336 14336
Close 13368
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13369
ReadX 13369 0 511 511
Close 13369
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13371
Close 13371
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13362 4095 1 1
QUERY_FILE_INFORMATION 13362
WriteX 13362 2048 2048 2048
WriteX 13362 0 88 88
Close 13362
WriteX 13352 1152 2048 2048
WriteX 13352 1408 6144 6144
WriteX 13352 1920 2048 2048
WriteX 13352 0 88 88
Close 13352
WriteX 13353 0 88 88
Close 13353
WriteX 13354 0 88 88
Close 13354
Close 13355
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13372
ReadX 13372 0 511 511
ReadX 13372 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13372
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13373
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13373 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13374
ReadX 13374 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13375
ReadX 13375 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13376
ReadX 13376 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13377
ReadX 13377 0 53 53
ReadX 13377 53 28 28
ReadX 13377 81 28 28
ReadX 13377 109 28 28
ReadX 13377 137 28 28
ReadX 13377 165 28 28
ReadX 13377 193 28 28
ReadX 13377 221 28 28
ReadX 13377 249 4 4
ReadX 13377 253 4 4
ReadX 13377 257 4 4
ReadX 13377 261 28 28
ReadX 13377 289 2 2
ReadX 13377 291 2 2
ReadX 13377 293 2 2
Close 13377
ReadX 13373 2048 2048 2048
Close 13373
Close 13374
Close 13375
Close 13376
Close 13351
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13378
QUERY_FILE_INFORMATION 13378
Close 13378
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13379
Close 13379
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13380
ReadX 13380 0 511 511
ReadX 13380 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13381
ReadX 13381 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13382
ReadX 13382 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13383
ReadX 13383 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13384
ReadX 13384 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13385
ReadX 13385 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13386
ReadX 13386 0 53 53
ReadX 13386 53 2 2
ReadX 13386 55 2 2
ReadX 13386 57 184 184
ReadX 13386 241 298 298
Close 13386
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13387
ReadX 13387 0 41 41
ReadX 13380 2048 2048 2048
Close 13387
Close 13380
Close 13381
Close 13384
Close 13385
Close 13382
Close 13383
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13388
ReadX 13388 0 511 511
ReadX 13388 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13389
ReadX 13389 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13390
ReadX 13390 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13391
ReadX 13391 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13392
ReadX 13392 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13393
ReadX 13393 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13394
ReadX 13394 0 53 53
ReadX 13394 53 2 2
ReadX 13394 55 2 2
ReadX 13394 57 184 184
ReadX 13394 241 298 298
Close 13394
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13395
ReadX 13395 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13396
ReadX 13396 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13397
ReadX 13397 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13398
ReadX 13398 0 511 511
ReadX 13397 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13399
ReadX 13399 0 53 53
ReadX 13399 53 2 2
ReadX 13399 55 480 480
ReadX 13399 535 2 2
Close 13399
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13400
ReadX 13400 0 41 41
ReadX 13388 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13404
FIND_FIRST \clients\client1\~dmtmp\*
Close 13404
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13405
QUERY_FILE_INFORMATION 13405
WriteX 13405 2047 1 1
QUERY_FILE_INFORMATION 13405
WriteX 13405 0 2048 2048
Close 13405
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13406
ReadX 13406 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13406
Close 13395
Close 13396
Close 13397
Close 13398
Close 13400
Close 13388
Close 13389
Close 13392
Close 13393
Close 13390
Close 13391
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13407
ReadX 13407 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13408
Close 13408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13409
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13409 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13410
ReadX 13410 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13411
ReadX 13411 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13412
ReadX 13412 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13413
ReadX 13413 0 53 53
ReadX 13413 53 2 2
ReadX 13413 55 480 480
ReadX 13413 535 2 2
Close 13413
ReadX 13409 2048 2048 2048
Close 13409
Close 13410
Close 13411
Close 13412
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13414
ReadX 13414 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13415
ReadX 13415 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13416
ReadX 13416 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13417
ReadX 13417 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13418
ReadX 13418 0 53 53
ReadX 13418 53 2 2
ReadX 13418 55 480 480
ReadX 13418 535 2 2
Close 13418
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13419
ReadX 13419 0 511 511
ReadX 13419 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13420
ReadX 13420 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13421
ReadX 13421 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13422
ReadX 13422 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13423
ReadX 13423 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13424
ReadX 13424 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13425
ReadX 13425 0 41 41
ReadX 13419 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13426
ReadX 13426 0 53 53
ReadX 13426 53 2 2
ReadX 13426 55 2 2
ReadX 13426 57 184 184
ReadX 13426 241 298 298
Close 13426
ReadX 13414 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13430
FIND_FIRST \clients\client1\~dmtmp\*
Close 13430
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13431
QUERY_FILE_INFORMATION 13431
WriteX 13431 2047 1 1
QUERY_FILE_INFORMATION 13431
WriteX 13431 0 2048 2048
Close 13431
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13432
ReadX 13432 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13432
Close 13425
Close 13419
Close 13420
Close 13423
Close 13424
Close 13421
Close 13422
Close 13414
Close 13415
Close 13416
Close 13417
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13433
ReadX 13433 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13407 4095 1 1
QUERY_FILE_INFORMATION 13407
WriteX 13407 2048 2048 2048
QUERY_FILE_INFORMATION 13407
Flush 13407
WriteX 13407 0 88 88
WriteX 13433 4095 1 1
QUERY_FILE_INFORMATION 13433
WriteX 13433 2048 2048 2048
QUERY_FILE_INFORMATION 13433
Flush 13433
WriteX 13433 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13434
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13434 0 511 511
ReadX 13434 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13435
ReadX 13435 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13436
ReadX 13436 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13437
ReadX 13437 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13438
ReadX 13438 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13439
ReadX 13439 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13440
ReadX 13440 0 53 53
ReadX 13440 53 2 2
ReadX 13440 55 2 2
ReadX 13440 57 184 184
ReadX 13440 241 298 298
Close 13440
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13441
ReadX 13441 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13442
ReadX 13442 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13443
ReadX 13443 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13444
ReadX 13444 0 511 511
ReadX 13443 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13445
ReadX 13445 0 53 53
ReadX 13445 53 2 2
ReadX 13445 55 480 480
ReadX 13445 535 2 2
Close 13445
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13446
ReadX 13446 0 41 41
ReadX 13434 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13447
ReadX 13447 0 53 53
ReadX 13447 53 2 2
ReadX 13447 55 480 480
ReadX 13447 535 2 2
Close 13447
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13448
ReadX 13448 0 53 53
ReadX 13448 53 2 2
ReadX 13448 55 2 2
ReadX 13448 57 184 184
ReadX 13448 241 298 298
Close 13448
ReadX 13441 2048 2048 2048
ReadX 13442 2048 2048 2048
ReadX 13441 320 16384 16384
ReadX 13441 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13449
FIND_FIRST \clients\client1\~dmtmp\*
Close 13449
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13450
QUERY_FILE_INFORMATION 13450
WriteX 13450 4095 1 1
QUERY_FILE_INFORMATION 13450
WriteX 13450 0 4096 4096
Close 13450
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13451
ReadX 13451 0 41 41
Close 13441
Close 13442
Close 13443
Close 13444
Close 13446
Close 13434
Close 13435
Close 13438
Close 13439
Close 13436
Close 13437
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13452
Close 13452
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13453
QUERY_FILE_INFORMATION 13453
WriteX 13453 4095 1 1
QUERY_FILE_INFORMATION 13453
WriteX 13453 0 4096 4096
Close 13453
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13454
ReadX 13454 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 13451
ReadX 13451 0 4096 4096
WriteX 13454 0 4096 4096
Close 13454
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13456
ReadX 13456 0 41 41
Close 13451
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13456
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13457
Close 13457
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13458
ReadX 13458 0 41 41
Close 13458
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13459
Close 13459
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13460
QUERY_FILE_INFORMATION 13460
WriteX 13460 2047 1 1
QUERY_FILE_INFORMATION 13460
WriteX 13460 0 2048 2048
Close 13460
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13461
ReadX 13461 0 511 511
ReadX 13461 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13462
ReadX 13462 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13462
Close 13461
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13463
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13463 0 511 511
ReadX 13463 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13464
ReadX 13464 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13465
ReadX 13465 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13466
ReadX 13466 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13467
ReadX 13467 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13468
ReadX 13468 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13469
ReadX 13469 0 53 53
ReadX 13469 53 2 2
ReadX 13469 55 2 2
ReadX 13469 57 184 184
ReadX 13469 241 298 298
Close 13469
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13470
ReadX 13470 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13471
ReadX 13471 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13472
ReadX 13472 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13473
ReadX 13473 0 511 511
ReadX 13472 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13474
ReadX 13474 0 53 53
ReadX 13474 53 2 2
ReadX 13474 55 480 480
ReadX 13474 535 2 2
Close 13474
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13475
ReadX 13475 0 41 41
ReadX 13463 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13476
ReadX 13476 0 53 53
ReadX 13476 53 2 2
ReadX 13476 55 480 480
ReadX 13476 535 2 2
Close 13476
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13477
ReadX 13477 0 53 53
ReadX 13477 53 2 2
ReadX 13477 55 2 2
ReadX 13477 57 184 184
ReadX 13477 241 298 298
Close 13477
ReadX 13470 2048 2048 2048
Close 13470
Close 13471
Close 13472
Close 13473
Close 13475
Close 13463
Close 13464
Close 13467
Close 13468
Close 13465
Close 13466
Close 13407
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13478
QUERY_FILE_INFORMATION 13478
Close 13478
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13433
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13479
QUERY_FILE_INFORMATION 13479
Close 13479
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13480
Close 13480
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13481
ReadX 13481 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13482
ReadX 13482 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13483
ReadX 13483 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13484
ReadX 13484 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13485
ReadX 13485 0 53 53
ReadX 13485 53 2 2
ReadX 13485 55 480 480
ReadX 13485 535 2 2
Close 13485
ReadX 13481 2048 2048 2048
Close 13481
Close 13482
Close 13483
Close 13484
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13486
ReadX 13486 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13487
ReadX 13487 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13488
ReadX 13488 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13489
ReadX 13489 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13490
ReadX 13490 0 53 53
ReadX 13490 53 2 2
ReadX 13490 55 480 480
ReadX 13490 535 2 2
Close 13490
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13491
ReadX 13491 0 511 511
ReadX 13491 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13492
ReadX 13492 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13493
ReadX 13493 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13494
ReadX 13494 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13495
ReadX 13495 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13496
ReadX 13496 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13497
ReadX 13497 0 41 41
ReadX 13491 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13498
ReadX 13498 0 53 53
ReadX 13498 53 2 2
ReadX 13498 55 2 2
ReadX 13498 57 184 184
ReadX 13498 241 298 298
Close 13498
ReadX 13486 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13502
FIND_FIRST \clients\client1\~dmtmp\*
Close 13502
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13503
QUERY_FILE_INFORMATION 13503
WriteX 13503 2047 1 1
QUERY_FILE_INFORMATION 13503
WriteX 13503 0 2048 2048
Close 13503
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13504
ReadX 13504 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13504
Close 13497
Close 13491
Close 13492
Close 13495
Close 13496
Close 13493
Close 13494
Close 13486
Close 13487
Close 13488
Close 13489
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13505
ReadX 13505 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13506
Close 13506
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13507
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13507 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13508
ReadX 13508 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13509
ReadX 13509 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13510
ReadX 13510 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13511
ReadX 13511 0 53 53
ReadX 13511 53 28 28
ReadX 13511 81 28 28
ReadX 13511 109 28 28
ReadX 13511 137 28 28
ReadX 13511 165 28 28
ReadX 13511 193 28 28
ReadX 13511 221 28 28
ReadX 13511 249 4 4
ReadX 13511 253 4 4
ReadX 13511 257 4 4
ReadX 13511 261 28 28
ReadX 13511 289 2 2
ReadX 13511 291 2 2
ReadX 13511 293 2 2
Close 13511
ReadX 13507 2048 2048 2048
Close 13507
Close 13508
Close 13509
Close 13510
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13512
ReadX 13512 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13513
ReadX 13513 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13514
ReadX 13514 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13515
ReadX 13515 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13516
ReadX 13516 0 53 53
ReadX 13516 53 28 28
ReadX 13516 81 28 28
ReadX 13516 109 28 28
ReadX 13516 137 28 28
ReadX 13516 165 28 28
ReadX 13516 193 28 28
ReadX 13516 221 28 28
ReadX 13516 249 4 4
ReadX 13516 253 4 4
ReadX 13516 257 4 4
ReadX 13516 261 28 28
ReadX 13516 289 2 2
ReadX 13516 291 2 2
ReadX 13516 293 2 2
Close 13516
ReadX 13512 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13520
FIND_FIRST \clients\client1\~dmtmp\*
Close 13520
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13521
QUERY_FILE_INFORMATION 13521
WriteX 13521 2047 1 1
QUERY_FILE_INFORMATION 13521
WriteX 13521 0 2048 2048
Close 13521
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13522
ReadX 13522 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13522
Close 13512
Close 13513
Close 13514
Close 13515
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13523
ReadX 13523 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13524
Close 13524
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13525
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13525 0 511 511
ReadX 13525 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13526
ReadX 13526 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13527
ReadX 13527 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13528
ReadX 13528 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13529
ReadX 13529 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13530
ReadX 13530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13531
ReadX 13531 0 53 53
ReadX 13531 53 2 2
ReadX 13531 55 2 2
ReadX 13531 57 184 184
ReadX 13531 241 298 298
Close 13531
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13532
ReadX 13532 0 41 41
ReadX 13525 2048 2048 2048
Close 13532
Close 13525
Close 13526
Close 13529
Close 13530
Close 13527
Close 13528
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13533
ReadX 13533 0 511 511
ReadX 13533 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13534
ReadX 13534 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13535
ReadX 13535 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13536
ReadX 13536 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13537
ReadX 13537 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13538
ReadX 13538 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13539
ReadX 13539 0 53 53
ReadX 13539 53 2 2
ReadX 13539 55 2 2
ReadX 13539 57 184 184
ReadX 13539 241 298 298
Close 13539
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13540
ReadX 13540 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13541
ReadX 13541 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13542
ReadX 13542 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13543
ReadX 13543 0 511 511
ReadX 13542 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13544
ReadX 13544 0 53 53
ReadX 13544 53 2 2
ReadX 13544 55 480 480
ReadX 13544 535 2 2
Close 13544
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13545
ReadX 13545 0 41 41
ReadX 13533 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13549
FIND_FIRST \clients\client1\~dmtmp\*
Close 13549
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13550
QUERY_FILE_INFORMATION 13550
WriteX 13550 2047 1 1
QUERY_FILE_INFORMATION 13550
WriteX 13550 0 2048 2048
Close 13550
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13551
ReadX 13551 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13551
Close 13540
Close 13541
Close 13542
Close 13543
Close 13545
Close 13533
Close 13534
Close 13537
Close 13538
Close 13535
Close 13536
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13552
ReadX 13552 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13505 4095 1 1
QUERY_FILE_INFORMATION 13505
WriteX 13505 2048 2048 2048
QUERY_FILE_INFORMATION 13505
Flush 13505
WriteX 13505 0 88 88
WriteX 13523 4095 1 1
QUERY_FILE_INFORMATION 13523
WriteX 13523 2048 2048 2048
QUERY_FILE_INFORMATION 13523
Flush 13523
WriteX 13523 0 88 88
WriteX 13552 4095 1 1
QUERY_FILE_INFORMATION 13552
WriteX 13552 2048 2048 2048
QUERY_FILE_INFORMATION 13552
Flush 13552
WriteX 13552 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13553
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13553 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13554
ReadX 13554 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13555
ReadX 13555 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13556
ReadX 13556 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13557
ReadX 13557 0 53 53
ReadX 13557 53 2 2
ReadX 13557 55 480 480
ReadX 13557 535 2 2
Close 13557
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13558
ReadX 13558 0 511 511
ReadX 13558 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13559
ReadX 13559 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13560
ReadX 13560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13561
ReadX 13561 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13562
ReadX 13562 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13563
ReadX 13563 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13564
ReadX 13564 0 41 41
ReadX 13558 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13565
ReadX 13565 0 53 53
ReadX 13565 53 2 2
ReadX 13565 55 2 2
ReadX 13565 57 184 184
ReadX 13565 241 298 298
Close 13565
ReadX 13553 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13566
ReadX 13566 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13567
ReadX 13567 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13568
ReadX 13568 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13569
ReadX 13569 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13570
ReadX 13570 0 53 53
ReadX 13570 53 28 28
ReadX 13570 81 28 28
ReadX 13570 109 28 28
ReadX 13570 137 28 28
ReadX 13570 165 28 28
ReadX 13570 193 28 28
ReadX 13570 221 28 28
ReadX 13570 249 4 4
ReadX 13570 253 4 4
ReadX 13570 257 4 4
ReadX 13570 261 28 28
ReadX 13570 289 2 2
ReadX 13570 291 2 2
ReadX 13570 293 2 2
Close 13570
ReadX 13566 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13571
ReadX 13571 0 53 53
ReadX 13571 53 2 2
ReadX 13571 55 2 2
ReadX 13571 57 184 184
ReadX 13571 241 298 298
Close 13571
ReadX 13555 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13572
ReadX 13572 0 53 53
ReadX 13572 53 2 2
ReadX 13572 55 480 480
ReadX 13572 535 2 2
Close 13572
ReadX 13566 4096 16384 16384
ReadX 13566 1280 16384 16384
ReadX 13566 2304 6144 6144
ReadX 13566 2688 2048 2048
ReadX 13553 4096 16384 16384
ReadX 13553 1280 16384 16384
ReadX 13553 2304 16384 16384
ReadX 13553 3328 16384 16384
ReadX 13553 272 16384 16384
ReadX 13553 336 16384 16384
ReadX 13553 400 16384 16384
ReadX 13553 464 16384 16384
ReadX 13553 528 16384 16384
ReadX 13553 592 16384 16384
ReadX 13553 656 16384 16384
ReadX 13553 720 16384 16384
ReadX 13553 784 16384 16384
ReadX 13553 848 16384 16384
ReadX 13553 912 16384 16384
ReadX 13559 2048 2048 2048
ReadX 13558 760 2048 2048
ReadX 13558 1144 2048 2048
ReadX 13558 408 2048 2048
ReadX 13558 912 2048 2048
ReadX 13558 1096 2048 2048
ReadX 13558 776 2048 2048
ReadX 13558 560 2048 2048
ReadX 13558 376 2048 2048
ReadX 13558 320 2048 2048
ReadX 13558 3072 2048 2048
ReadX 13558 784 2048 2048
ReadX 13558 2176 2048 2048
ReadX 13558 792 2048 2048
ReadX 13558 576 2048 2048
ReadX 13558 600 2048 2048
ReadX 13558 728 2048 2048
ReadX 13558 1112 2048 2048
ReadX 13558 664 2048 2048
ReadX 13558 976 2048 2048
ReadX 13558 3840 2048 2048
ReadX 13558 296 2048 2048
ReadX 13558 480 2048 2048
ReadX 13558 680 2048 2048
ReadX 13558 696 2048 2048
ReadX 13558 832 2048 2048
ReadX 13558 1016 2048 2048
ReadX 13558 1104 2048 2048
ReadX 13558 3200 2048 2048
ReadX 13558 264 2048 2048
ReadX 13558 448 2048 2048
ReadX 13558 648 2048 2048
ReadX 13558 1136 2048 2048
ReadX 13558 288 2048 2048
ReadX 13558 352 2048 2048
ReadX 13558 536 2048 2048
ReadX 13558 800 2048 2048
ReadX 13558 736 2048 2048
ReadX 13558 392 2048 2048
ReadX 13558 752 2048 2048
ReadX 13558 880 2048 2048
ReadX 13558 1064 2048 2048
ReadX 13558 1128 2048 2048
ReadX 13558 1536 2048 2048
ReadX 13558 2432 2048 2048
ReadX 13558 688 2048 2048
ReadX 13558 872 2048 2048
ReadX 13558 1072 2048 2048
ReadX 13558 984 2048 2048
ReadX 13558 704 2048 2048
ReadX 13558 3328 2048 2048
ReadX 13558 888 2048 2048
ReadX 13558 496 2048 2048
ReadX 13558 624 2048 2048
ReadX 13558 808 2048 2048
ReadX 13558 1008 2048 2048
ReadX 13558 1152 2048 2048
ReadX 13558 416 2048 2048
ReadX 13558 584 2048 2048
ReadX 13558 384 2048 2048
ReadX 13558 568 2048 2048
ReadX 13558 512 2048 2048
ReadX 13558 1408 2048 2048
ReadX 13558 472 2048 2048
ReadX 13558 672 2048 2048
ReadX 13558 2560 2048 2048
ReadX 13558 544 2048 2048
ReadX 13558 920 2048 2048
ReadX 13558 1120 2048 2048
ReadX 13558 2304 2048 2048
ReadX 13558 1080 2048 2048
ReadX 13558 1664 2048 2048
ReadX 13558 608 2048 2048
ReadX 13558 2688 2048 2048
ReadX 13558 3712 2048 2048
ReadX 13558 616 2048 2048
ReadX 13558 632 2048 2048
ReadX 13558 944 2048 2048
ReadX 13558 856 2048 2048
ReadX 13558 768 2048 2048
ReadX 13558 720 2048 2048
ReadX 13558 640 2048 2048
ReadX 13558 1048 2048 2048
ReadX 13558 1040 2048 2048
ReadX 13558 1032 2048 2048
ReadX 13558 1000 2048 2048
ReadX 13558 992 2048 2048
ReadX 13558 968 2048 2048
ReadX 13558 952 2048 2048
ReadX 13558 1056 2048 2048
ReadX 13558 816 2048 2048
ReadX 13558 864 2048 2048
ReadX 13558 2816 2048 2048
ReadX 13558 640 2048 2048
ReadX 13558 1024 2048 2048
ReadX 13558 504 2048 2048
ReadX 13558 424 2048 2048
ReadX 13558 840 2048 2048
ReadX 13558 896 2048 2048
ReadX 13558 520 2048 2048
ReadX 13558 960 2048 2048
ReadX 13558 552 2048 2048
ReadX 13558 488 2048 2048
ReadX 13558 824 2048 2048
ReadX 13558 304 2048 2048
ReadX 13558 768 2048 2048
ReadX 13558 712 2048 2048
ReadX 13558 512 2048 2048
ReadX 13558 432 2048 2048
ReadX 13558 384 2048 2048
ReadX 13558 2944 2048 2048
ReadX 13558 1088 2048 2048
ReadX 13558 928 2048 2048
ReadX 13558 280 2048 2048
ReadX 13558 744 2048 2048
ReadX 13558 3968 2048 2048
ReadX 13558 336 2048 2048
ReadX 13558 592 2048 2048
ReadX 13558 312 2048 2048
ReadX 13558 400 2048 2048
ReadX 13558 904 2048 2048
ReadX 13558 464 2048 2048
ReadX 13558 3456 2048 2048
ReadX 13558 848 2048 2048
ReadX 13558 936 2048 2048
ReadX 13558 656 2048 2048
ReadX 13558 344 2048 2048
ReadX 13558 440 2048 2048
ReadX 13558 4096 2048 2048
ReadX 13558 528 2048 2048
ReadX 13558 2048 2048 2048
ReadX 13558 1024 2048 2048
ReadX 13558 456 2048 2048
ReadX 13558 1792 2048 2048
ReadX 13558 1152 2048 2048
ReadX 13558 3584 2048 2048
ReadX 13558 1920 2048 2048
ReadX 13558 1280 2048 2048
ReadX 13558 896 2048 2048
ReadX 13558 328 2048 2048
Close 13566
Close 13567
Close 13568
Close 13569
Close 13564
Close 13558
Close 13559
Close 13562
Close 13563
Close 13560
Close 13561
Close 13553
Close 13554
Close 13555
Close 13556
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13573
FIND_FIRST \clients\client1\~dmtmp\*
Close 13573
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13574
QUERY_FILE_INFORMATION 13574
WriteX 13574 0 2048 2048
WriteX 13574 18431 1 1
QUERY_FILE_INFORMATION 13574
WriteX 13574 2048 16384 16384
WriteX 13574 1152 16384 16384
WriteX 13574 2176 16384 16384
WriteX 13574 3200 16384 16384
WriteX 13574 264 16384 16384
WriteX 13574 328 16384 16384
WriteX 13574 392 16384 16384
WriteX 13574 456 16384 16384
WriteX 13574 520 16384 16384
WriteX 13574 584 16384 16384
WriteX 13574 648 16384 16384
WriteX 13574 712 16384 16384
WriteX 13574 776 16384 16384
WriteX 13574 840 16384 16384
WriteX 13574 904 16384 16384
WriteX 13574 968 16384 16384
WriteX 13574 1032 16384 16384
WriteX 13574 1096 16384 16384
WriteX 13574 1160 16384 16384
WriteX 13574 1224 16384 16384
WriteX 13574 1288 16384 16384
WriteX 13574 1352 16384 16384
WriteX 13574 1416 16384 16384
WriteX 13574 1480 16384 16384
WriteX 13574 1544 16384 16384
WriteX 13574 1608 16384 16384
WriteX 13574 1672 16384 16384
WriteX 13574 1736 16384 16384
WriteX 13574 1800 16384 16384
WriteX 13574 1864 16384 16384
WriteX 13574 1928 16384 16384
WriteX 13574 1992 16384 16384
WriteX 13574 2056 16384 16384
WriteX 13574 2120 16384 16384
WriteX 13574 2184 16384 16384
WriteX 13574 2248 16384 16384
WriteX 13574 2312 16384 16384
WriteX 13574 2376 16384 16384
WriteX 13574 2440 16384 16384
WriteX 13574 0 88 88
Close 13574
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13575
ReadX 13575 0 511 511
ReadX 13575 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13575
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13576
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13576 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13577
ReadX 13577 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13578
ReadX 13578 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13579
ReadX 13579 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13580
ReadX 13580 0 53 53
ReadX 13580 53 2 2
ReadX 13580 55 480 480
ReadX 13580 535 2 2
Close 13580
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13581
ReadX 13581 0 511 511
ReadX 13581 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13582
ReadX 13582 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13583
ReadX 13583 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13584
ReadX 13584 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13585
ReadX 13585 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13586
ReadX 13586 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13587
ReadX 13587 0 41 41
ReadX 13581 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13588
ReadX 13588 0 53 53
ReadX 13588 53 2 2
ReadX 13588 55 2 2
ReadX 13588 57 184 184
ReadX 13588 241 298 298
Close 13588
ReadX 13576 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13589
ReadX 13589 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13590
ReadX 13590 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13591
ReadX 13591 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13592
ReadX 13592 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13593
ReadX 13593 0 53 53
ReadX 13593 53 28 28
ReadX 13593 81 28 28
ReadX 13593 109 28 28
ReadX 13593 137 28 28
ReadX 13593 165 28 28
ReadX 13593 193 28 28
ReadX 13593 221 28 28
ReadX 13593 249 4 4
ReadX 13593 253 4 4
ReadX 13593 257 4 4
ReadX 13593 261 28 28
ReadX 13593 289 2 2
ReadX 13593 291 2 2
ReadX 13593 293 2 2
Close 13593
ReadX 13589 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13594
ReadX 13594 0 53 53
ReadX 13594 53 2 2
ReadX 13594 55 2 2
ReadX 13594 57 184 184
ReadX 13594 241 298 298
Close 13594
ReadX 13578 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13595
ReadX 13595 0 53 53
ReadX 13595 53 2 2
ReadX 13595 55 480 480
ReadX 13595 535 2 2
Close 13595
Close 13589
Close 13590
Close 13591
Close 13592
Close 13587
Close 13581
Close 13582
Close 13585
Close 13586
Close 13583
Close 13584
Close 13576
Close 13577
Close 13578
Close 13579
Close 13505
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13596
QUERY_FILE_INFORMATION 13596
Close 13596
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13523
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13597
QUERY_FILE_INFORMATION 13597
Close 13597
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13552
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13598
QUERY_FILE_INFORMATION 13598
Close 13598
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
Close 13599
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13600
ReadX 13600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13601
ReadX 13601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13602
ReadX 13602 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13603
ReadX 13603 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13604
ReadX 13604 0 53 53
ReadX 13604 53 28 28
ReadX 13604 81 28 28
ReadX 13604 109 28 28
ReadX 13604 137 28 28
ReadX 13604 165 28 28
ReadX 13604 193 28 28
ReadX 13604 221 28 28
ReadX 13604 249 4 4
ReadX 13604 253 4 4
ReadX 13604 257 4 4
ReadX 13604 261 28 28
ReadX 13604 289 2 2
ReadX 13604 291 2 2
ReadX 13604 293 2 2
Close 13604
ReadX 13600 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13600 384 2048 2048
ReadX 13600 768 16384 16384
ReadX 13600 1792 14336 14336
ReadX 13603 2048 2048 2048
ReadX 13602 2048 2048 2048
WriteX 13600 1152 2048 2048
WriteX 13603 2048 2048 2048
WriteX 13602 2048 2048 2048
WriteX 13600 0 88 88
WriteX 13601 0 88 88
WriteX 13602 0 88 88
WriteX 13603 0 88 88
Close 13600
Close 13601
Close 13602
Close 13603
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13605
Close 13605
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13606
ReadX 13606 0 511 511
ReadX 13606 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13607
ReadX 13607 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13608
ReadX 13608 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13609
ReadX 13609 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13610
ReadX 13610 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13611
ReadX 13611 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13612
ReadX 13612 0 53 53
ReadX 13612 53 2 2
ReadX 13612 55 2 2
ReadX 13612 57 184 184
ReadX 13612 241 298 298
Close 13612
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13613
ReadX 13613 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13614
ReadX 13614 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13615
ReadX 13615 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13616
ReadX 13616 0 511 511
ReadX 13615 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13617
ReadX 13617 0 53 53
ReadX 13617 53 2 2
ReadX 13617 55 480 480
ReadX 13617 535 2 2
Close 13617
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13618
ReadX 13618 0 41 41
ReadX 13606 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13619
QUERY_FILE_INFORMATION 13619
QUERY_FILE_INFORMATION 13619
ReadX 13619 0 8192 8192
Close 13619
ReadX 13606 1152 2048 2048
ReadX 13606 4096 16384 16384
Close 13613
Close 13614
Close 13615
Close 13616
Close 13618
Close 13606
Close 13607
Close 13610
Close 13611
Close 13608
Close 13609
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13620
Close 13620
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13621
QUERY_FILE_INFORMATION 13621
ReadX 13621 0 64 64
ReadX 13621 144 64 64
ReadX 13621 224 156 156
ReadX 13621 1193 128 128
ReadX 13621 1201 128 128
ReadX 13621 1072 4 4
ReadX 13621 1076 1925 1925
ReadX 13621 758 4 4
ReadX 13621 762 4557 4557
ReadX 13621 1052 4 4
ReadX 13621 1056 314 314
ReadX 13621 1056 11056 11056
Close 13621
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13622
ReadX 13622 0 511 511
ReadX 13622 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13623
ReadX 13623 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13624
ReadX 13624 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13625
ReadX 13625 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13626
ReadX 13626 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13627
ReadX 13627 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13628
ReadX 13628 0 53 53
ReadX 13628 53 2 2
ReadX 13628 55 2 2
ReadX 13628 57 184 184
ReadX 13628 241 298 298
Close 13628
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13629
ReadX 13629 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13630
ReadX 13630 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13631
ReadX 13631 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13632
ReadX 13632 0 511 511
ReadX 13631 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13633
ReadX 13633 0 53 53
ReadX 13633 53 2 2
ReadX 13633 55 480 480
ReadX 13633 535 2 2
Close 13633
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13634
ReadX 13634 0 41 41
ReadX 13622 2048 2048 2048
ReadX 13623 2048 2048 2048
ReadX 13622 1144 2048 2048
ReadX 13622 1152 2048 2048
ReadX 13622 4096 16384 16384
WriteX 13622 2048 2048 2048
WriteX 13623 2048 2048 2048
WriteX 13622 0 88 88
WriteX 13623 0 88 88
Close 13629
Close 13630
Close 13631
Close 13632
Close 13634
Close 13622
Close 13623
Close 13626
Close 13627
Close 13624
Close 13625
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13635
Close 13635
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13636
QUERY_FILE_INFORMATION 13636
ReadX 13636 0 64 64
ReadX 13636 144 64 64
ReadX 13636 224 84 84
ReadX 13636 478 16 16
ReadX 13636 1056 6176 6176
Close 13636
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13637
ReadX 13637 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13638
ReadX 13638 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13639
ReadX 13639 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13640
ReadX 13640 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13641
ReadX 13641 0 53 53
ReadX 13641 53 28 28
ReadX 13641 81 28 28
ReadX 13641 109 28 28
ReadX 13641 137 28 28
ReadX 13641 165 28 28
ReadX 13641 193 28 28
ReadX 13641 221 28 28
ReadX 13641 249 4 4
ReadX 13641 253 4 4
ReadX 13641 257 4 4
ReadX 13641 261 28 28
ReadX 13641 289 2 2
ReadX 13641 291 2 2
ReadX 13641 293 2 2
Close 13641
ReadX 13637 2048 2048 2048
ReadX 13638 2048 2048 2048
ReadX 13637 1280 2048 2048
ReadX 13640 2048 2048 2048
ReadX 13639 2048 2048 2048
WriteX 13637 1280 2048 2048
WriteX 13640 2048 2048 2048
WriteX 13639 2048 2048 2048
WriteX 13638 2048 2048 2048
WriteX 13637 0 88 88
WriteX 13638 0 88 88
WriteX 13639 0 88 88
WriteX 13640 0 88 88
WriteX 13637 1280 2048 2048
WriteX 13640 2048 2048 2048
WriteX 13639 2048 2048 2048
WriteX 13638 2048 2048 2048
WriteX 13637 0 88 88
WriteX 13638 0 88 88
WriteX 13639 0 88 88
WriteX 13640 0 88 88
WriteX 13637 1280 2048 2048
WriteX 13640 2048 2048 2048
WriteX 13639 2048 2048 2048
WriteX 13638 2048 2048 2048
WriteX 13637 0 88 88
WriteX 13638 0 88 88
WriteX 13639 0 88 88
WriteX 13640 0 88 88
Close 13637
Close 13638
Close 13639
Close 13640
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13642
ReadX 13642 0 511 511
ReadX 13642 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13643
ReadX 13643 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13644
ReadX 13644 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13645
ReadX 13645 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13646
ReadX 13646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13647
ReadX 13647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13648
ReadX 13648 0 53 53
ReadX 13648 53 2 2
ReadX 13648 55 2 2
ReadX 13648 57 184 184
ReadX 13648 241 298 298
Close 13648
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13649
ReadX 13649 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13650
ReadX 13650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13651
ReadX 13651 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13652
ReadX 13652 0 511 511
ReadX 13651 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13653
ReadX 13653 0 53 53
ReadX 13653 53 2 2
ReadX 13653 55 480 480
ReadX 13653 535 2 2
Close 13653
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13654
ReadX 13654 0 41 41
ReadX 13642 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13658
FIND_FIRST \clients\client1\~dmtmp\*
Close 13658
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13659
QUERY_FILE_INFORMATION 13659
WriteX 13659 2047 1 1
QUERY_FILE_INFORMATION 13659
WriteX 13659 0 2048 2048
Close 13659
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13660
ReadX 13660 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13660 4095 1 1
QUERY_FILE_INFORMATION 13660
WriteX 13660 2048 2048 2048
WriteX 13660 0 88 88
Close 13660
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13661
ReadX 13661 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13661 2048 2048 2048
Close 13649
Close 13650
Close 13651
Close 13652
Close 13654
Close 13642
Close 13643
Close 13646
Close 13647
Close 13644
Close 13645
WriteX 13661 2048 2048 2048
WriteX 13661 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13662
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13662 0 511 511
ReadX 13662 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13663
ReadX 13663 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13664
ReadX 13664 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13665
ReadX 13665 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13666
ReadX 13666 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13667
ReadX 13667 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13668
ReadX 13668 0 53 53
ReadX 13668 53 2 2
ReadX 13668 55 2 2
ReadX 13668 57 184 184
ReadX 13668 241 298 298
Close 13668
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13669
ReadX 13669 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13670
ReadX 13670 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13671
ReadX 13671 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13672
ReadX 13672 0 511 511
ReadX 13671 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13673
ReadX 13673 0 53 53
ReadX 13673 53 2 2
ReadX 13673 55 480 480
ReadX 13673 535 2 2
Close 13673
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13674
ReadX 13674 0 41 41
ReadX 13662 2048 2048 2048
ReadX 13662 1152 2048 2048
ReadX 13662 4096 16384 16384
ReadX 13662 1280 16384 16384
ReadX 13662 2304 16384 16384
ReadX 13662 3328 16384 16384
ReadX 13662 272 16384 16384
ReadX 13662 336 16384 16384
ReadX 13662 400 16384 16384
ReadX 13662 464 16384 16384
ReadX 13662 528 16384 16384
ReadX 13662 592 16384 16384
ReadX 13662 656 16384 16384
ReadX 13662 720 16384 16384
ReadX 13662 784 16384 16384
ReadX 13662 848 16384 16384
ReadX 13662 912 16384 16384
ReadX 13662 976 16384 16384
ReadX 13662 1040 16384 16384
ReadX 13662 1104 12288 12288
Close 13669
Close 13670
Close 13671
Close 13672
Close 13674
Close 13662
Close 13663
Close 13666
Close 13667
Close 13664
Close 13665
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13675
FIND_FIRST \clients\client1\~dmtmp\*
Close 13675
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13676
QUERY_FILE_INFORMATION 13676
WriteX 13676 0 2048 2048
WriteX 13676 2048 4096 4096
WriteX 13676 0 88 88
Close 13676
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13677
ReadX 13677 0 511 511
ReadX 13677 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13677
WriteX 13661 2048 2048 2048
WriteX 13661 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13678
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13678 0 511 511
ReadX 13678 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13679
ReadX 13679 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13680
ReadX 13680 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13681
ReadX 13681 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13682
ReadX 13682 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13683
ReadX 13683 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13684
ReadX 13684 0 53 53
ReadX 13684 53 2 2
ReadX 13684 55 2 2
ReadX 13684 57 184 184
ReadX 13684 241 298 298
Close 13684
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13685
ReadX 13685 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13686
ReadX 13686 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13687
ReadX 13687 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13688
ReadX 13688 0 511 511
ReadX 13687 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13689
ReadX 13689 0 53 53
ReadX 13689 53 2 2
ReadX 13689 55 480 480
ReadX 13689 535 2 2
Close 13689
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13690
ReadX 13690 0 41 41
ReadX 13678 2048 2048 2048
ReadX 13678 1152 2048 2048
ReadX 13678 4096 16384 16384
ReadX 13678 1280 16384 16384
ReadX 13678 2304 16384 16384
ReadX 13678 3328 16384 16384
ReadX 13678 272 16384 16384
ReadX 13678 336 16384 16384
ReadX 13678 400 16384 16384
ReadX 13678 464 16384 16384
ReadX 13678 528 16384 16384
ReadX 13678 592 16384 16384
ReadX 13678 656 16384 16384
ReadX 13678 720 16384 16384
ReadX 13678 784 16384 16384
ReadX 13678 848 16384 16384
ReadX 13678 912 16384 16384
ReadX 13678 976 16384 16384
ReadX 13678 1040 16384 16384
ReadX 13678 1104 12288 12288
Close 13685
Close 13686
Close 13687
Close 13688
Close 13690
Close 13678
Close 13679
Close 13682
Close 13683
Close 13680
Close 13681
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13691
FIND_FIRST \clients\client1\~dmtmp\*
Close 13691
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13692
QUERY_FILE_INFORMATION 13692
WriteX 13692 0 2048 2048
WriteX 13692 2048 4096 4096
WriteX 13692 0 88 88
Close 13692
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13693
ReadX 13693 0 511 511
ReadX 13693 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13693
Close 13661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13694
QUERY_FILE_INFORMATION 13694
Close 13694
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13695
Close 13695
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13696
QUERY_FILE_INFORMATION 13696
ReadX 13696 0 64 64
ReadX 13696 144 64 64
ReadX 13696 224 156 156
ReadX 13696 1193 128 128
ReadX 13696 1201 128 128
ReadX 13696 1072 4 4
ReadX 13696 1076 1925 1925
ReadX 13696 758 4 4
ReadX 13696 762 4557 4557
ReadX 13696 1052 4 4
ReadX 13696 1056 314 314
ReadX 13696 1056 11056 11056
Close 13696
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13697
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13697 0 511 511
ReadX 13697 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13698
ReadX 13698 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13699
ReadX 13699 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13700
ReadX 13700 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13701
ReadX 13701 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13702
ReadX 13702 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13703
ReadX 13703 0 53 53
ReadX 13703 53 2 2
ReadX 13703 55 2 2
ReadX 13703 57 184 184
ReadX 13703 241 298 298
Close 13703
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13704
ReadX 13704 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13705
ReadX 13705 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13706
ReadX 13706 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13707
ReadX 13707 0 511 511
ReadX 13706 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13708
ReadX 13708 0 53 53
ReadX 13708 53 2 2
ReadX 13708 55 480 480
ReadX 13708 535 2 2
Close 13708
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13709
ReadX 13709 0 41 41
ReadX 13697 2048 2048 2048
ReadX 13697 1152 2048 2048
ReadX 13697 4096 16384 16384
Close 13704
Close 13705
Close 13706
Close 13707
Close 13709
Close 13697
Close 13698
Close 13701
Close 13702
Close 13699
Close 13700
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13710
ReadX 13710 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13711
ReadX 13711 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13712
ReadX 13712 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13713
ReadX 13713 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13714
ReadX 13714 0 53 53
ReadX 13714 53 2 2
ReadX 13714 55 480 480
ReadX 13714 535 2 2
Close 13714
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13715
ReadX 13715 0 511 511
ReadX 13715 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13716
ReadX 13716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13717
ReadX 13717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13718
ReadX 13718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13719
ReadX 13719 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13720
ReadX 13720 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13721
ReadX 13721 0 41 41
ReadX 13715 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13722
ReadX 13722 0 53 53
ReadX 13722 53 2 2
ReadX 13722 55 2 2
ReadX 13722 57 184 184
ReadX 13722 241 298 298
Close 13722
ReadX 13710 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13726
FIND_FIRST \clients\client1\~dmtmp\*
Close 13726
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13727
QUERY_FILE_INFORMATION 13727
WriteX 13727 2047 1 1
QUERY_FILE_INFORMATION 13727
WriteX 13727 0 2048 2048
Close 13727
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13728
ReadX 13728 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13728 4095 1 1
QUERY_FILE_INFORMATION 13728
WriteX 13728 2048 2048 2048
WriteX 13728 0 88 88
Close 13728
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13729
ReadX 13729 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13729 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13733
Close 13733
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13734
QUERY_FILE_INFORMATION 13734
WriteX 13734 2047 1 1
QUERY_FILE_INFORMATION 13734
WriteX 13734 0 2048 2048
Close 13734
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13735
ReadX 13735 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13735 4095 1 1
QUERY_FILE_INFORMATION 13735
WriteX 13735 2048 2048 2048
WriteX 13735 0 88 88
Close 13735
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13736
ReadX 13736 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13736 2048 2048 2048
Close 13721
Close 13715
Close 13716
Close 13719
Close 13720
Close 13717
Close 13718
Close 13710
Close 13711
Close 13712
Close 13713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13737
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13737 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13738
ReadX 13738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13739
ReadX 13739 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13740
ReadX 13740 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13741
ReadX 13741 0 53 53
ReadX 13741 53 2 2
ReadX 13741 55 480 480
ReadX 13741 535 2 2
Close 13741
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13742
ReadX 13742 0 511 511
ReadX 13742 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13743
ReadX 13743 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13744
ReadX 13744 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13745
ReadX 13745 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13746
ReadX 13746 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13747
ReadX 13747 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13748
ReadX 13748 0 41 41
ReadX 13742 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13749
ReadX 13749 0 53 53
ReadX 13749 53 2 2
ReadX 13749 55 2 2
ReadX 13749 57 184 184
ReadX 13749 241 298 298
Close 13749
ReadX 13737 2048 2048 2048
ReadX 13737 384 16384 16384
ReadX 13737 1408 16384 16384
ReadX 13737 2560 16384 16384
ReadX 13737 3584 16384 16384
ReadX 13737 288 16384 16384
ReadX 13737 352 16384 16384
ReadX 13737 416 16384 16384
ReadX 13737 480 16384 16384
ReadX 13737 552 16384 16384
ReadX 13737 616 16384 16384
ReadX 13737 680 16384 16384
ReadX 13737 744 16384 16384
ReadX 13737 808 16384 16384
ReadX 13737 872 16384 16384
ReadX 13737 936 10240 10240
Close 13748
Close 13742
Close 13743
Close 13746
Close 13747
Close 13744
Close 13745
Close 13737
Close 13738
Close 13739
Close 13740
Close 13729
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13750
QUERY_FILE_INFORMATION 13750
Close 13750
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13736
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13751
QUERY_FILE_INFORMATION 13751
Close 13751
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13752
ReadX 13752 0 65471 65471
ReadX 13752 65471 63 63
ReadX 13752 65534 65471 65471
ReadX 13752 131005 63 63
ReadX 13752 131068 65471 65471
ReadX 13752 196539 63 63
ReadX 13752 196602 65471 65471
ReadX 13752 262073 63 63
ReadX 13752 262136 65471 65471
ReadX 13752 327607 63 63
ReadX 13752 327670 10 10
Close 13752
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13753
ReadX 13753 0 65471 65471
ReadX 13753 65471 63 63
ReadX 13753 65534 65471 65471
ReadX 13753 131005 63 63
ReadX 13753 131068 65471 65471
ReadX 13753 196539 63 63
ReadX 13753 196602 65471 65471
ReadX 13753 262073 63 63
ReadX 13753 262136 65471 65471
ReadX 13753 327607 63 63
ReadX 13753 327670 65471 65471
ReadX 13753 393141 63 63
ReadX 13753 393204 65471 65471
ReadX 13753 458675 63 63
ReadX 13753 458738 65471 65471
ReadX 13753 524209 63 63
ReadX 13753 524272 65471 65471
ReadX 13753 589743 63 63
ReadX 13753 589806 65471 65471
ReadX 13753 655277 63 63
ReadX 13753 655340 32 32
Close 13753
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13754
ReadX 13754 0 65471 65471
ReadX 13754 65471 63 63
ReadX 13754 65534 65471 65471
ReadX 13754 131005 63 63
ReadX 13754 131068 65471 65471
ReadX 13754 196539 63 63
ReadX 13754 196602 65471 65471
ReadX 13754 262073 63 63
ReadX 13754 262136 65471 65471
ReadX 13754 327607 63 63
ReadX 13754 327670 65471 65471
ReadX 13754 393141 63 63
ReadX 13754 393204 65471 65471
ReadX 13754 458675 63 63
ReadX 13754 458738 65471 65471
ReadX 13754 524209 63 63
ReadX 13754 524272 65471 65471
ReadX 13754 589743 63 63
ReadX 13754 589806 65471 65471
ReadX 13754 655277 63 63
ReadX 13754 655340 65471 65471
ReadX 13754 720811 63 63
ReadX 13754 720874 65471 65471
ReadX 13754 786345 63 63
ReadX 13754 786408 65471 65471
ReadX 13754 851879 63 63
ReadX 13754 851942 65471 65471
ReadX 13754 917413 63 63
ReadX 13754 917476 65471 65471
ReadX 13754 982947 63 63
ReadX 13754 983010 65471 65471
ReadX 13754 1048481 63 63
ReadX 13754 1048544 65471 65471
ReadX 13754 1114015 63 63
ReadX 13754 1114078 65471 65471
ReadX 13754 1179549 63 63
ReadX 13754 1179612 65471 65471
ReadX 13754 1245083 63 63
ReadX 13754 1245146 65471 65471
ReadX 13754 1310617 63 63
ReadX 13754 1310680 65471 65471
ReadX 13754 1376151 63 63
ReadX 13754 1376214 65471 65471
ReadX 13754 1441685 63 63
ReadX 13754 1441748 65471 65471
ReadX 13754 1507219 63 63
ReadX 13754 1507282 65471 65471
ReadX 13754 1572753 63 63
ReadX 13754 1572816 65471 65471
ReadX 13754 1638287 63 63
ReadX 13754 1638350 65471 65471
ReadX 13754 1703821 63 63
ReadX 13754 1703884 65471 65471
ReadX 13754 1769355 63 63
ReadX 13754 1769418 65471 65471
ReadX 13754 1834889 63 63
ReadX 13754 1834952 32824 32824
Close 13754
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13755
QUERY_FILE_INFORMATION 13755
ReadX 13755 0 512 512
ReadX 13755 512 512 512
ReadX 13755 1024 512 512
QUERY_FILE_INFORMATION 13755
QUERY_FILE_INFORMATION 13755
ReadX 13755 2560 2048 2048
ReadX 13755 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13756
WriteX 13756 52 1 1
QUERY_FILE_INFORMATION 13756
WriteX 13756 0 53 53
Close 13756
ReadX 13755 2208 650 650
ReadX 13755 1920 2048 2048
ReadX 13755 2112 2048 2048
ReadX 13755 1856 2048 2048
ReadX 13755 1824 2048 2048
ReadX 13755 1536 512 512
ReadX 13755 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13757
Close 13757
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13755 1568 512 512
ReadX 13755 1536 512 512
ReadX 13755 2176 384 384
ReadX 13755 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13758
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13755 288 2048 2048
ReadX 13755 2336 2048 2048
ReadX 13755 4384 2048 2048
ReadX 13755 6432 2048 2048
ReadX 13755 8480 2048 2048
ReadX 13755 10528 2048 2048
ReadX 13755 12576 2048 2048
WriteX 13758 15359 1 1
QUERY_FILE_INFORMATION 13758
ReadX 13755 14624 2048 2048
ReadX 13755 16672 2048 2048
ReadX 13755 18720 2048 2048
ReadX 13755 1728 2048 2048
WriteX 13758 0 15360 15360
Close 13758
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13759
QUERY_FILE_INFORMATION 13759
ReadX 13759 0 512 512
ReadX 13759 2048 512 512
ReadX 13759 2560 512 512
QUERY_FILE_INFORMATION 13759
QUERY_FILE_INFORMATION 13759
QUERY_FILE_INFORMATION 13759
QUERY_FILE_INFORMATION 13759
QUERY_FILE_INFORMATION 13759
WriteX 13759 2152 384 384
QUERY_FILE_INFORMATION 13759
WriteX 13759 2150 22 22
WriteX 13759 2144 106 106
QUERY_FILE_INFORMATION 13759
WriteX 13759 2176 496 496
ReadX 13759 2176 496 496
QUERY_FILE_INFORMATION 13759
WriteX 13759 2440 384 384
QUERY_FILE_INFORMATION 13759
WriteX 13759 2152 384 384
WriteX 13759 2432 112 112
QUERY_FILE_INFORMATION 13759
WriteX 13759 2439 16 16
QUERY_FILE_INFORMATION 13759
WriteX 13759 2208 220 220
ReadX 13759 2208 220 220
QUERY_FILE_INFORMATION 13759
QUERY_FILE_INFORMATION 13759
WriteX 13759 2440 220 220
QUERY_FILE_INFORMATION 13759
WriteX 13759 2453 36 36
WriteX 13759 2080 512 512
WriteX 13759 2176 512 512
WriteX 13759 2112 512 512
WriteX 13759 2048 512 512
WriteX 13759 0 512 512
QUERY_FILE_INFORMATION 13755
QUERY_FILE_INFORMATION 13755
WriteX 13759 2080 512 512
Close 13759
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13760
Close 13760
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13761
QUERY_FILE_INFORMATION 13761
ReadX 13761 0 512 512
ReadX 13761 2048 512 512
ReadX 13761 2560 512 512
QUERY_FILE_INFORMATION 13761
QUERY_FILE_INFORMATION 13761
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13762
Close 13762
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13755
ReadX 13761 1408 512 512
ReadX 13761 2048 512 512
ReadX 13761 1536 512 512
ReadX 13761 2560 512 512
ReadX 13761 3072 512 512
ReadX 13761 3584 512 512
ReadX 13761 4096 512 512
ReadX 13761 4608 512 512
ReadX 13761 5120 512 512
ReadX 13761 5632 512 512
ReadX 13761 6144 512 512
ReadX 13761 6656 512 512
ReadX 13761 7168 512 512
ReadX 13761 7680 512 512
ReadX 13761 8192 512 512
ReadX 13761 8704 512 512
ReadX 13761 9216 512 512
ReadX 13761 9728 512 512
ReadX 13761 10240 512 512
ReadX 13761 10752 512 512
ReadX 13761 11264 512 512
ReadX 13761 11776 512 512
ReadX 13761 12288 512 512
ReadX 13761 12800 512 512
ReadX 13761 13312 512 512
ReadX 13761 13824 512 512
ReadX 13761 14336 512 512
ReadX 13761 14848 512 512
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 15360 512 0
ReadX 13761 2560 2048 2048
ReadX 13761 4608 2048 2048
ReadX 13761 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13763
QUERY_FILE_INFORMATION 13763
ReadX 13763 0 512 512
ReadX 13763 512 512 512
ReadX 13763 1024 512 512
QUERY_FILE_INFORMATION 13763
QUERY_FILE_INFORMATION 13763
ReadX 13763 352 2048 2048
ReadX 13763 608 1097 1097
ReadX 13763 576 1609 1609
ReadX 13763 4096 512 512
ReadX 13763 1536 512 512
ReadX 13763 3840 256 256
ReadX 13763 288 576 576
ReadX 13763 512 512 512
ReadX 13763 480 512 512
ReadX 13763 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13764
ReadX 13764 0 4096 4096
ReadX 13764 4096 4096 4096
ReadX 13764 8192 4096 4096
Close 13763
Close 13764
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13765
WriteX 13765 15359 1 1
QUERY_FILE_INFORMATION 13765
WriteX 13765 0 15360 15360
Close 13765
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13766
QUERY_FILE_INFORMATION 13766
ReadX 13766 0 512 512
ReadX 13766 2048 512 512
ReadX 13766 2560 512 512
QUERY_FILE_INFORMATION 13766
QUERY_FILE_INFORMATION 13766
QUERY_FILE_INFORMATION 13766
QUERY_FILE_INFORMATION 13766
QUERY_FILE_INFORMATION 13766
WriteX 13766 2152 384 384
QUERY_FILE_INFORMATION 13766
WriteX 13766 2150 22 22
WriteX 13766 2144 106 106
QUERY_FILE_INFORMATION 13766
WriteX 13766 2176 476 476
ReadX 13766 2176 476 476
QUERY_FILE_INFORMATION 13766
WriteX 13766 2440 384 384
QUERY_FILE_INFORMATION 13766
WriteX 13766 2152 384 384
WriteX 13766 2432 92 92
QUERY_FILE_INFORMATION 13766
WriteX 13766 2437 36 36
QUERY_FILE_INFORMATION 13766
WriteX 13766 2208 220 220
ReadX 13766 2208 220 220
QUERY_FILE_INFORMATION 13766
QUERY_FILE_INFORMATION 13766
WriteX 13766 2440 220 220
QUERY_FILE_INFORMATION 13766
WriteX 13766 2453 36 36
WriteX 13766 2080 512 512
WriteX 13766 2176 512 512
WriteX 13766 2112 512 512
WriteX 13766 2048 512 512
WriteX 13766 0 512 512
QUERY_FILE_INFORMATION 13761
QUERY_FILE_INFORMATION 13761
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13761
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13767
Close 13767
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13768
QUERY_FILE_INFORMATION 13768
ReadX 13768 0 512 512
ReadX 13768 2048 512 512
ReadX 13768 2560 512 512
QUERY_FILE_INFORMATION 13768
QUERY_FILE_INFORMATION 13768
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13769
Close 13769
WriteX 13766 2080 512 512
Close 13766
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13770
Close 13770
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13771
QUERY_FILE_INFORMATION 13771
ReadX 13771 0 512 512
ReadX 13771 2048 512 512
ReadX 13771 2560 512 512
QUERY_FILE_INFORMATION 13771
QUERY_FILE_INFORMATION 13771
ReadX 13771 1312 512 512
ReadX 13771 1536 512 512
ReadX 13771 2048 512 512
ReadX 13771 576 512 512
ReadX 13771 1088 512 512
ReadX 13771 1056 512 512
ReadX 13771 1120 512 512
ReadX 13771 1184 512 512
ReadX 13771 2560 2048 2048
ReadX 13771 4608 2048 2048
ReadX 13771 6656 2048 2048
ReadX 13771 8704 2048 2048
ReadX 13771 10752 2048 2048
ReadX 13771 12800 2048 2048
ReadX 13771 14848 2048 512
ReadX 13771 15360 1536 0
ReadX 13771 1088 2048 2048
ReadX 13771 3136 2048 2048
ReadX 13771 1665 5835 5835
ReadX 13771 1856 2048 2048
ReadX 13771 2112 512 512
ReadX 13771 2152 384 384
ReadX 13771 2432 92 92
ReadX 13771 2176 512 512
ReadX 13771 2440 220 220
QUERY_FILE_INFORMATION 13771
QUERY_FILE_INFORMATION 13771
ReadX 13771 2432 512 512
WriteX 13771 2272 512 512
ReadX 13771 2144 512 512
WriteX 13771 2304 512 512
WriteX 13771 2272 92 92
WriteX 13771 2208 512 512
WriteX 13771 2720 512 512
WriteX 13771 0 512 512
QUERY_FILE_INFORMATION 13771
QUERY_FILE_INFORMATION 13771
ReadX 13771 1312 4096 4096
ReadX 13771 5408 4096 4096
ReadX 13771 9504 3305 3305
ReadX 13771 512 4096 4096
QUERY_FILE_INFORMATION 13771
QUERY_FILE_INFORMATION 13771
QUERY_FILE_INFORMATION 13771
WriteX 13771 3132 50 50
WriteX 13771 3182 4096 4096
WriteX 13771 7278 4096 4096
WriteX 13771 15469 1 1
QUERY_FILE_INFORMATION 13771
WriteX 13771 11374 4096 4096
WriteX 13771 15470 3584 3584
WriteX 13771 2144 512 512
WriteX 13771 2336 4096 4096
WriteX 13771 6432 4096 4096
WriteX 13771 10528 4096 4096
WriteX 13771 14624 462 462
WriteX 13771 2048 512 512
WriteX 13771 2560 512 512
WriteX 13771 0 512 512
QUERY_FILE_INFORMATION 13771
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13772
QUERY_FILE_INFORMATION 13772
ReadX 13772 0 512 512
ReadX 13772 1152 512 512
ReadX 13772 1664 512 512
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
ReadX 13772 512 2048 2048
ReadX 13772 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13773
WriteX 13773 52 1 1
QUERY_FILE_INFORMATION 13773
WriteX 13773 0 53 53
Close 13773
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
ReadX 13772 1120 504 504
ReadX 13772 896 2048 2048
ReadX 13772 1056 1528 1528
ReadX 13772 864 2048 2048
ReadX 13772 832 2048 2048
ReadX 13772 736 2048 2048
ReadX 13772 1216 512 512
ReadX 13772 1256 384 384
ReadX 13772 1536 140 140
ReadX 13772 1280 512 512
ReadX 13772 1548 252 252
ReadX 13771 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13774
Close 13774
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13775
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13772 2560 2048 2048
ReadX 13772 4608 2048 2048
ReadX 13772 6656 2048 2048
ReadX 13772 8704 2048 2048
ReadX 13772 10752 2048 2048
WriteX 13775 12005 1 1
QUERY_FILE_INFORMATION 13775
WriteX 13775 0 12006 12006
Close 13775
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13776
QUERY_FILE_INFORMATION 13776
ReadX 13776 0 512 512
ReadX 13776 1152 512 512
ReadX 13776 1664 512 512
QUERY_FILE_INFORMATION 13776
QUERY_FILE_INFORMATION 13776
QUERY_FILE_INFORMATION 13776
QUERY_FILE_INFORMATION 13776
QUERY_FILE_INFORMATION 13776
QUERY_FILE_INFORMATION 13776
QUERY_FILE_INFORMATION 13776
WriteX 13776 1256 384 384
QUERY_FILE_INFORMATION 13776
WriteX 13776 1254 22 22
WriteX 13776 1248 106 106
QUERY_FILE_INFORMATION 13776
WriteX 13776 1280 508 508
ReadX 13776 1280 508 508
QUERY_FILE_INFORMATION 13776
WriteX 13776 1544 384 384
QUERY_FILE_INFORMATION 13776
WriteX 13776 1256 384 384
WriteX 13776 1536 124 124
QUERY_FILE_INFORMATION 13776
WriteX 13776 1543 4 4
QUERY_FILE_INFORMATION 13776
WriteX 13776 1312 252 252
ReadX 13776 1312 252 252
QUERY_FILE_INFORMATION 13776
QUERY_FILE_INFORMATION 13776
WriteX 13776 1544 252 252
QUERY_FILE_INFORMATION 13776
WriteX 13776 1559 4 4
WriteX 13776 1184 512 512
WriteX 13776 1280 512 512
WriteX 13776 1216 512 512
WriteX 13776 1152 512 512
WriteX 13776 0 512 512
QUERY_FILE_INFORMATION 13772
QUERY_FILE_INFORMATION 13772
WriteX 13776 1184 512 512
Close 13776
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13777
Close 13777
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13778
QUERY_FILE_INFORMATION 13778
ReadX 13778 0 512 512
ReadX 13778 1152 512 512
ReadX 13778 1664 512 512
QUERY_FILE_INFORMATION 13778
QUERY_FILE_INFORMATION 13778
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13779
Close 13779
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13772
ReadX 13778 736 512 512
ReadX 13778 1536 2048 2048
ReadX 13778 3584 2048 2048
ReadX 13778 5632 2048 2048
ReadX 13778 7680 2048 2048
ReadX 13778 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13780
WriteX 13780 11990 1 1
QUERY_FILE_INFORMATION 13780
WriteX 13780 0 11991 11991
Close 13780
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13781
QUERY_FILE_INFORMATION 13781
ReadX 13781 0 512 512
ReadX 13781 1184 512 512
ReadX 13781 1696 512 512
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
WriteX 13781 1288 384 384
QUERY_FILE_INFORMATION 13781
WriteX 13781 1286 22 22
WriteX 13781 1280 106 106
QUERY_FILE_INFORMATION 13781
WriteX 13781 1312 508 508
ReadX 13781 1312 508 508
QUERY_FILE_INFORMATION 13781
WriteX 13781 1576 384 384
QUERY_FILE_INFORMATION 13781
WriteX 13781 1288 384 384
WriteX 13781 1568 124 124
QUERY_FILE_INFORMATION 13781
WriteX 13781 1575 4 4
QUERY_FILE_INFORMATION 13781
WriteX 13781 1344 252 252
ReadX 13781 1344 252 252
QUERY_FILE_INFORMATION 13781
QUERY_FILE_INFORMATION 13781
WriteX 13781 1576 252 252
QUERY_FILE_INFORMATION 13781
WriteX 13781 1591 4 4
WriteX 13781 1216 512 512
WriteX 13781 1312 512 512
WriteX 13781 1248 512 512
WriteX 13781 1184 512 512
WriteX 13781 0 512 512
QUERY_FILE_INFORMATION 13778
QUERY_FILE_INFORMATION 13778
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13778
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13782
Close 13782
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13783
QUERY_FILE_INFORMATION 13783
ReadX 13783 0 512 512
ReadX 13783 1152 512 512
ReadX 13783 1664 512 512
QUERY_FILE_INFORMATION 13783
QUERY_FILE_INFORMATION 13783
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13784
Close 13784
WriteX 13781 1216 512 512
Close 13781
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13785
Close 13785
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13786
QUERY_FILE_INFORMATION 13786
ReadX 13786 0 512 512
ReadX 13786 1184 512 512
ReadX 13786 1696 512 512
QUERY_FILE_INFORMATION 13786
QUERY_FILE_INFORMATION 13786
ReadX 13786 1536 512 512
ReadX 13786 736 512 512
ReadX 13786 2048 512 512
ReadX 13786 2560 512 512
ReadX 13786 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13787
Close 13787
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13786 914 3899 3899
ReadX 13786 1248 512 512
ReadX 13786 1288 384 384
ReadX 13786 1568 124 124
ReadX 13786 1312 512 512
ReadX 13786 1576 252 252
QUERY_FILE_INFORMATION 13786
QUERY_FILE_INFORMATION 13786
ReadX 13786 1568 512 512
WriteX 13786 1408 512 512
ReadX 13786 1280 512 512
WriteX 13786 1440 512 512
WriteX 13786 1408 124 124
WriteX 13786 1344 512 512
WriteX 13786 1856 512 512
WriteX 13786 0 512 512
QUERY_FILE_INFORMATION 13786
QUERY_FILE_INFORMATION 13786
ReadX 13786 544 4096 4096
ReadX 13786 4640 4096 4096
ReadX 13786 8736 1637 1637
ReadX 13786 512 4096 4096
QUERY_FILE_INFORMATION 13786
QUERY_FILE_INFORMATION 13786
WriteX 13786 1280 512 512
WriteX 13786 1472 3584 3584
WriteX 13786 5056 4096 4096
WriteX 13786 13247 1 1
QUERY_FILE_INFORMATION 13786
WriteX 13786 9152 4096 4096
WriteX 13786 13248 1736 1736
WriteX 13786 1184 512 512
WriteX 13786 1696 512 512
WriteX 13786 0 512 512
QUERY_FILE_INFORMATION 13786
ReadX 13786 1632 1024 1024
ReadX 13786 288 1024 1024
ReadX 13786 1312 2048 2048
ReadX 13786 3360 1024 1024
ReadX 13786 1696 1024 1024
ReadX 13786 2720 512 512
ReadX 13786 3232 512 512
ReadX 13786 3744 512 512
ReadX 13786 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13786 2066 3998 3998
ReadX 13786 1448 384 384
ReadX 13786 1408 124 124
ReadX 13786 1416 252 252
QUERY_FILE_INFORMATION 13786
QUERY_FILE_INFORMATION 13786
ReadX 13786 1408 512 512
WriteX 13786 1536 512 512
ReadX 13786 1440 512 512
WriteX 13786 2048 512 512
WriteX 13786 1536 124 124
WriteX 13786 512 512 512
WriteX 13786 1024 512 512
WriteX 13786 0 512 512
QUERY_FILE_INFORMATION 13786
ReadX 13786 1696 4096 4096
ReadX 13786 5792 4096 4096
ReadX 13786 9888 1736 1736
ReadX 13786 1280 512 512
ReadX 13786 1472 3584 3584
QUERY_FILE_INFORMATION 13786
QUERY_FILE_INFORMATION 13786
WriteX 13786 3940 156 156
WriteX 13786 4096 512 512
WriteX 13786 544 3584 3584
WriteX 13786 4128 4096 4096
WriteX 13786 8224 3584 3584
WriteX 13786 1344 512 512
WriteX 13786 1856 1536 1536
WriteX 13786 2336 512 512
WriteX 13786 3584 356 356
WriteX 13786 2560 512 512
WriteX 13786 3072 512 512
WriteX 13786 0 512 512
QUERY_FILE_INFORMATION 13786
Close 13768
Close 13771
Close 13786
Close 13783
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13788
Close 13788
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13789
Close 13789
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13790
WriteX 13790 0 65471 65471
WriteX 13790 65471 63 63
WriteX 13790 65534 65471 65471
WriteX 13790 131005 63 63
Close 13790
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13791
WriteX 13791 0 65471 65471
WriteX 13791 65471 63 63
WriteX 13791 65534 65471 65471
WriteX 13791 131005 63 63
WriteX 13791 131068 65471 65471
WriteX 13791 196539 63 63
WriteX 13791 196602 65471 65471
WriteX 13791 262073 63 63
Close 13791
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13792
WriteX 13792 0 65471 65471
WriteX 13792 65471 63 63
WriteX 13792 65534 65471 65471
WriteX 13792 131005 63 63
WriteX 13792 131068 65471 65471
WriteX 13792 196539 63 63
WriteX 13792 196602 65471 65471
WriteX 13792 262073 63 63
WriteX 13792 262136 65471 65471
WriteX 13792 327607 63 63
WriteX 13792 327670 65471 65471
WriteX 13792 393141 63 63
WriteX 13792 393204 65471 65471
WriteX 13792 458675 63 63
WriteX 13792 458738 65471 65471
WriteX 13792 524209 63 63
Close 13792
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13793
QUERY_FILE_INFORMATION 13793
QUERY_FILE_INFORMATION 13793
ReadX 13793 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13794
Close 13794
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13795
WriteX 13795 63 1 1
QUERY_FILE_INFORMATION 13795
WriteX 13795 0 64 64
ReadX 13793 992 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 344 2048 2048
ReadX 13793 1344 2048 2048
ReadX 13793 1352 2048 2048
ReadX 13793 1320 2048 2048
ReadX 13793 1360 2048 2048
ReadX 13793 1344 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2304 2048 2048
ReadX 13793 1472 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 1480 2048 2048
ReadX 13793 1488 2048 2048
ReadX 13793 1496 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 1504 2048 2048
ReadX 13793 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 1000 2048 2048
ReadX 13793 1416 2048 2048
ReadX 13793 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13793 360 2048 2048
ReadX 13793 368 2048 2048
ReadX 13793 360 2048 2048
ReadX 13793 376 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 1232 2048 2048
ReadX 13793 2432 6144 6144
ReadX 13793 2376 2048 2048
ReadX 13793 2360 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 2376 2048 2048
ReadX 13793 2384 2048 2048
ReadX 13793 2368 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 1296 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 13793 0 2048 2048
ReadX 13793 2688 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 2688 2048 2048
WriteX 13793 2688 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 2688 2048 2048
ReadX 13793 2688 2048 2048
ReadX 13793 2688 2048 2048
WriteX 13793 2688 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13793 2688 2048 2048
ReadX 13793 2688 2048 2048
WriteX 13793 2688 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 320 4096 4096
ReadX 13793 0 2048 2048
ReadX 13793 3584 2048 2048
ReadX 13793 3584 2048 2048
ReadX 13793 3584 2048 2048
ReadX 13793 0 2048 2048
WriteX 13793 3584 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2688 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 2688 2048 2048
ReadX 13793 2688 2048 2048
WriteX 13793 2688 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 3200 2048 2048
ReadX 13793 3200 2048 2048
ReadX 13793 3200 2048 2048
WriteX 13793 3200 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 3456 2048 2048
ReadX 13793 3456 2048 2048
ReadX 13793 3456 2048 2048
WriteX 13793 3456 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2496 2048 2048
ReadX 13793 2472 2048 2048
ReadX 13793 2456 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 2472 2048 2048
ReadX 13793 2480 2048 2048
ReadX 13793 2464 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 2488 2048 2048
ReadX 13793 2568 8192 8192
ReadX 13793 1000 2048 2048
ReadX 13793 328 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 2048 2048 2048
ReadX 13793 2560 2048 2048
ReadX 13793 920 2048 2048
WriteX 13793 2048 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 312 2048 2048
WriteX 13793 336 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 328 2048 2048
WriteX 13793 2560 2048 2048
WriteX 13793 3840 2048 2048
WriteX 13793 920 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2432 2048 2048
WriteX 13793 2432 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2456 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 328 2048 2048
ReadX 13793 2560 2048 2048
ReadX 13793 2048 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 336 2048 2048
ReadX 13793 920 2048 2048
WriteX 13793 1536 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 2048 2048 2048
WriteX 13793 2560 2048 2048
WriteX 13793 336 2048 2048
WriteX 13793 920 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2048 2048 2048
ReadX 13793 2432 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 2048 2048 2048
WriteX 13793 2432 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2456 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1536 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 336 2048 2048
ReadX 13793 920 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 1536 2048 2048
WriteX 13793 336 2048 2048
WriteX 13793 920 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2432 2048 2048
WriteX 13793 2432 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2456 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1536 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 336 2048 2048
ReadX 13793 920 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 1536 2048 2048
WriteX 13793 336 2048 2048
WriteX 13793 920 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2432 2048 2048
WriteX 13793 2432 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2456 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1536 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 336 2048 2048
ReadX 13793 920 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 1536 2048 2048
WriteX 13793 336 2048 2048
WriteX 13793 920 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2432 2048 2048
WriteX 13793 2432 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2456 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1536 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 336 2048 2048
ReadX 13793 920 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 1536 2048 2048
WriteX 13793 336 2048 2048
WriteX 13793 920 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2432 2048 2048
WriteX 13793 2432 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
Flush 13793
ReadX 13793 2456 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1536 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 336 2048 2048
ReadX 13793 920 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 1536 2048 2048
WriteX 13793 336 2048 2048
WriteX 13793 920 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2432 2048 2048
WriteX 13793 2432 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2624 6144 6144
ReadX 13793 2616 2048 2048
ReadX 13793 2688 2048 2048
ReadX 13793 2600 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 2616 2048 2048
ReadX 13793 2608 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 344 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 520 2048 2048
ReadX 13793 1392 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 400 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 536 2048 2048
ReadX 13793 824 2048 2048
ReadX 13793 832 2048 2048
ReadX 13793 384 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 408 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 552 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 824 2048 2048
ReadX 13793 840 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 768 2048 2048
ReadX 13793 2048 2048 2048
WriteX 13793 1415 1 1
WriteX 13793 352 2048 2048
WriteX 13793 1112 2048 2048
WriteX 13793 1400 2048 2048
WriteX 13793 1408 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 2048 2048 2048
WriteX 13793 768 2048 2048
WriteX 13793 344 2048 2048
WriteX 13793 1000 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 416 2048 2048
ReadX 13793 424 2048 2048
ReadX 13793 432 2048 2048
ReadX 13793 440 2048 2048
ReadX 13793 576 16384 16384
ReadX 13793 448 2048 2048
ReadX 13793 456 2048 2048
ReadX 13793 464 2048 2048
ReadX 13793 640 16384 16384
ReadX 13793 704 16384 16384
ReadX 13793 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 13793 848 2048 2048
ReadX 13793 560 2048 2048
ReadX 13793 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 2600 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 352 2048 2048
ReadX 13793 1928 8192 8192
ReadX 13793 528 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 824 2048 2048
ReadX 13793 0 2048 2048
Flush 13793
ReadX 13793 2600 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 352 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 824 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 856 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 392 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 472 2048 2048
ReadX 13793 480 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 488 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 928 2048 2048
ReadX 13793 936 2048 2048
ReadX 13793 976 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 392 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 952 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 528 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 528 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 816 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13793 1336 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 528 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 528 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1240 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2200 4096 4096
ReadX 13793 2152 2048 2048
ReadX 13793 2160 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1312 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 1928 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 824 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1416 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 352 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 824 2048 2048
ReadX 13793 384 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13793 352 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 768 2048 2048
ReadX 13793 2048 2048 2048
ReadX 13793 352 2048 2048
WriteX 13793 1551 1 1
WriteX 13793 1512 2048 2048
WriteX 13793 1520 2048 2048
WriteX 13793 1528 2048 2048
WriteX 13793 1544 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 2048 2048 2048
WriteX 13793 768 2048 2048
WriteX 13793 344 2048 2048
WriteX 13793 1000 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2048 2048 2048
WriteX 13793 2048 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 1000 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1240 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 344 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 384 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 768 2048 2048
WriteX 13793 1567 1 1
WriteX 13793 1552 2048 2048
WriteX 13793 1560 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 768 2048 2048
WriteX 13793 344 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 1328 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1240 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2200 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1240 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 344 2048 2048
ReadX 13793 384 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 2048 2048 2048
ReadX 13793 768 2048 2048
WriteX 13793 1583 1 1
WriteX 13793 1568 2048 2048
WriteX 13793 1576 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 2048 2048 2048
WriteX 13793 768 2048 2048
WriteX 13793 344 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 864 2048 2048
ReadX 13793 872 2048 2048
ReadX 13793 912 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 2688 2048 2048
ReadX 13793 1000 2048 2048
WriteX 13793 2688 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 2944 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 0 2048 2048
Flush 13793
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 2688 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 2688 2048 2048
WriteX 13793 2688 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 392 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 416 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 416 2048 2048
ReadX 13793 864 2048 2048
ReadX 13793 872 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 312 2048 2048
ReadX 13793 888 2048 2048
ReadX 13793 400 2048 2048
ReadX 13793 896 2048 2048
WriteX 13793 1584 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 400 2048 2048
WriteX 13793 416 2048 2048
WriteX 13793 864 2048 2048
WriteX 13793 872 2048 2048
WriteX 13793 888 2048 2048
WriteX 13793 896 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 584 2048 2048
ReadX 13793 392 2048 2048
WriteX 13793 392 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 1328 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 0 2048 2048
ReadX 13793 408 2048 2048
ReadX 13793 1328 2048 2048
ReadX 13793 864 2048 2048
ReadX 13793 912 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 3840 2048 2048
ReadX 13793 312 2048 2048
ReadX 13793 1584 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 408 2048 2048
WriteX 13793 912 2048 2048
WriteX 13793 1584 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 408 2048 2048
ReadX 13793 392 2048 2048
WriteX 13793 392 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 528 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 528 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 552 2048 2048
ReadX 13793 1336 2048 2048
WriteX 13793 552 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 0 2048 2048
ReadX 13793 552 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 2664 2048 2048
ReadX 13793 2648 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 2672 2048 2048
ReadX 13793 2656 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13793 528 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 1336 2048 2048
ReadX 13793 2680 2048 2048
ReadX 13793 2760 8192 8192
ReadX 13793 544 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 568 2048 2048
ReadX 13793 544 2048 2048
ReadX 13793 0 2048 2048
Flush 13793
ReadX 13793 2816 6144 6144
ReadX 13793 2760 2048 2048
ReadX 13793 2744 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 2752 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 528 2048 2048
ReadX 13793 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13797
Close 13797
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13799
WriteX 13799 4065 1 1
QUERY_FILE_INFORMATION 13799
WriteX 13799 0 62591 62591
Close 13799
ReadX 13793 0 2048 2048
ReadX 13793 2808 2048 2048
ReadX 13793 2792 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 2800 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 384 2048 2048
ReadX 13793 392 2048 2048
ReadX 13793 1384 2048 2048
ReadX 13793 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13801
Close 13801
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13803
WriteX 13803 4094 1 1
QUERY_FILE_INFORMATION 13803
WriteX 13803 0 10845 10845
Close 13803
ReadX 13793 1432 2048 2048
ReadX 13793 1304 2048 2048
ReadX 13793 1368 2048 2048
ReadX 13793 2304 2048 2048
ReadX 13793 1440 2048 2048
ReadX 13793 1424 2048 2048
ReadX 13793 1448 2048 2048
ReadX 13793 1456 2048 2048
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13805
Close 13805
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13807
ReadX 13793 0 2048 2048
WriteX 13807 4081 1 1
QUERY_FILE_INFORMATION 13807
WriteX 13807 0 30118 30118
Close 13807
ReadX 13793 1344 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1152 2048 2048
ReadX 13793 1152 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 1000 2048 2048
ReadX 13793 768 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 344 2048 2048
WriteX 13793 1000 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 1416 2048 2048
ReadX 13793 1416 2048 2048
ReadX 13793 344 2048 2048
ReadX 13793 896 2048 2048
WriteX 13793 1538 2 2
WriteX 13793 344 2048 2048
WriteX 13793 1416 2048 2048
WriteX 13793 1538 2 2
ReadX 13793 2048 2048 2048
WriteX 13793 2048 2048 2048
WriteX 13793 1538 2 2
Close 13793
Close 13795
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13808
ReadX 13808 0 65471 65471
ReadX 13808 65471 63 63
ReadX 13808 65534 65471 65471
ReadX 13808 131005 63 63
ReadX 13808 131068 65471 65471
ReadX 13808 196539 63 63
ReadX 13808 196602 65471 65471
ReadX 13808 262073 63 63
ReadX 13808 262136 65471 65471
ReadX 13808 327607 63 63
ReadX 13808 327670 10 10
Close 13808
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13809
ReadX 13809 0 65471 65471
ReadX 13809 65471 63 63
ReadX 13809 65534 65471 65471
ReadX 13809 131005 63 63
ReadX 13809 131068 65471 65471
ReadX 13809 196539 63 63
ReadX 13809 196602 65471 65471
ReadX 13809 262073 63 63
ReadX 13809 262136 65471 65471
ReadX 13809 327607 63 63
ReadX 13809 327670 65471 65471
ReadX 13809 393141 63 63
ReadX 13809 393204 65471 65471
ReadX 13809 458675 63 63
ReadX 13809 458738 65471 65471
ReadX 13809 524209 63 63
ReadX 13809 524272 65471 65471
ReadX 13809 589743 63 63
ReadX 13809 589806 65471 65471
ReadX 13809 655277 63 63
ReadX 13809 655340 32 32
Close 13809
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13810
ReadX 13810 0 65471 65471
ReadX 13810 65471 63 63
ReadX 13810 65534 65471 65471
ReadX 13810 131005 63 63
ReadX 13810 131068 65471 65471
ReadX 13810 196539 63 63
ReadX 13810 196602 65471 65471
ReadX 13810 262073 63 63
ReadX 13810 262136 65471 65471
ReadX 13810 327607 63 63
ReadX 13810 327670 65471 65471
ReadX 13810 393141 63 63
ReadX 13810 393204 65471 65471
ReadX 13810 458675 63 63
ReadX 13810 458738 65471 65471
ReadX 13810 524209 63 63
ReadX 13810 524272 65471 65471
ReadX 13810 589743 63 63
ReadX 13810 589806 65471 65471
ReadX 13810 655277 63 63
ReadX 13810 655340 65471 65471
ReadX 13810 720811 63 63
ReadX 13810 720874 65471 65471
ReadX 13810 786345 63 63
ReadX 13810 786408 65471 65471
ReadX 13810 851879 63 63
ReadX 13810 851942 65471 65471
ReadX 13810 917413 63 63
ReadX 13810 917476 65471 65471
ReadX 13810 982947 63 63
ReadX 13810 983010 65471 65471
ReadX 13810 1048481 63 63
ReadX 13810 1048544 65471 65471
ReadX 13810 1114015 63 63
ReadX 13810 1114078 65471 65471
ReadX 13810 1179549 63 63
ReadX 13810 1179612 65471 65471
ReadX 13810 1245083 63 63
ReadX 13810 1245146 65471 65471
ReadX 13810 1310617 63 63
ReadX 13810 1310680 65471 65471
ReadX 13810 1376151 63 63
ReadX 13810 1376214 65471 65471
ReadX 13810 1441685 63 63
ReadX 13810 1441748 65471 65471
ReadX 13810 1507219 63 63
ReadX 13810 1507282 65471 65471
ReadX 13810 1572753 63 63
ReadX 13810 1572816 65471 65471
ReadX 13810 1638287 63 63
ReadX 13810 1638350 65471 65471
ReadX 13810 1703821 63 63
ReadX 13810 1703884 65471 65471
ReadX 13810 1769355 63 63
ReadX 13810 1769418 65471 65471
ReadX 13810 1834889 63 63
ReadX 13810 1834952 32824 32824
Close 13810
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13811
Close 13811
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13812
ReadX 13812 0 24 24
Close 13812
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13813
QUERY_FILE_INFORMATION 13813
ReadX 13813 0 512 512
ReadX 13813 464 512 512
ReadX 13813 498 512 512
ReadX 13813 472 512 512
ReadX 13813 466 512 512
ReadX 13813 978 512 512
ReadX 13813 497 57 57
Close 13813
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13814
QUERY_FILE_INFORMATION 13814
ReadX 13814 0 512 512
ReadX 13814 464 512 512
ReadX 13814 498 512 512
ReadX 13814 472 512 512
ReadX 13814 462 512 512
ReadX 13814 468 512 512
ReadX 13814 466 512 512
QUERY_FILE_INFORMATION 13814
WriteX 13814 482 60 60
WriteX 13814 482 4 4
QUERY_FILE_INFORMATION 13814
WriteX 13814 482 11 11
ReadX 13814 497 57 57
ReadX 13814 497 57 57
ReadX 13814 368 4096 4096
ReadX 13814 460 512 512
ReadX 13814 512 4096 4096
ReadX 13814 4608 4096 4096
ReadX 13814 8704 4096 4096
ReadX 13814 12800 4096 4096
ReadX 13814 16896 4096 4096
ReadX 13814 20992 4096 4096
ReadX 13814 25088 4096 4096
ReadX 13814 29184 4096 4096
ReadX 13814 33280 4096 4096
ReadX 13814 37376 4096 4096
ReadX 13814 41472 4096 4096
ReadX 13814 45568 4096 4096
ReadX 13814 49664 4096 4096
ReadX 13814 53760 4096 4096
ReadX 13814 57856 4096 4096
ReadX 13814 61952 4096 4096
ReadX 13814 66048 4096 4096
ReadX 13814 70144 4096 4096
ReadX 13814 497 20 20
ReadX 13814 496 103 103
ReadX 13814 500 448 448
ReadX 13814 470 512 512
ReadX 13814 486 2692 2692
ReadX 13814 290 4096 4096
ReadX 13814 4386 4096 4096
ReadX 13814 8482 4096 4096
ReadX 13814 500 20 20
ReadX 13814 483 108 108
ReadX 13814 482 292 292
ReadX 13814 338 4096 4096
ReadX 13814 4434 3103 3103
ReadX 13814 384 28 28
ReadX 13814 412 20 20
ReadX 13814 432 8 8
ReadX 13814 440 136 136
ReadX 13814 576 8 8
ReadX 13814 584 4 4
ReadX 13814 588 4 4
ReadX 13814 592 39 39
ReadX 13814 384 4 4
ReadX 13814 388 4 4
ReadX 13814 392 23 23
ReadX 13814 385 4 4
ReadX 13814 389 4 4
ReadX 13814 393 12 12
ReadX 13814 405 4 4
ReadX 13814 409 4 4
ReadX 13814 413 1 1
ReadX 13814 385 4 4
ReadX 13814 389 4 4
ReadX 13814 393 1 1
ReadX 13814 385 4 4
ReadX 13814 389 4 4
ReadX 13814 393 12 12
ReadX 13814 405 4 4
ReadX 13814 409 4 4
ReadX 13814 413 2 2
ReadX 13814 385 4 4
ReadX 13814 389 4 4
ReadX 13814 393 25 25
ReadX 13814 385 4 4
ReadX 13814 389 8 8
ReadX 13814 397 4 4
ReadX 13814 401 8 8
ReadX 13814 409 4 4
ReadX 13814 413 8 8
ReadX 13814 421 4 4
ReadX 13814 425 8 8
ReadX 13814 433 4 4
ReadX 13814 437 4 4
ReadX 13814 441 4 4
ReadX 13814 445 4 4
ReadX 13814 449 4 4
ReadX 13814 453 4 4
ReadX 13814 457 4 4
ReadX 13814 461 4 4
ReadX 13814 465 10670 10670
ReadX 13814 428 4096 4096
WriteX 13814 498 512 512
WriteX 13814 472 512 512
WriteX 13814 462 512 512
WriteX 13814 468 512 512
Close 13814
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13815
Close 13815
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13816
QUERY_FILE_INFORMATION 13816
ReadX 13816 0 512 512
ReadX 13816 464 512 512
ReadX 13816 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13817
Close 13817
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13816
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13819
WriteX 13819 4607 1 1
QUERY_FILE_INFORMATION 13819
WriteX 13819 0 65471 65471
WriteX 13819 65471 65 65
WriteX 13819 65536 19979 19979
Close 13819
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13820
QUERY_FILE_INFORMATION 13820
ReadX 13820 0 512 512
ReadX 13820 462 512 512
ReadX 13820 974 512 512
ReadX 13820 1486 512 512
ReadX 13820 460 512 512
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 470 448 448
QUERY_FILE_INFORMATION 13820
WriteX 13820 470 60 60
WriteX 13820 470 4 4
QUERY_FILE_INFORMATION 13820
WriteX 13820 470 11 11
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 464 512 512
WriteX 13820 976 512 512
WriteX 13820 1488 512 512
WriteX 13820 462 512 512
WriteX 13820 0 512 512
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
ReadX 13820 470 512 512
WriteX 13820 482 512 512
WriteX 13820 482 292 292
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 483 20 20
WriteX 13820 483 108 108
QUERY_FILE_INFORMATION 13820
WriteX 13820 484 448 448
QUERY_FILE_INFORMATION 13820
WriteX 13820 484 44 44
WriteX 13820 484 20 20
WriteX 13820 480 512 512
WriteX 13820 472 512 512
WriteX 13820 476 512 512
WriteX 13820 988 512 512
WriteX 13820 474 512 512
Flush 13820
WriteX 13820 0 512 512
Flush 13820
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 480 512 512
WriteX 13820 472 512 512
WriteX 13820 476 512 512
QUERY_FILE_INFORMATION 13820
WriteX 13820 496 320 320
QUERY_FILE_INFORMATION 13820
WriteX 13820 496 60 60
ReadX 13820 484 512 512
WriteX 13820 500 512 512
WriteX 13820 470 512 512
WriteX 13820 486 2692 2692
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 497 25 25
WriteX 13820 496 103 103
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 497 44 44
WriteX 13820 497 20 20
WriteX 13820 498 512 512
WriteX 13820 462 512 512
WriteX 13820 466 512 512
WriteX 13820 978 512 512
WriteX 13820 464 512 512
Flush 13820
WriteX 13820 0 512 512
Flush 13820
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 497 7 7
WriteX 13820 497 57 57
WriteX 13820 498 512 512
WriteX 13820 472 512 512
WriteX 13820 462 512 512
WriteX 13820 466 512 512
WriteX 13820 978 512 512
Flush 13820
WriteX 13820 498 512 512
Flush 13820
Close 13820
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13821
QUERY_FILE_INFORMATION 13821
ReadX 13821 0 512 512
ReadX 13821 464 512 512
ReadX 13821 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13822
ReadX 13822 0 20 20
ReadX 13822 14 40 40
ReadX 13822 54 64 64
ReadX 13822 118 1152 1152
Close 13822
Close 13821
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13823
Close 13823
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13824
ReadX 13824 0 24 24
Close 13824
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13825
QUERY_FILE_INFORMATION 13825
ReadX 13825 0 512 512
ReadX 13825 464 512 512
ReadX 13825 498 512 512
ReadX 13825 472 512 512
ReadX 13825 462 512 512
ReadX 13825 466 512 512
ReadX 13825 978 512 512
ReadX 13825 497 57 57
Close 13825
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13826
QUERY_FILE_INFORMATION 13826
ReadX 13826 0 512 512
ReadX 13826 464 512 512
ReadX 13826 498 512 512
ReadX 13826 472 512 512
ReadX 13826 468 512 512
ReadX 13826 462 512 512
ReadX 13826 466 512 512
QUERY_FILE_INFORMATION 13826
WriteX 13826 482 60 60
WriteX 13826 482 4 4
QUERY_FILE_INFORMATION 13826
WriteX 13826 482 11 11
WriteX 13826 498 512 512
WriteX 13826 472 512 512
WriteX 13826 462 512 512
WriteX 13826 466 512 512
WriteX 13826 978 512 512
Close 13826
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13827
Close 13827
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13828
Close 13828
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13830
WriteX 13830 4607 1 1
QUERY_FILE_INFORMATION 13830
WriteX 13830 0 65471 65471
WriteX 13830 65471 65 65
WriteX 13830 65536 17654 17654
Close 13830
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13831
QUERY_FILE_INFORMATION 13831
ReadX 13831 0 512 512
ReadX 13831 474 512 512
ReadX 13831 986 512 512
ReadX 13831 1498 512 512
ReadX 13831 472 512 512
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
WriteX 13831 482 448 448
QUERY_FILE_INFORMATION 13831
WriteX 13831 482 60 60
WriteX 13831 482 4 4
QUERY_FILE_INFORMATION 13831
WriteX 13831 482 11 11
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
WriteX 13831 476 512 512
WriteX 13831 988 512 512
WriteX 13831 1500 512 512
WriteX 13831 474 512 512
WriteX 13831 0 512 512
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
ReadX 13831 482 512 512
WriteX 13831 494 512 512
WriteX 13831 494 292 292
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
WriteX 13831 495 20 20
WriteX 13831 495 108 108
QUERY_FILE_INFORMATION 13831
WriteX 13831 496 448 448
QUERY_FILE_INFORMATION 13831
WriteX 13831 496 44 44
WriteX 13831 496 20 20
WriteX 13831 492 512 512
WriteX 13831 484 512 512
WriteX 13831 488 512 512
WriteX 13831 1000 512 512
WriteX 13831 486 512 512
Flush 13831
WriteX 13831 0 512 512
Flush 13831
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
WriteX 13831 492 512 512
WriteX 13831 484 512 512
WriteX 13831 488 512 512
QUERY_FILE_INFORMATION 13831
WriteX 13831 508 320 320
QUERY_FILE_INFORMATION 13831
WriteX 13831 508 60 60
ReadX 13831 496 512 512
WriteX 13831 512 512 512
WriteX 13831 482 512 512
WriteX 13831 498 2692 2692
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
WriteX 13831 509 25 25
WriteX 13831 508 103 103
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
WriteX 13831 509 44 44
WriteX 13831 509 20 20
WriteX 13831 510 512 512
WriteX 13831 474 512 512
WriteX 13831 478 512 512
WriteX 13831 990 512 512
WriteX 13831 476 512 512
Flush 13831
WriteX 13831 0 512 512
Flush 13831
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
QUERY_FILE_INFORMATION 13831
WriteX 13831 509 7 7
WriteX 13831 509 57 57
WriteX 13831 510 512 512
WriteX 13831 484 512 512
WriteX 13831 474 512 512
WriteX 13831 478 512 512
WriteX 13831 990 512 512
Flush 13831
WriteX 13831 510 512 512
Flush 13831
Close 13831
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13832
Close 13832
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13833
QUERY_FILE_INFORMATION 13833
ReadX 13833 0 512 512
ReadX 13833 476 512 512
ReadX 13833 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13834
Close 13834
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13835
QUERY_FILE_INFORMATION 13835
ReadX 13835 0 512 512
ReadX 13835 512 512 512
ReadX 13835 770 512 512
ReadX 13835 1282 512 512
ReadX 13835 1794 512 512
ReadX 13835 2562 512 512
ReadX 13835 3586 512 512
ReadX 13835 3828 512 512
ReadX 13835 288 512 512
ReadX 13835 1024 512 512
ReadX 13835 954 512 512
ReadX 13835 295 512 512
ReadX 13835 320 512 512
ReadX 13835 322 512 512
ReadX 13835 834 512 512
ReadX 13835 1346 512 512
ReadX 13835 1858 512 512
ReadX 13835 323 512 512
ReadX 13835 835 512 512
ReadX 13835 1347 512 512
ReadX 13835 1859 512 512
ReadX 13835 2371 345 345
ReadX 13835 322 167 167
ReadX 13835 489 512 512
ReadX 13835 1001 512 512
ReadX 13835 1513 512 512
ReadX 13835 2025 512 512
ReadX 13835 2537 512 512
ReadX 13835 3049 512 512
ReadX 13835 3561 345 345
ReadX 13835 323 167 167
ReadX 13835 490 512 512
ReadX 13835 1002 512 512
ReadX 13835 1514 512 512
ReadX 13835 2026 512 512
ReadX 13835 2538 512 512
ReadX 13835 3050 512 512
ReadX 13835 3562 512 512
ReadX 13835 4074 512 512
ReadX 13835 4586 512 512
ReadX 13835 5098 512 512
ReadX 13835 5610 512 512
ReadX 13835 6122 512 512
ReadX 13835 6634 512 512
ReadX 13835 7146 512 512
ReadX 13835 7658 512 512
ReadX 13835 8170 512 512
ReadX 13835 8682 512 512
ReadX 13835 9194 512 512
ReadX 13835 9706 512 512
ReadX 13835 10218 512 512
ReadX 13835 10730 345 345
ReadX 13835 11075 512 512
ReadX 13835 11587 167 167
ReadX 13835 11754 512 512
ReadX 13835 12266 512 512
ReadX 13835 12778 512 512
ReadX 13835 13290 512 512
ReadX 13835 13802 512 512
ReadX 13835 14314 512 512
ReadX 13835 14826 512 512
ReadX 13835 15338 512 512
ReadX 13835 337 512 512
ReadX 13835 337 512 512
ReadX 13835 849 34 34
ReadX 13835 352 512 512
ReadX 13835 864 512 512
ReadX 13835 1376 512 512
ReadX 13835 1888 512 512
ReadX 13835 2400 512 512
ReadX 13835 2912 512 512
ReadX 13835 3424 512 512
ReadX 13835 3936 512 512
ReadX 13835 1632 512 512
ReadX 13835 2144 512 512
ReadX 13835 1682 512 512
ReadX 13835 258 512 512
ReadX 13835 360 144 144
ReadX 13835 2517 512 512
ReadX 13835 3029 512 512
ReadX 13835 1751 512 512
ReadX 13835 2263 512 512
ReadX 13835 2775 512 512
ReadX 13835 3287 512 512
ReadX 13835 3799 512 512
ReadX 13835 4311 512 512
ReadX 13835 4823 512 512
ReadX 13835 5335 512 512
ReadX 13835 5847 512 512
ReadX 13835 6359 512 512
ReadX 13835 6871 512 512
ReadX 13835 7383 512 512
ReadX 13835 7895 512 512
ReadX 13835 8407 512 512
ReadX 13835 8919 512 512
ReadX 13835 9431 512 512
ReadX 13835 9943 512 512
ReadX 13835 10455 512 512
ReadX 13835 10967 512 512
ReadX 13835 11479 512 512
ReadX 13835 2556 512 512
ReadX 13835 3068 512 512
ReadX 13835 3580 512 512
ReadX 13835 4092 512 512
ReadX 13835 4604 512 512
ReadX 13835 5116 512 512
ReadX 13835 5628 512 512
ReadX 13835 6140 512 512
ReadX 13835 6652 512 512
ReadX 13835 7164 512 512
ReadX 13835 7676 512 512
ReadX 13835 8188 512 512
ReadX 13835 8700 512 512
ReadX 13835 9212 512 512
ReadX 13835 9724 512 512
ReadX 13835 10236 512 512
ReadX 13835 10748 512 512
ReadX 13835 11260 512 512
ReadX 13835 11772 512 512
ReadX 13835 12284 512 512
ReadX 13835 12796 49 49
ReadX 13835 260 463 463
ReadX 13835 723 512 512
ReadX 13835 1235 512 512
ReadX 13835 1747 512 512
ReadX 13835 2259 512 512
ReadX 13835 2771 512 512
ReadX 13835 3283 512 512
ReadX 13835 3795 512 512
ReadX 13835 4307 512 512
ReadX 13835 4819 512 512
ReadX 13835 5331 512 512
ReadX 13835 5843 512 512
ReadX 13835 6355 512 512
ReadX 13835 6867 512 512
ReadX 13835 7379 512 512
ReadX 13835 7891 512 512
ReadX 13835 8403 512 512
ReadX 13835 8915 512 512
ReadX 13835 9427 512 512
ReadX 13835 9939 512 512
ReadX 13835 10451 512 512
ReadX 13835 10963 402 402
ReadX 13835 593 240 240
ReadX 13835 2048 272 272
ReadX 13835 2320 512 512
ReadX 13835 2832 512 512
ReadX 13835 3344 512 512
ReadX 13835 3856 512 512
ReadX 13835 4368 512 512
ReadX 13835 4880 512 512
ReadX 13835 5392 240 240
ReadX 13835 608 272 272
ReadX 13835 880 512 512
ReadX 13835 1392 512 512
ReadX 13835 1904 512 512
ReadX 13835 2416 512 512
ReadX 13835 2928 512 512
ReadX 13835 3440 512 512
ReadX 13835 3952 512 512
ReadX 13835 4464 512 512
ReadX 13835 4976 512 512
ReadX 13835 5488 512 512
ReadX 13835 6000 512 512
ReadX 13835 6512 512 512
ReadX 13835 7024 512 512
ReadX 13835 7536 512 512
ReadX 13835 8048 512 512
ReadX 13835 8560 512 512
ReadX 13835 9072 512 512
ReadX 13835 9584 512 512
ReadX 13835 10096 512 512
ReadX 13835 1683 512 512
ReadX 13835 514 512 512
ReadX 13835 620 512 512
ReadX 13835 770 512 512
ReadX 13835 1282 512 512
ReadX 13835 1794 512 512
ReadX 13835 2000 512 512
ReadX 13835 1434 512 512
ReadX 13835 2050 512 512
ReadX 13835 2118 512 512
ReadX 13835 1715 512 512
ReadX 13835 1024 512 512
ReadX 13835 954 512 512
ReadX 13835 1880 512 512
ReadX 13835 1286 512 512
ReadX 13835 1510 512 512
ReadX 13835 2562 512 512
ReadX 13835 2610 512 512
ReadX 13835 3586 512 512
ReadX 13835 3812 512 512
ReadX 13835 3828 512 512
ReadX 13835 4046 512 512
ReadX 13835 4066 512 512
ReadX 13835 1747 512 512
ReadX 13835 1026 512 512
ReadX 13835 1538 512 512
ReadX 13835 514 512 512
ReadX 13835 751 512 512
ReadX 13835 1263 512 512
ReadX 13835 620 512 512
ReadX 13835 1132 512 512
ReadX 13835 1644 512 512
ReadX 13835 2156 512 512
ReadX 13835 2668 512 512
ReadX 13835 3180 512 512
ReadX 13835 3692 512 512
ReadX 13835 4204 394 394
ReadX 13835 606 118 118
ReadX 13835 724 512 512
ReadX 13835 1236 512 512
ReadX 13835 1748 512 512
ReadX 13835 2260 512 512
ReadX 13835 2772 512 512
ReadX 13835 3284 512 512
ReadX 13835 3796 394 394
ReadX 13835 636 118 118
ReadX 13835 754 512 512
ReadX 13835 1266 512 512
ReadX 13835 1778 512 512
ReadX 13835 2290 512 512
ReadX 13835 2802 512 512
ReadX 13835 3314 512 512
ReadX 13835 3826 512 512
ReadX 13835 4338 512 512
ReadX 13835 4850 512 512
ReadX 13835 5362 512 512
ReadX 13835 5874 512 512
ReadX 13835 6386 512 512
ReadX 13835 6898 512 512
ReadX 13835 7410 512 512
ReadX 13835 7922 512 512
ReadX 13835 8434 512 512
ReadX 13835 8946 512 512
ReadX 13835 9458 512 512
ReadX 13835 9970 512 512
ReadX 13835 10482 512 512
ReadX 13835 723 512 512
ReadX 13835 1235 512 512
ReadX 13835 725 512 512
ReadX 13835 729 512 512
ReadX 13835 1241 512 512
ReadX 13835 1753 512 512
ReadX 13835 2265 512 512
ReadX 13835 2777 512 512
ReadX 13835 3289 512 512
ReadX 13835 3801 512 512
ReadX 13835 4313 512 512
ReadX 13835 4825 512 512
ReadX 13835 5337 512 512
ReadX 13835 5849 512 512
ReadX 13835 6361 512 512
ReadX 13835 755 512 512
ReadX 13835 1267 512 512
ReadX 13835 1779 512 512
ReadX 13835 2291 512 512
ReadX 13835 2803 512 512
ReadX 13835 3315 512 512
ReadX 13835 3827 512 512
ReadX 13835 4339 244 244
ReadX 13835 4583 512 512
ReadX 13835 5095 268 268
ReadX 13835 5363 512 512
ReadX 13835 5875 512 512
ReadX 13835 6387 512 512
ReadX 13835 6899 512 512
ReadX 13835 7411 512 512
ReadX 13835 7923 512 512
ReadX 13835 8435 512 512
ReadX 13835 8947 512 512
ReadX 13835 9459 512 512
ReadX 13835 9971 512 512
ReadX 13835 10483 512 512
ReadX 13835 10995 512 512
ReadX 13835 11507 512 512
ReadX 13835 12019 512 512
ReadX 13835 12531 512 512
ReadX 13835 13043 512 512
ReadX 13835 13555 512 512
ReadX 13835 14067 512 512
ReadX 13835 14579 512 512
ReadX 13835 15091 512 512
ReadX 13835 15603 342 342
ReadX 13835 725 512 512
ReadX 13835 2000 512 512
ReadX 13835 3918 512 512
ReadX 13835 727 512 512
ReadX 13835 258 512 512
ReadX 13835 376 512 512
ReadX 13835 1109 512 512
ReadX 13835 1028 512 512
ReadX 13835 1540 512 512
ReadX 13835 2052 512 512
ReadX 13835 2564 512 512
ReadX 13835 3076 512 512
ReadX 13835 3588 512 512
ReadX 13835 4100 512 512
ReadX 13835 4612 412 412
ReadX 13835 1012 100 100
ReadX 13835 1112 512 512
ReadX 13835 1624 512 512
ReadX 13835 2136 512 512
ReadX 13835 2648 512 512
ReadX 13835 3160 512 512
ReadX 13835 3672 512 512
ReadX 13835 4184 412 412
ReadX 13835 1044 100 100
ReadX 13835 1144 512 512
ReadX 13835 1656 512 512
ReadX 13835 2168 512 512
ReadX 13835 2680 512 512
ReadX 13835 3192 512 512
ReadX 13835 3704 512 512
ReadX 13835 4216 512 512
ReadX 13835 4728 512 512
ReadX 13835 5240 512 512
ReadX 13835 5752 512 512
ReadX 13835 6264 512 512
ReadX 13835 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 13835 7288 512 512
ReadX 13835 7800 512 512
ReadX 13835 8312 512 512
ReadX 13835 8824 512 512
ReadX 13835 9336 512 512
ReadX 13835 9848 512 512
ReadX 13835 10360 512 512
ReadX 13835 10872 512 512
ReadX 13835 11384 512 512
ReadX 13835 11896 512 512
ReadX 13835 12408 512 512
ReadX 13835 1088 512 512
ReadX 13835 1600 512 512
ReadX 13835 1090 512 512
ReadX 13835 1094 512 512
ReadX 13835 1606 512 512
ReadX 13835 2118 512 512
ReadX 13835 2630 512 512
ReadX 13835 3142 512 512
ReadX 13835 3654 512 512
ReadX 13835 4166 512 512
ReadX 13835 4678 512 512
ReadX 13835 1111 512 512
ReadX 13835 1623 512 512
ReadX 13835 2135 512 512
ReadX 13835 2647 512 512
ReadX 13835 3159 512 512
ReadX 13835 3671 512 512
ReadX 13835 4183 512 512
ReadX 13835 4695 512 512
ReadX 13835 5207 512 512
ReadX 13835 5719 512 512
ReadX 13835 6231 512 512
ReadX 13835 6743 512 512
ReadX 13835 7255 512 512
ReadX 13835 7767 512 512
ReadX 13835 8279 512 512
ReadX 13835 8791 512 512
ReadX 13835 9303 512 512
ReadX 13835 9815 512 512
ReadX 13835 10327 512 512
ReadX 13835 10839 512 512
ReadX 13835 11351 294 294
ReadX 13835 1091 512 512
ReadX 13835 970 512 512
ReadX 13835 1093 512 512
ReadX 13835 1434 512 512
ReadX 13835 2050 512 512
ReadX 13835 2158 512 512
ReadX 13835 2118 512 512
ReadX 13835 2630 512 512
ReadX 13835 3142 512 512
ReadX 13835 3654 512 512
ReadX 13835 4166 512 512
ReadX 13835 4678 512 512
ReadX 13835 5190 512 512
ReadX 13835 5702 382 382
ReadX 13835 2104 130 130
ReadX 13835 2234 512 512
ReadX 13835 2746 512 512
ReadX 13835 3258 512 512
ReadX 13835 3770 512 512
ReadX 13835 4282 512 512
ReadX 13835 4794 512 512
ReadX 13835 5306 382 382
ReadX 13835 2134 130 130
ReadX 13835 2264 512 512
ReadX 13835 2776 512 512
ReadX 13835 3288 512 512
ReadX 13835 3800 512 512
ReadX 13835 4312 512 512
ReadX 13835 4824 512 512
ReadX 13835 5336 512 512
ReadX 13835 2147 512 512
ReadX 13835 2149 512 512
ReadX 13835 2152 512 512
ReadX 13835 2664 512 512
ReadX 13835 3176 512 512
ReadX 13835 3688 512 512
ReadX 13835 2159 512 512
ReadX 13835 2671 512 512
ReadX 13835 3183 512 512
ReadX 13835 3695 512 512
ReadX 13835 4207 512 512
ReadX 13835 4719 512 512
ReadX 13835 5231 512 512
ReadX 13835 5743 512 512
ReadX 13835 6255 512 512
ReadX 13835 6767 512 512
ReadX 13835 7279 512 512
ReadX 13835 7791 512 512
ReadX 13835 8303 512 512
ReadX 13835 8815 512 512
ReadX 13835 9327 512 512
ReadX 13835 9839 512 512
ReadX 13835 10351 512 512
ReadX 13835 10863 512 512
ReadX 13835 11375 512 512
ReadX 13835 11887 512 512
ReadX 13835 12399 38 38
ReadX 13835 2149 512 512
ReadX 13835 1794 512 512
ReadX 13835 2016 512 512
ReadX 13835 2151 512 512
ReadX 13835 1918 512 512
ReadX 13835 1880 512 512
ReadX 13835 2392 512 512
ReadX 13835 2904 512 512
ReadX 13835 3416 512 512
ReadX 13835 3928 512 512
ReadX 13835 4440 512 512
ReadX 13835 4952 512 512
ReadX 13835 5464 416 416
ReadX 13835 1866 96 96
ReadX 13835 1962 512 512
ReadX 13835 2474 512 512
ReadX 13835 2986 512 512
ReadX 13835 3498 512 512
ReadX 13835 4010 512 512
ReadX 13835 4522 512 512
ReadX 13835 5034 416 416
ReadX 13835 1896 96 96
ReadX 13835 1992 512 512
ReadX 13835 2504 512 512
ReadX 13835 3016 512 512
ReadX 13835 3528 512 512
ReadX 13835 1903 512 512
ReadX 13835 1905 512 512
ReadX 13835 1908 512 512
ReadX 13835 2420 512 512
ReadX 13835 2932 512 512
ReadX 13835 3444 512 512
ReadX 13835 3956 512 512
ReadX 13835 1919 512 512
ReadX 13835 2431 512 512
ReadX 13835 2943 512 512
ReadX 13835 3455 512 512
ReadX 13835 3967 512 512
ReadX 13835 4479 512 512
ReadX 13835 4991 512 512
ReadX 13835 5503 512 512
ReadX 13835 6015 512 512
ReadX 13835 6527 512 512
ReadX 13835 7039 512 512
ReadX 13835 7551 512 512
ReadX 13835 8063 512 512
ReadX 13835 8575 512 512
ReadX 13835 9087 512 512
ReadX 13835 9599 512 512
ReadX 13835 10111 512 512
ReadX 13835 10623 512 512
ReadX 13835 11135 512 512
ReadX 13835 11647 512 512
ReadX 13835 12159 322 322
ReadX 13835 1905 512 512
ReadX 13835 1846 512 512
ReadX 13835 1907 512 512
ReadX 13835 1860 268 268
ReadX 13835 1832 244 244
ReadX 13835 1846 512 512
ReadX 13835 2358 512 512
ReadX 13835 2870 512 512
ReadX 13835 3382 512 512
ReadX 13835 3894 512 512
ReadX 13835 4406 512 512
ReadX 13835 4918 512 512
ReadX 13835 1858 512 512
ReadX 13835 1859 512 512
ReadX 13835 1860 488 488
ReadX 13835 1832 24 24
ReadX 13835 1861 228 228
ReadX 13835 1832 284 284
ReadX 13835 2116 512 512
ReadX 13835 2628 512 512
ReadX 13835 3140 512 512
ReadX 13835 3652 512 512
ReadX 13835 4164 512 512
ReadX 13835 4676 512 512
ReadX 13835 5188 228 228
ReadX 13835 1862 284 284
ReadX 13835 2146 512 512
ReadX 13835 2658 38 38
ReadX 13835 1859 512 512
ReadX 13835 2047 512 512
ReadX 13835 2016 512 512
ReadX 13835 2528 512 512
ReadX 13835 3040 512 512
ReadX 13835 3552 512 512
ReadX 13835 4064 512 512
ReadX 13835 4576 512 512
ReadX 13835 5088 512 512
ReadX 13835 5600 424 424
ReadX 13835 2002 88 88
ReadX 13835 2090 512 512
ReadX 13835 2602 512 512
ReadX 13835 3114 512 512
ReadX 13835 3626 512 512
ReadX 13835 4138 512 512
ReadX 13835 4650 512 512
ReadX 13835 5162 424 424
ReadX 13835 2032 88 88
ReadX 13835 2120 512 512
ReadX 13835 2632 512 512
ReadX 13835 3144 512 512
ReadX 13835 3656 512 512
ReadX 13835 4168 512 512
ReadX 13835 4680 512 512
ReadX 13835 5192 512 512
ReadX 13835 2044 512 512
ReadX 13835 2045 512 512
ReadX 13835 2046 512 512
ReadX 13835 2047 512 512
ReadX 13835 2559 110 110
ReadX 13835 2052 402 402
ReadX 13835 2454 512 512
ReadX 13835 2966 512 512
ReadX 13835 3478 512 512
ReadX 13835 3990 512 512
ReadX 13835 4502 512 512
ReadX 13835 5014 512 512
ReadX 13835 5526 512 512
ReadX 13835 6038 512 512
ReadX 13835 6550 512 512
ReadX 13835 7062 512 512
ReadX 13835 7574 512 512
ReadX 13835 8086 512 512
ReadX 13835 8598 512 512
ReadX 13835 9110 512 512
ReadX 13835 9622 512 512
ReadX 13835 10134 512 512
ReadX 13835 10646 512 512
ReadX 13835 11158 512 512
ReadX 13835 11670 512 512
ReadX 13835 12182 512 512
ReadX 13835 12694 118 118
ReadX 13835 2045 512 512
ReadX 13835 1282 512 512
ReadX 13835 1343 512 512
ReadX 13835 1286 512 512
ReadX 13835 1798 512 512
ReadX 13835 2310 512 512
ReadX 13835 2822 512 512
ReadX 13835 3334 512 512
ReadX 13835 3846 512 512
ReadX 13835 4358 512 512
ReadX 13835 4870 416 416
ReadX 13835 1270 96 96
ReadX 13835 1366 512 512
ReadX 13835 1878 512 512
ReadX 13835 2390 512 512
ReadX 13835 2902 512 512
ReadX 13835 3414 512 512
ReadX 13835 3926 416 416
ReadX 13835 1284 96 96
ReadX 13835 1380 416 416
ReadX 13835 1302 96 96
ReadX 13835 1398 512 512
ReadX 13835 1910 512 512
ReadX 13835 2422 512 512
ReadX 13835 2934 512 512
ReadX 13835 3446 512 512
ReadX 13835 3958 512 512
ReadX 13835 4470 512 512
ReadX 13835 4982 512 512
ReadX 13835 5494 512 512
ReadX 13835 6006 512 512
ReadX 13835 6518 512 512
ReadX 13835 7030 512 512
ReadX 13835 7542 512 512
ReadX 13835 1328 512 512
ReadX 13835 1330 512 512
ReadX 13835 1333 512 512
ReadX 13835 1845 512 512
ReadX 13835 2357 512 512
ReadX 13835 2869 512 512
ReadX 13835 3381 512 512
ReadX 13835 1344 512 512
ReadX 13835 1856 512 512
ReadX 13835 2368 512 512
ReadX 13835 2880 512 512
ReadX 13835 3392 512 512
ReadX 13835 3904 512 512
ReadX 13835 4416 512 512
ReadX 13835 4928 512 512
ReadX 13835 5440 512 512
ReadX 13835 5952 512 512
ReadX 13835 6464 512 512
ReadX 13835 6976 512 512
ReadX 13835 7488 512 512
ReadX 13835 8000 512 512
ReadX 13835 8512 512 512
ReadX 13835 9024 512 512
ReadX 13835 9536 512 512
ReadX 13835 10048 512 512
ReadX 13835 10560 512 512
ReadX 13835 11072 512 512
ReadX 13835 11584 426 426
ReadX 13835 1330 512 512
ReadX 13835 1842 512 512
ReadX 13835 1250 512 512
ReadX 13835 1264 268 268
ReadX 13835 1236 244 244
ReadX 13835 1250 512 512
ReadX 13835 1762 512 512
ReadX 13835 2274 512 512
ReadX 13835 2786 512 512
ReadX 13835 3298 512 512
ReadX 13835 3810 512 512
ReadX 13835 4322 512 512
ReadX 13835 1262 512 512
ReadX 13835 1263 512 512
ReadX 13835 1264 488 488
ReadX 13835 1236 24 24
ReadX 13835 1265 228 228
ReadX 13835 1236 284 284
ReadX 13835 1520 512 512
ReadX 13835 2032 512 512
ReadX 13835 2544 512 512
ReadX 13835 3056 512 512
ReadX 13835 3568 512 512
ReadX 13835 4080 512 512
ReadX 13835 4592 228 228
ReadX 13835 1266 284 284
ReadX 13835 1550 512 512
ReadX 13835 2062 42 42
ReadX 13835 1263 512 512
ReadX 13835 1538 512 512
ReadX 13835 1640 512 512
ReadX 13835 1510 512 512
ReadX 13835 2022 512 512
ReadX 13835 2534 512 512
ReadX 13835 3046 512 512
ReadX 13835 3558 512 512
ReadX 13835 4070 512 512
ReadX 13835 4582 512 512
ReadX 13835 5094 408 408
ReadX 13835 1496 104 104
ReadX 13835 1600 512 512
ReadX 13835 2112 512 512
ReadX 13835 2624 512 512
ReadX 13835 3136 512 512
ReadX 13835 3648 512 512
ReadX 13835 4160 512 512
ReadX 13835 4672 408 408
ReadX 13835 1526 104 104
ReadX 13835 1630 512 512
ReadX 13835 2142 512 512
ReadX 13835 2654 512 512
ReadX 13835 3166 512 512
ReadX 13835 3678 512 512
ReadX 13835 4190 408 408
ReadX 13835 1540 104 104
ReadX 13835 1644 512 512
ReadX 13835 2156 512 512
ReadX 13835 2668 512 512
ReadX 13835 3180 512 512
ReadX 13835 3692 512 512
ReadX 13835 4204 512 512
ReadX 13835 4716 512 512
ReadX 13835 5228 512 512
ReadX 13835 5740 512 512
ReadX 13835 6252 512 512
ReadX 13835 6764 512 512
ReadX 13835 7276 512 512
ReadX 13835 7788 512 512
ReadX 13835 8300 512 512
ReadX 13835 8812 512 512
ReadX 13835 9324 512 512
ReadX 13835 9836 512 512
ReadX 13835 10348 512 512
ReadX 13835 10860 512 512
ReadX 13835 11372 512 512
ReadX 13835 1615 512 512
ReadX 13835 2127 512 512
ReadX 13835 1617 512 512
ReadX 13835 1621 512 512
ReadX 13835 2133 512 512
ReadX 13835 2645 512 512
ReadX 13835 3157 512 512
ReadX 13835 3669 512 512
ReadX 13835 4181 512 512
ReadX 13835 4693 512 512
ReadX 13835 5205 512 512
ReadX 13835 5717 512 512
ReadX 13835 6229 512 512
ReadX 13835 1641 512 512
ReadX 13835 2153 512 512
ReadX 13835 2665 512 512
ReadX 13835 3177 512 512
ReadX 13835 3689 512 512
ReadX 13835 4201 512 512
ReadX 13835 4713 512 512
ReadX 13835 5225 512 512
ReadX 13835 5737 512 512
ReadX 13835 6249 512 512
ReadX 13835 6761 512 512
ReadX 13835 7273 512 512
ReadX 13835 7785 512 512
ReadX 13835 8297 512 512
ReadX 13835 8809 512 512
ReadX 13835 9321 512 512
ReadX 13835 9833 512 512
ReadX 13835 10345 512 512
ReadX 13835 10857 512 512
ReadX 13835 11369 512 512
ReadX 13835 11881 2 2
ReadX 13835 1796 510 510
ReadX 13835 2306 512 512
ReadX 13835 2818 512 512
ReadX 13835 3330 512 512
ReadX 13835 3842 512 512
ReadX 13835 4354 512 512
ReadX 13835 4866 512 512
ReadX 13835 5378 512 512
ReadX 13835 5890 512 512
ReadX 13835 6402 512 512
ReadX 13835 6914 512 512
ReadX 13835 7426 512 512
ReadX 13835 7938 512 512
ReadX 13835 8450 512 512
ReadX 13835 8962 512 512
ReadX 13835 9474 512 512
ReadX 13835 9986 512 512
ReadX 13835 10498 326 326
ReadX 13835 1617 512 512
ReadX 13835 2129 512 512
ReadX 13835 1450 512 512
ReadX 13835 1621 512 512
ReadX 13835 1446 512 512
ReadX 13835 1450 512 512
ReadX 13835 1962 512 512
ReadX 13835 2474 512 512
ReadX 13835 2986 512 512
ReadX 13835 3498 512 512
ReadX 13835 4010 512 512
ReadX 13835 4522 512 512
ReadX 13835 5034 424 424
ReadX 13835 1436 88 88
ReadX 13835 1524 512 512
ReadX 13835 2036 512 512
ReadX 13835 2548 512 512
ReadX 13835 3060 512 512
ReadX 13835 1442 512 512
ReadX 13835 1443 512 512
ReadX 13835 1444 512 512
ReadX 13835 1446 512 512
ReadX 13835 1958 386 386
ReadX 13835 1466 126 126
ReadX 13835 1592 512 512
ReadX 13835 2104 512 512
ReadX 13835 2616 512 512
ReadX 13835 3128 512 512
ReadX 13835 3640 512 512
ReadX 13835 4152 512 512
ReadX 13835 4664 512 512
ReadX 13835 5176 512 512
ReadX 13835 5688 512 512
ReadX 13835 6200 512 512
ReadX 13835 6712 512 512
ReadX 13835 7224 512 512
ReadX 13835 7736 512 512
ReadX 13835 8248 512 512
ReadX 13835 8760 294 294
ReadX 13835 1443 512 512
ReadX 13835 964 512 512
ReadX 13835 970 512 512
ReadX 13835 1482 512 512
ReadX 13835 1994 512 512
ReadX 13835 2506 512 512
ReadX 13835 3018 512 512
ReadX 13835 3530 512 512
ReadX 13835 4042 512 512
ReadX 13835 4554 424 424
ReadX 13835 956 88 88
ReadX 13835 1044 512 512
ReadX 13835 1556 512 512
ReadX 13835 2068 512 512
ReadX 13835 2580 512 512
ReadX 13835 962 512 512
ReadX 13835 963 512 512
ReadX 13835 964 512 512
ReadX 13835 965 512 512
ReadX 13835 1477 512 512
ReadX 13835 1989 228 228
ReadX 13835 986 284 284
ReadX 13835 1270 512 512
ReadX 13835 1782 512 512
ReadX 13835 2294 512 512
ReadX 13835 2806 512 512
ReadX 13835 3318 512 512
ReadX 13835 3830 512 512
ReadX 13835 4342 512 512
ReadX 13835 4854 512 512
ReadX 13835 5366 512 512
ReadX 13835 5878 512 512
ReadX 13835 6390 512 512
ReadX 13835 6902 512 512
ReadX 13835 7414 42 42
ReadX 13835 963 512 512
ReadX 13835 2610 512 512
ReadX 13835 3812 512 512
ReadX 13835 3828 512 512
ReadX 13835 3969 512 512
ReadX 13835 3918 512 512
ReadX 13835 4430 512 512
ReadX 13835 4942 512 512
ReadX 13835 5454 512 512
ReadX 13835 5966 512 512
ReadX 13835 6478 512 512
ReadX 13835 6990 512 512
ReadX 13835 7502 424 424
ReadX 13835 3904 88 88
ReadX 13835 3992 512 512
ReadX 13835 4504 512 512
ReadX 13835 5016 512 512
ReadX 13835 5528 512 512
ReadX 13835 6040 512 512
ReadX 13835 6552 512 512
ReadX 13835 7064 424 424
ReadX 13835 3934 88 88
ReadX 13835 4022 512 512
ReadX 13835 4534 512 512
ReadX 13835 5046 512 512
ReadX 13835 5558 512 512
ReadX 13835 6070 512 512
ReadX 13835 6582 512 512
ReadX 13835 7094 512 512
ReadX 13835 7606 512 512
ReadX 13835 8118 512 512
ReadX 13835 8630 512 512
ReadX 13835 3953 512 512
ReadX 13835 4465 512 512
ReadX 13835 3956 512 512
ReadX 13835 3964 512 512
ReadX 13835 4476 512 512
ReadX 13835 4988 512 512
ReadX 13835 3970 512 512
ReadX 13835 4482 512 512
ReadX 13835 4994 512 512
ReadX 13835 5506 512 512
ReadX 13835 6018 512 512
ReadX 13835 6530 512 512
ReadX 13835 7042 512 512
ReadX 13835 7554 512 512
ReadX 13835 8066 512 512
ReadX 13835 8578 512 512
ReadX 13835 9090 512 512
ReadX 13835 9602 512 512
ReadX 13835 10114 512 512
ReadX 13835 10626 512 512
ReadX 13835 11138 512 512
ReadX 13835 11650 512 512
ReadX 13835 12162 512 512
ReadX 13835 12674 512 512
ReadX 13835 13186 512 512
ReadX 13835 13698 512 512
ReadX 13835 14210 134 134
ReadX 13835 3956 512 512
ReadX 13835 4468 512 512
ReadX 13835 4980 512 512
ReadX 13835 5492 512 512
ReadX 13835 3074 512 512
ReadX 13835 3246 512 512
ReadX 13835 3964 512 512
ReadX 13835 3330 512 512
ReadX 13835 3465 512 512
ReadX 13835 3246 512 512
ReadX 13835 3758 512 512
ReadX 13835 4270 512 512
ReadX 13835 4782 512 512
ReadX 13835 5294 512 512
ReadX 13835 5806 512 512
ReadX 13835 6318 512 512
ReadX 13835 6830 368 368
ReadX 13835 3232 144 144
ReadX 13835 3376 512 512
ReadX 13835 3888 512 512
ReadX 13835 4400 512 512
ReadX 13835 4912 512 512
ReadX 13835 5424 512 512
ReadX 13835 5936 512 512
ReadX 13835 6448 368 368
ReadX 13835 3262 144 144
ReadX 13835 3406 512 512
ReadX 13835 3918 512 512
ReadX 13835 4430 512 512
ReadX 13835 4942 512 512
ReadX 13835 5454 512 512
ReadX 13835 5966 512 512
ReadX 13835 6478 512 512
ReadX 13835 6990 512 512
ReadX 13835 7502 512 512
ReadX 13835 8014 512 512
ReadX 13835 8526 512 512
ReadX 13835 9038 512 512
ReadX 13835 9550 512 512
ReadX 13835 10062 512 512
ReadX 13835 10574 512 512
ReadX 13835 11086 512 512
ReadX 13835 11598 512 512
ReadX 13835 12110 512 512
ReadX 13835 12622 512 512
ReadX 13835 13134 512 512
ReadX 13835 13646 368 368
ReadX 13835 3332 144 144
ReadX 13835 3476 512 512
ReadX 13835 3988 512 512
ReadX 13835 4500 512 512
ReadX 13835 5012 512 512
ReadX 13835 5524 512 512
ReadX 13835 6036 512 512
ReadX 13835 6548 512 512
ReadX 13835 7060 512 512
ReadX 13835 7572 512 512
ReadX 13835 8084 512 512
ReadX 13835 8596 512 512
ReadX 13835 9108 512 512
ReadX 13835 9620 512 512
ReadX 13835 10132 512 512
ReadX 13835 10644 512 512
ReadX 13835 11156 512 512
ReadX 13835 11668 512 512
ReadX 13835 12180 512 512
ReadX 13835 12692 512 512
ReadX 13835 13204 512 512
ReadX 13835 3430 512 512
ReadX 13835 3942 512 512
ReadX 13835 3434 512 512
ReadX 13835 3435 512 512
ReadX 13835 3947 512 512
ReadX 13835 4459 512 512
ReadX 13835 4971 512 512
ReadX 13835 5483 512 512
ReadX 13835 5995 512 512
ReadX 13835 6507 512 512
ReadX 13835 7019 512 512
ReadX 13835 7531 512 512
ReadX 13835 8043 512 512
ReadX 13835 8555 512 512
ReadX 13835 9067 512 512
ReadX 13835 9579 512 512
ReadX 13835 10091 512 512
ReadX 13835 10603 512 512
ReadX 13835 11115 512 512
ReadX 13835 3467 512 512
ReadX 13835 3979 512 512
ReadX 13835 4491 512 512
ReadX 13835 5003 512 512
ReadX 13835 5515 512 512
ReadX 13835 6027 512 512
ReadX 13835 6539 512 512
ReadX 13835 7051 512 512
ReadX 13835 7563 512 512
ReadX 13835 8075 512 512
ReadX 13835 8587 512 512
ReadX 13835 9099 512 512
ReadX 13835 9611 512 512
ReadX 13835 10123 512 512
ReadX 13835 10635 512 512
ReadX 13835 11147 512 512
ReadX 13835 11659 512 512
ReadX 13835 12171 512 512
ReadX 13835 12683 512 512
ReadX 13835 13195 512 512
ReadX 13835 13707 56 56
ReadX 13835 13763 512 512
ReadX 13835 14275 456 456
ReadX 13835 14731 512 512
ReadX 13835 15243 512 512
ReadX 13835 15755 512 512
ReadX 13835 16267 512 512
ReadX 13835 16779 512 512
ReadX 13835 17291 512 512
ReadX 13835 17803 512 512
ReadX 13835 18315 512 512
ReadX 13835 18827 512 512
ReadX 13835 19339 512 512
ReadX 13835 19851 512 512
ReadX 13835 20363 512 512
ReadX 13835 20875 512 512
ReadX 13835 21387 512 512
ReadX 13835 21899 512 512
ReadX 13835 22411 512 512
ReadX 13835 22923 512 512
ReadX 13835 23435 512 512
ReadX 13835 23947 512 512
ReadX 13835 24459 512 512
ReadX 13835 24971 282 282
ReadX 13835 3434 512 512
ReadX 13835 2818 512 512
ReadX 13835 2870 512 512
ReadX 13835 3026 512 512
ReadX 13835 3538 512 512
ReadX 13835 2870 512 512
ReadX 13835 3382 512 512
ReadX 13835 3894 512 512
ReadX 13835 4406 512 512
ReadX 13835 4918 512 512
ReadX 13835 5430 512 512
ReadX 13835 5942 512 512
ReadX 13835 6454 374 374
ReadX 13835 2856 138 138
ReadX 13835 2994 512 512
ReadX 13835 3506 512 512
ReadX 13835 4018 512 512
ReadX 13835 4530 512 512
ReadX 13835 5042 512 512
ReadX 13835 5554 512 512
ReadX 13835 6066 374 374
ReadX 13835 2886 138 138
ReadX 13835 3024 512 512
ReadX 13835 3536 512 512
ReadX 13835 4048 512 512
ReadX 13835 4560 512 512
ReadX 13835 5072 512 512
ReadX 13835 5584 512 512
ReadX 13835 6096 512 512
ReadX 13835 6608 512 512
ReadX 13835 7120 512 512
ReadX 13835 7632 512 512
ReadX 13835 8144 512 512
ReadX 13835 8656 512 512
ReadX 13835 9168 512 512
ReadX 13835 9680 512 512
ReadX 13835 10192 512 512
ReadX 13835 10704 512 512
ReadX 13835 11216 512 512
ReadX 13835 11728 512 512
ReadX 13835 12240 512 512
ReadX 13835 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 13835 13264 512 512
ReadX 13835 13776 512 512
ReadX 13835 14288 512 512
ReadX 13835 14800 512 512
ReadX 13835 15312 512 512
ReadX 13835 15824 512 512
ReadX 13835 16336 512 512
ReadX 13835 16848 512 512
ReadX 13835 17360 512 512
ReadX 13835 17872 512 512
ReadX 13835 18384 512 512
ReadX 13835 18896 512 512
ReadX 13835 19408 512 512
ReadX 13835 19920 512 512
ReadX 13835 20432 512 512
ReadX 13835 20944 512 512
ReadX 13835 21456 512 512
ReadX 13835 21968 512 512
ReadX 13835 22480 512 512
ReadX 13835 22992 512 512
ReadX 13835 2998 512 512
ReadX 13835 3510 512 512
ReadX 13835 3001 512 512
ReadX 13835 3003 512 512
ReadX 13835 3515 512 512
ReadX 13835 4027 512 512
ReadX 13835 4539 512 512
ReadX 13835 5051 512 512
ReadX 13835 5563 512 512
ReadX 13835 6075 512 512
ReadX 13835 6587 512 512
ReadX 13835 7099 512 512
ReadX 13835 7611 512 512
ReadX 13835 8123 512 512
ReadX 13835 8635 512 512
ReadX 13835 3029 512 512
ReadX 13835 3541 512 512
ReadX 13835 4053 512 512
ReadX 13835 4565 512 512
ReadX 13835 5077 512 512
ReadX 13835 5589 512 512
ReadX 13835 6101 512 512
ReadX 13835 6613 512 512
ReadX 13835 7125 512 512
ReadX 13835 7637 512 512
ReadX 13835 8149 512 512
ReadX 13835 8661 512 512
ReadX 13835 9173 512 512
ReadX 13835 9685 512 512
ReadX 13835 10197 512 512
ReadX 13835 10709 512 512
ReadX 13835 11221 512 512
ReadX 13835 11733 512 512
ReadX 13835 12245 512 512
ReadX 13835 12757 512 512
ReadX 13835 13269 40 40
ReadX 13835 3076 472 472
ReadX 13835 3548 512 512
ReadX 13835 4060 512 512
ReadX 13835 4572 512 512
ReadX 13835 5084 512 512
ReadX 13835 5596 512 512
ReadX 13835 6108 512 512
ReadX 13835 6620 512 512
ReadX 13835 7132 512 512
ReadX 13835 7644 512 512
ReadX 13835 8156 512 512
ReadX 13835 8668 512 512
ReadX 13835 9180 512 512
ReadX 13835 9692 512 512
ReadX 13835 10204 512 512
ReadX 13835 10716 512 512
ReadX 13835 11228 512 512
ReadX 13835 11740 512 512
ReadX 13835 12252 512 512
ReadX 13835 12764 512 512
ReadX 13835 13276 310 310
ReadX 13835 3001 512 512
ReadX 13835 2562 512 512
ReadX 13835 2626 512 512
ReadX 13835 3003 512 512
ReadX 13835 2721 512 512
ReadX 13835 2626 512 512
ReadX 13835 3138 512 512
ReadX 13835 3650 512 512
ReadX 13835 4162 512 512
ReadX 13835 4674 512 512
ReadX 13835 5186 512 512
ReadX 13835 5698 512 512
ReadX 13835 6210 424 424
ReadX 13835 2612 88 88
ReadX 13835 2700 512 512
ReadX 13835 3212 512 512
ReadX 13835 3724 512 512
ReadX 13835 4236 512 512
ReadX 13835 4748 512 512
ReadX 13835 5260 512 512
ReadX 13835 5772 424 424
ReadX 13835 2642 88 88
ReadX 13835 2730 512 512
ReadX 13835 3242 512 512
ReadX 13835 3754 512 512
ReadX 13835 4266 512 512
ReadX 13835 4778 512 512
ReadX 13835 5290 512 512
ReadX 13835 5802 512 512
ReadX 13835 6314 512 512
ReadX 13835 6826 512 512
ReadX 13835 7338 512 512
ReadX 13835 7850 512 512
ReadX 13835 8362 512 512
ReadX 13835 8874 512 512
ReadX 13835 9386 512 512
ReadX 13835 9898 512 512
ReadX 13835 10410 512 512
ReadX 13835 10922 512 512
ReadX 13835 11434 512 512
ReadX 13835 11946 512 512
ReadX 13835 12458 512 512
ReadX 13835 2716 512 512
ReadX 13835 2717 512 512
ReadX 13835 2718 512 512
ReadX 13835 3230 512 512
ReadX 13835 2721 512 512
ReadX 13835 3233 512 512
ReadX 13835 3745 512 512
ReadX 13835 4257 512 512
ReadX 13835 4769 512 512
ReadX 13835 5281 512 512
ReadX 13835 5793 512 512
ReadX 13835 6305 512 512
ReadX 13835 6817 512 512
ReadX 13835 7329 512 512
ReadX 13835 7841 512 512
ReadX 13835 8353 512 512
ReadX 13835 8865 512 512
ReadX 13835 9377 512 512
ReadX 13835 9889 512 512
ReadX 13835 10401 512 512
ReadX 13835 10913 512 512
ReadX 13835 11425 512 512
ReadX 13835 11937 512 512
ReadX 13835 12449 512 512
ReadX 13835 12961 512 512
ReadX 13835 13473 512 512
ReadX 13835 13985 106 106
ReadX 13835 2820 406 406
ReadX 13835 3226 512 512
ReadX 13835 3738 512 512
ReadX 13835 4250 512 512
ReadX 13835 4762 512 512
ReadX 13835 5274 512 512
ReadX 13835 5786 512 512
ReadX 13835 6298 512 512
ReadX 13835 6810 512 512
ReadX 13835 7322 512 512
ReadX 13835 7834 512 512
ReadX 13835 8346 512 512
ReadX 13835 8858 512 512
ReadX 13835 9370 512 512
ReadX 13835 9882 512 512
ReadX 13835 10394 512 512
ReadX 13835 10906 512 512
ReadX 13835 11418 182 182
ReadX 13835 2717 512 512
ReadX 13835 258 512 512
ReadX 13835 470 512 512
ReadX 13835 376 512 512
ReadX 13835 888 512 512
ReadX 13835 1400 512 512
ReadX 13835 1912 512 512
ReadX 13835 2424 512 512
ReadX 13835 2936 512 512
ReadX 13835 3448 512 512
ReadX 13835 3960 424 424
ReadX 13835 362 88 88
ReadX 13835 450 512 512
ReadX 13835 962 512 512
ReadX 13835 1474 512 512
ReadX 13835 1986 512 512
ReadX 13835 2498 512 512
ReadX 13835 3010 512 512
ReadX 13835 3522 424 424
ReadX 13835 392 88 88
ReadX 13835 480 512 512
ReadX 13835 992 512 512
ReadX 13835 1504 512 512
ReadX 13835 2016 512 512
ReadX 13835 2528 512 512
ReadX 13835 3040 512 512
ReadX 13835 3552 512 512
ReadX 13835 4064 512 512
ReadX 13835 4576 512 512
ReadX 13835 5088 512 512
ReadX 13835 5600 512 512
ReadX 13835 6112 512 512
ReadX 13835 6624 512 512
ReadX 13835 7136 512 512
ReadX 13835 7648 512 512
ReadX 13835 8160 512 512
ReadX 13835 8672 512 512
ReadX 13835 9184 512 512
ReadX 13835 9696 512 512
ReadX 13835 10208 512 512
ReadX 13835 464 512 512
ReadX 13835 465 512 512
ReadX 13835 466 512 512
ReadX 13835 978 512 512
ReadX 13835 470 512 512
ReadX 13835 982 512 512
ReadX 13835 1494 512 512
ReadX 13835 2006 512 512
ReadX 13835 2518 512 512
ReadX 13835 3030 512 512
ReadX 13835 3542 512 512
ReadX 13835 4054 512 512
ReadX 13835 4566 512 512
ReadX 13835 5078 512 512
ReadX 13835 5590 512 512
ReadX 13835 6102 512 512
ReadX 13835 6614 512 512
ReadX 13835 7126 512 512
ReadX 13835 7638 512 512
ReadX 13835 8150 512 512
ReadX 13835 8662 512 512
ReadX 13835 9174 512 512
ReadX 13835 9686 512 512
ReadX 13835 10198 512 512
ReadX 13835 10710 333 333
ReadX 13835 11043 512 512
ReadX 13835 11555 179 179
ReadX 13835 11734 512 512
ReadX 13835 12246 512 512
ReadX 13835 12758 512 512
ReadX 13835 13270 512 512
ReadX 13835 13782 512 512
ReadX 13835 14294 512 512
ReadX 13835 14806 512 512
ReadX 13835 15318 512 512
ReadX 13835 15830 512 512
ReadX 13835 16342 512 512
ReadX 13835 16854 512 512
ReadX 13835 17366 512 512
ReadX 13835 17878 512 512
ReadX 13835 18390 512 512
ReadX 13835 18902 512 512
ReadX 13835 19414 512 512
ReadX 13835 19926 512 512
ReadX 13835 20438 512 512
ReadX 13835 20950 512 512
ReadX 13835 21462 512 512
ReadX 13835 21974 350 350
ReadX 13835 465 512 512
ReadX 13835 3812 512 512
ReadX 13835 4046 512 512
ReadX 13835 3828 512 512
ReadX 13835 256 512 512
ReadX 13835 260 512 512
ReadX 13835 4066 512 512
ReadX 13835 4578 512 512
ReadX 13835 5090 512 512
ReadX 13835 5602 512 512
ReadX 13835 6114 512 512
ReadX 13835 6626 512 512
ReadX 13835 7138 512 512
ReadX 13835 7650 394 394
ReadX 13835 4052 118 118
ReadX 13835 4170 512 512
ReadX 13835 4682 512 512
ReadX 13835 5194 512 512
ReadX 13835 5706 512 512
ReadX 13835 6218 512 512
ReadX 13835 6730 512 512
ReadX 13835 7242 394 394
ReadX 13835 4082 118 118
ReadX 13835 4200 512 512
ReadX 13835 4712 512 512
ReadX 13835 5224 512 512
ReadX 13835 5736 512 512
ReadX 13835 6248 512 512
ReadX 13835 6760 512 512
ReadX 13835 7272 512 512
ReadX 13835 7784 394 394
ReadX 13835 256 118 118
ReadX 13835 374 512 512
ReadX 13835 886 512 512
ReadX 13835 1398 512 512
ReadX 13835 1910 512 512
ReadX 13835 2422 512 512
ReadX 13835 2934 512 512
ReadX 13835 3446 512 512
ReadX 13835 3958 512 512
ReadX 13835 4470 512 512
ReadX 13835 4982 512 512
ReadX 13835 5494 512 512
ReadX 13835 6006 512 512
ReadX 13835 6518 512 512
ReadX 13835 7030 512 512
ReadX 13835 7542 512 512
ReadX 13835 8054 512 512
ReadX 13835 8566 512 512
ReadX 13835 9078 512 512
ReadX 13835 9590 512 512
ReadX 13835 10102 512 512
ReadX 13835 259 512 512
ReadX 13835 771 512 512
ReadX 13835 259 512 512
ReadX 13835 259 512 512
ReadX 13835 771 512 512
ReadX 13835 1283 512 512
ReadX 13835 1795 512 512
ReadX 13835 2307 512 512
ReadX 13835 2819 512 512
ReadX 13835 3331 512 512
ReadX 13835 3843 512 512
ReadX 13835 4355 512 512
ReadX 13835 4867 512 512
ReadX 13835 260 512 512
ReadX 13835 772 512 512
ReadX 13835 1284 512 512
ReadX 13835 1796 512 512
ReadX 13835 2308 512 512
ReadX 13835 2820 512 512
ReadX 13835 3332 512 512
ReadX 13835 3844 512 512
ReadX 13835 4356 512 512
ReadX 13835 4868 512 512
ReadX 13835 5380 512 512
ReadX 13835 5892 512 512
ReadX 13835 6404 512 512
ReadX 13835 6916 512 512
ReadX 13835 7428 512 512
ReadX 13835 7940 512 512
ReadX 13835 8452 512 512
ReadX 13835 8964 512 512
ReadX 13835 9476 512 512
ReadX 13835 9988 512 512
ReadX 13835 10500 378 378
ReadX 13835 10878 512 512
ReadX 13835 11390 134 134
ReadX 13835 11524 512 512
ReadX 13835 12036 512 512
ReadX 13835 12548 512 512
ReadX 13835 13060 512 512
ReadX 13835 13572 138 138
ReadX 13835 259 512 512
ReadX 13835 273 512 512
ReadX 13835 276 512 512
ReadX 13835 295 512 512
ReadX 13835 288 512 512
ReadX 13835 296 512 512
ReadX 13835 259 512 512
ReadX 13835 273 512 512
ReadX 13835 273 512 512
ReadX 13835 785 512 512
ReadX 13835 1297 512 512
ReadX 13835 1809 512 512
ReadX 13835 2321 512 512
ReadX 13835 274 512 512
ReadX 13835 274 512 512
ReadX 13835 274 497 497
ReadX 13835 272 15 15
ReadX 13835 287 512 512
ReadX 13835 799 512 512
ReadX 13835 273 512 512
ReadX 13835 785 512 512
ReadX 13835 1297 512 512
ReadX 13835 1809 512 512
ReadX 13835 2321 512 512
ReadX 13835 2833 317 317
ReadX 13835 274 195 195
ReadX 13835 469 512 512
ReadX 13835 981 512 512
ReadX 13835 1493 512 512
ReadX 13835 2005 512 512
ReadX 13835 2517 512 512
ReadX 13835 3029 512 512
ReadX 13835 3541 512 512
ReadX 13835 4053 512 512
ReadX 13835 4565 250 250
ReadX 13835 274 512 512
ReadX 13835 283 512 512
ReadX 13835 795 512 512
ReadX 13835 276 512 512
ReadX 13835 788 512 512
ReadX 13835 1300 512 512
ReadX 13835 1812 512 512
ReadX 13835 2324 512 512
ReadX 13835 2836 512 512
ReadX 13835 3348 512 512
ReadX 13835 3860 420 420
ReadX 13835 275 92 92
ReadX 13835 367 512 512
ReadX 13835 879 512 512
ReadX 13835 1391 512 512
ReadX 13835 1903 512 512
ReadX 13835 2415 512 512
ReadX 13835 2927 512 512
ReadX 13835 3439 420 420
ReadX 13835 277 92 92
ReadX 13835 369 512 512
ReadX 13835 881 512 512
ReadX 13835 1393 512 512
ReadX 13835 1905 512 512
ReadX 13835 2417 512 512
ReadX 13835 2929 512 512
ReadX 13835 3441 512 512
ReadX 13835 3953 512 512
ReadX 13835 4465 512 512
ReadX 13835 4977 512 512
ReadX 13835 5489 512 512
ReadX 13835 6001 512 512
ReadX 13835 6513 512 512
ReadX 13835 7025 512 512
ReadX 13835 7537 512 512
ReadX 13835 8049 512 512
ReadX 13835 8561 512 512
ReadX 13835 9073 512 512
ReadX 13835 9585 512 512
ReadX 13835 10097 512 512
ReadX 13835 282 512 512
ReadX 13835 794 512 512
ReadX 13835 1306 512 512
ReadX 13835 1818 512 512
ReadX 13835 2330 512 512
ReadX 13835 2842 512 512
ReadX 13835 3354 512 512
ReadX 13835 3866 512 512
ReadX 13835 4378 512 512
ReadX 13835 284 512 512
ReadX 13835 796 512 512
ReadX 13835 1308 512 512
ReadX 13835 1820 512 512
ReadX 13835 2332 512 512
ReadX 13835 2844 512 512
ReadX 13835 3356 512 512
ReadX 13835 3868 512 512
ReadX 13835 4380 512 512
ReadX 13835 4892 512 512
ReadX 13835 5404 512 512
ReadX 13835 5916 512 512
ReadX 13835 6428 512 512
ReadX 13835 6940 512 512
ReadX 13835 7452 512 512
ReadX 13835 7964 512 512
ReadX 13835 8476 512 512
ReadX 13835 8988 512 512
ReadX 13835 9500 512 512
ReadX 13835 10012 512 512
ReadX 13835 10524 472 472
ReadX 13835 288 40 40
ReadX 13835 328 512 512
ReadX 13835 840 512 512
ReadX 13835 1352 512 512
ReadX 13835 1864 512 512
ReadX 13835 2376 512 512
ReadX 13835 2888 512 512
ReadX 13835 3400 512 512
ReadX 13835 3912 512 512
ReadX 13835 4424 512 512
ReadX 13835 4936 512 512
ReadX 13835 5448 512 512
ReadX 13835 5960 512 512
ReadX 13835 6472 512 512
ReadX 13835 6984 512 512
ReadX 13835 7496 512 512
ReadX 13835 8008 512 512
ReadX 13835 8520 512 512
ReadX 13835 9032 512 512
ReadX 13835 9544 512 512
ReadX 13835 10056 512 512
ReadX 13835 10568 506 506
ReadX 13835 282 512 512
ReadX 13835 794 512 512
ReadX 13835 301 512 512
ReadX 13835 296 512 512
ReadX 13835 808 512 512
ReadX 13835 1320 512 512
ReadX 13835 1832 512 512
ReadX 13835 2344 512 512
ReadX 13835 2856 512 512
ReadX 13835 3368 512 512
ReadX 13835 3880 424 424
ReadX 13835 295 88 88
ReadX 13835 383 512 512
ReadX 13835 895 512 512
ReadX 13835 1407 512 512
ReadX 13835 1919 512 512
ReadX 13835 2431 512 512
ReadX 13835 2943 512 512
ReadX 13835 3455 424 424
ReadX 13835 297 88 88
ReadX 13835 385 512 512
ReadX 13835 897 512 512
ReadX 13835 1409 512 512
ReadX 13835 1921 512 512
ReadX 13835 2433 512 512
ReadX 13835 2945 512 512
ReadX 13835 3457 512 512
ReadX 13835 3969 512 512
ReadX 13835 4481 512 512
ReadX 13835 4993 512 512
ReadX 13835 5505 512 512
ReadX 13835 6017 512 512
ReadX 13835 6529 512 512
ReadX 13835 7041 512 512
ReadX 13835 7553 512 512
ReadX 13835 8065 512 512
ReadX 13835 8577 512 512
ReadX 13835 9089 512 512
ReadX 13835 9601 512 512
ReadX 13835 10113 512 512
ReadX 13835 301 512 512
ReadX 13835 301 512 512
ReadX 13835 301 512 512
ReadX 13835 813 512 512
ReadX 13835 301 512 512
ReadX 13835 813 512 512
ReadX 13835 1325 512 512
ReadX 13835 1837 512 512
ReadX 13835 2349 512 512
ReadX 13835 2861 512 512
ReadX 13835 3373 512 512
ReadX 13835 3885 512 512
ReadX 13835 4397 512 512
ReadX 13835 4909 512 512
ReadX 13835 5421 512 512
ReadX 13835 5933 512 512
ReadX 13835 6445 512 512
ReadX 13835 6957 512 512
ReadX 13835 7469 512 512
ReadX 13835 7981 512 512
ReadX 13835 8493 512 512
ReadX 13835 9005 512 512
ReadX 13835 9517 463 463
ReadX 13835 9980 512 512
ReadX 13835 10492 49 49
ReadX 13835 10541 512 512
ReadX 13835 11053 512 512
ReadX 13835 11565 512 512
ReadX 13835 12077 512 512
ReadX 13835 12589 512 512
ReadX 13835 13101 512 512
ReadX 13835 13613 512 512
ReadX 13835 14125 512 512
ReadX 13835 14637 512 512
ReadX 13835 15149 512 512
ReadX 13835 15661 512 512
ReadX 13835 16173 512 512
ReadX 13835 16685 512 512
ReadX 13835 17197 512 512
ReadX 13835 17709 512 512
ReadX 13835 18221 512 512
ReadX 13835 18733 512 512
ReadX 13835 19245 512 512
ReadX 13835 19757 512 512
ReadX 13835 20269 512 512
ReadX 13835 20781 326 326
ReadX 13835 301 512 512
QUERY_FS_INFORMATION 259
Close 13833
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13836
Close 13836
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13837
ReadX 13837 0 24 24
Close 13837
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13838
QUERY_FILE_INFORMATION 13838
ReadX 13838 0 512 512
ReadX 13838 476 512 512
ReadX 13838 510 512 512
ReadX 13838 484 512 512
ReadX 13838 474 512 512
ReadX 13838 478 512 512
ReadX 13838 990 512 512
ReadX 13838 509 57 57
Close 13838
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13839
QUERY_FILE_INFORMATION 13839
ReadX 13839 0 512 512
ReadX 13839 476 512 512
ReadX 13839 510 512 512
ReadX 13839 484 512 512
ReadX 13839 480 512 512
ReadX 13839 474 512 512
ReadX 13839 478 512 512
QUERY_FILE_INFORMATION 13839
WriteX 13839 494 60 60
WriteX 13839 494 4 4
QUERY_FILE_INFORMATION 13839
WriteX 13839 494 11 11
WriteX 13839 510 512 512
WriteX 13839 484 512 512
WriteX 13839 474 512 512
WriteX 13839 478 512 512
WriteX 13839 990 512 512
Close 13839
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13840
Close 13840
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13841
Close 13841
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13843
WriteX 13843 4607 1 1
QUERY_FILE_INFORMATION 13843
WriteX 13843 0 65471 65471
WriteX 13843 65471 65 65
WriteX 13843 65536 19490 19490
Close 13843
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13844
QUERY_FILE_INFORMATION 13844
ReadX 13844 0 512 512
ReadX 13844 482 512 512
ReadX 13844 994 512 512
ReadX 13844 1506 512 512
ReadX 13844 480 512 512
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 490 448 448
QUERY_FILE_INFORMATION 13844
WriteX 13844 490 60 60
WriteX 13844 490 4 4
QUERY_FILE_INFORMATION 13844
WriteX 13844 490 11 11
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 484 512 512
WriteX 13844 996 512 512
WriteX 13844 1508 512 512
WriteX 13844 482 512 512
WriteX 13844 0 512 512
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
ReadX 13844 490 512 512
WriteX 13844 502 512 512
WriteX 13844 502 292 292
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 503 20 20
WriteX 13844 503 108 108
QUERY_FILE_INFORMATION 13844
WriteX 13844 504 448 448
QUERY_FILE_INFORMATION 13844
WriteX 13844 504 44 44
WriteX 13844 504 20 20
WriteX 13844 500 512 512
WriteX 13844 492 512 512
WriteX 13844 496 512 512
WriteX 13844 1008 512 512
WriteX 13844 494 512 512
Flush 13844
WriteX 13844 0 512 512
Flush 13844
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 500 512 512
WriteX 13844 492 512 512
WriteX 13844 496 512 512
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 518 320 320
QUERY_FILE_INFORMATION 13844
WriteX 13844 518 60 60
ReadX 13844 504 512 512
WriteX 13844 522 512 512
WriteX 13844 506 3204 3204
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 519 25 25
WriteX 13844 518 103 103
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 519 44 44
WriteX 13844 519 20 20
WriteX 13844 520 512 512
WriteX 13844 482 512 512
WriteX 13844 486 512 512
WriteX 13844 998 512 512
WriteX 13844 484 512 512
WriteX 13844 490 512 512
Flush 13844
WriteX 13844 0 512 512
Flush 13844
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
QUERY_FILE_INFORMATION 13844
WriteX 13844 519 7 7
WriteX 13844 519 57 57
WriteX 13844 520 512 512
WriteX 13844 492 512 512
WriteX 13844 482 512 512
WriteX 13844 486 512 512
WriteX 13844 998 512 512
Flush 13844
WriteX 13844 520 512 512
Flush 13844
Close 13844
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13845
Close 13845
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13846
QUERY_FILE_INFORMATION 13846
ReadX 13846 0 512 512
ReadX 13846 490 512 512
ReadX 13846 484 512 512
ReadX 13846 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13847
Close 13847
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13846
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13848
Close 13848
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13849
ReadX 13849 0 24 24
Close 13849
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13850
QUERY_FILE_INFORMATION 13850
ReadX 13850 0 512 512
ReadX 13850 366 512 512
ReadX 13850 878 512 512
ReadX 13850 1390 512 512
ReadX 13850 1902 512 512
ReadX 13850 374 57 57
Close 13850
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13851
QUERY_FILE_INFORMATION 13851
ReadX 13851 0 512 512
ReadX 13851 366 512 512
ReadX 13851 878 512 512
ReadX 13851 1390 512 512
ReadX 13851 1902 512 512
QUERY_FILE_INFORMATION 13851
WriteX 13851 374 60 60
WriteX 13851 374 4 4
QUERY_FILE_INFORMATION 13851
WriteX 13851 374 11 11
ReadX 13851 374 57 57
ReadX 13851 374 57 57
ReadX 13851 292 4096 4096
ReadX 13851 364 512 512
ReadX 13851 512 4096 4096
ReadX 13851 4608 4096 4096
ReadX 13851 8704 4096 4096
ReadX 13851 12800 4096 4096
ReadX 13851 16896 4096 4096
ReadX 13851 20992 4096 4096
ReadX 13851 25088 4096 4096
ReadX 13851 29184 4096 4096
ReadX 13851 33280 4096 4096
ReadX 13851 37376 4096 4096
ReadX 13851 41472 4096 4096
ReadX 13851 45568 4096 4096
ReadX 13851 49664 4096 4096
ReadX 13851 53760 4096 4096
ReadX 13851 57856 4096 4096
ReadX 13851 61952 4096 4096
ReadX 13851 66048 4096 4096
ReadX 13851 70144 4096 4096
ReadX 13851 74240 162 162
ReadX 13851 308 4096 4096
ReadX 13851 4404 4096 4096
WriteX 13851 368 512 512
WriteX 13851 880 512 512
WriteX 13851 1392 512 512
Close 13851
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13852
Close 13852
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13853
QUERY_FILE_INFORMATION 13853
ReadX 13853 0 512 512
ReadX 13853 366 512 512
ReadX 13853 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13854
Close 13854
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13853
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13856
WriteX 13856 4607 1 1
QUERY_FILE_INFORMATION 13856
WriteX 13856 0 65471 65471
WriteX 13856 65471 65 65
WriteX 13856 65536 8866 8866
Close 13856
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13857
QUERY_FILE_INFORMATION 13857
ReadX 13857 0 512 512
ReadX 13857 366 512 512
ReadX 13857 878 512 512
ReadX 13857 1390 512 512
ReadX 13857 364 512 512
QUERY_FILE_INFORMATION 13857
QUERY_FILE_INFORMATION 13857
QUERY_FILE_INFORMATION 13857
WriteX 13857 374 448 448
QUERY_FILE_INFORMATION 13857
WriteX 13857 374 60 60
WriteX 13857 374 4 4
QUERY_FILE_INFORMATION 13857
WriteX 13857 374 11 11
QUERY_FILE_INFORMATION 13857
QUERY_FILE_INFORMATION 13857
WriteX 13857 374 7 7
WriteX 13857 374 57 57
WriteX 13857 368 512 512
WriteX 13857 880 512 512
WriteX 13857 1392 512 512
WriteX 13857 366 512 512
WriteX 13857 0 512 512
Flush 13857
WriteX 13857 368 512 512
Flush 13857
Close 13857
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13858
QUERY_FILE_INFORMATION 13858
ReadX 13858 0 512 512
ReadX 13858 366 512 512
ReadX 13858 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13858
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13859
Close 13859
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13860
ReadX 13860 0 24 24
Close 13860
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13861
QUERY_FILE_INFORMATION 13861
ReadX 13861 0 512 512
ReadX 13861 366 512 512
ReadX 13861 878 512 512
ReadX 13861 1390 512 512
ReadX 13861 1902 512 512
ReadX 13861 374 57 57
Close 13861
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13862
QUERY_FILE_INFORMATION 13862
ReadX 13862 0 512 512
ReadX 13862 366 512 512
ReadX 13862 878 512 512
ReadX 13862 1390 512 512
ReadX 13862 1902 512 512
QUERY_FILE_INFORMATION 13862
WriteX 13862 374 60 60
WriteX 13862 374 4 4
QUERY_FILE_INFORMATION 13862
WriteX 13862 374 11 11
WriteX 13862 368 512 512
WriteX 13862 880 512 512
WriteX 13862 1392 512 512
Close 13862
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13863
Close 13863
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13864
Close 13864
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13866
WriteX 13866 4607 1 1
QUERY_FILE_INFORMATION 13866
WriteX 13866 0 65471 65471
WriteX 13866 65471 65 65
WriteX 13866 65536 9298 9298
Close 13866
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13867
QUERY_FILE_INFORMATION 13867
ReadX 13867 0 512 512
ReadX 13867 368 512 512
ReadX 13867 880 512 512
ReadX 13867 1392 512 512
ReadX 13867 366 512 512
QUERY_FILE_INFORMATION 13867
QUERY_FILE_INFORMATION 13867
QUERY_FILE_INFORMATION 13867
WriteX 13867 376 448 448
QUERY_FILE_INFORMATION 13867
WriteX 13867 376 60 60
WriteX 13867 376 4 4
QUERY_FILE_INFORMATION 13867
WriteX 13867 376 11 11
QUERY_FILE_INFORMATION 13867
QUERY_FILE_INFORMATION 13867
WriteX 13867 376 7 7
WriteX 13867 376 57 57
WriteX 13867 370 512 512
WriteX 13867 882 512 512
WriteX 13867 1394 512 512
WriteX 13867 368 512 512
WriteX 13867 0 512 512
Flush 13867
WriteX 13867 370 512 512
Flush 13867
Close 13867
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13868
Close 13868
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13869
QUERY_FILE_INFORMATION 13869
ReadX 13869 0 512 512
ReadX 13869 368 512 512
ReadX 13869 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13870
Close 13870
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13872
Close 13872
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13873
ReadX 13873 0 24 24
Close 13873
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13874
QUERY_FILE_INFORMATION 13874
ReadX 13874 0 512 512
ReadX 13874 512 512 512
ReadX 13874 1024 512 512
ReadX 13874 2016 512 512
ReadX 13874 1056 512 512
ReadX 13874 1096 57 57
Close 13874
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13875
QUERY_FILE_INFORMATION 13875
ReadX 13875 0 512 512
ReadX 13875 512 512 512
ReadX 13875 1024 512 512
ReadX 13875 2016 512 512
ReadX 13875 1056 512 512
ReadX 13875 1096 57 57
ReadX 13875 1096 57 57
ReadX 13875 1088 62 62
ReadX 13875 1536 4096 4096
ReadX 13875 5632 4096 4096
ReadX 13875 9728 4096 4096
ReadX 13875 13824 2859 2859
ReadX 13875 1120 28 28
ReadX 13875 1148 20 20
ReadX 13875 1168 8 8
ReadX 13875 1176 88 88
ReadX 13875 1264 8 8
ReadX 13875 1272 4 4
ReadX 13875 1276 4 4
ReadX 13875 1280 1 1
ReadX 13875 1130 4 4
ReadX 13875 1134 4 4
ReadX 13875 1138 1 1
ReadX 13875 1131 4 4
ReadX 13875 1135 4 4
ReadX 13875 1139 1 1
ReadX 13875 1131 4 4
ReadX 13875 1135 4 4
ReadX 13875 1139 2 2
ReadX 13875 1132 4 4
ReadX 13875 1136 4 4
ReadX 13875 1140 25 25
ReadX 13875 1134 4 4
ReadX 13875 1138 8 8
ReadX 13875 1146 4 4
ReadX 13875 1150 8 8
ReadX 13875 1158 4 4
ReadX 13875 1162 8 8
ReadX 13875 1170 4 4
ReadX 13875 1174 4 4
ReadX 13875 1178 4 4
ReadX 13875 1182 4 4
ReadX 13875 1186 4 4
ReadX 13875 1190 4 4
ReadX 13875 1194 13900 13900
ReadX 13875 2048 4096 4096
Close 13875
QUERY_FS_INFORMATION 259
Close 13869
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13876
Close 13876
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13877
ReadX 13877 0 24 24
Close 13877
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13878
QUERY_FILE_INFORMATION 13878
ReadX 13878 0 512 512
ReadX 13878 368 512 512
ReadX 13878 880 512 512
ReadX 13878 1392 512 512
ReadX 13878 1904 512 512
ReadX 13878 376 57 57
Close 13878
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13879
QUERY_FILE_INFORMATION 13879
ReadX 13879 0 512 512
ReadX 13879 368 512 512
ReadX 13879 880 512 512
ReadX 13879 1392 512 512
ReadX 13879 1904 512 512
QUERY_FILE_INFORMATION 13879
WriteX 13879 376 60 60
WriteX 13879 376 4 4
QUERY_FILE_INFORMATION 13879
WriteX 13879 376 11 11
WriteX 13879 370 512 512
WriteX 13879 882 512 512
WriteX 13879 1394 512 512
Close 13879
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13880
Close 13880
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13881
Close 13881
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13883
WriteX 13883 4607 1 1
QUERY_FILE_INFORMATION 13883
WriteX 13883 0 65471 65471
WriteX 13883 65471 65 65
WriteX 13883 65536 11540 11540
Close 13883
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13884
QUERY_FILE_INFORMATION 13884
ReadX 13884 0 512 512
ReadX 13884 398 512 512
ReadX 13884 910 512 512
ReadX 13884 1422 512 512
ReadX 13884 396 512 512
QUERY_FILE_INFORMATION 13884
QUERY_FILE_INFORMATION 13884
QUERY_FILE_INFORMATION 13884
WriteX 13884 406 448 448
QUERY_FILE_INFORMATION 13884
WriteX 13884 406 60 60
WriteX 13884 406 4 4
QUERY_FILE_INFORMATION 13884
WriteX 13884 406 11 11
QUERY_FILE_INFORMATION 13884
QUERY_FILE_INFORMATION 13884
WriteX 13884 406 7 7
WriteX 13884 406 57 57
WriteX 13884 400 512 512
WriteX 13884 912 512 512
WriteX 13884 1424 512 512
WriteX 13884 398 512 512
WriteX 13884 0 512 512
Flush 13884
WriteX 13884 400 512 512
Flush 13884
Close 13884
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13885
Close 13885
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13886
QUERY_FILE_INFORMATION 13886
ReadX 13886 0 512 512
ReadX 13886 398 512 512
ReadX 13886 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13887
Close 13887
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13886
ReadX 13835 1434 512 512
Close 13835
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13888
WriteX 13888 0 65471 65471
WriteX 13888 65471 63 63
WriteX 13888 65534 65471 65471
WriteX 13888 131005 63 63
Close 13888
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13889
WriteX 13889 0 65471 65471
WriteX 13889 65471 63 63
WriteX 13889 65534 65471 65471
WriteX 13889 131005 63 63
WriteX 13889 131068 65471 65471
WriteX 13889 196539 63 63
WriteX 13889 196602 65471 65471
WriteX 13889 262073 63 63
Close 13889
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13890
WriteX 13890 0 65471 65471
WriteX 13890 65471 63 63
WriteX 13890 65534 65471 65471
WriteX 13890 131005 63 63
WriteX 13890 131068 65471 65471
WriteX 13890 196539 63 63
WriteX 13890 196602 65471 65471
WriteX 13890 262073 63 63
WriteX 13890 262136 65471 65471
WriteX 13890 327607 63 63
WriteX 13890 327670 65471 65471
WriteX 13890 393141 63 63
WriteX 13890 393204 65471 65471
WriteX 13890 458675 63 63
WriteX 13890 458738 65471 65471
WriteX 13890 524209 63 63
Close 13890
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13891
Close 13891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13892
ReadX 13892 0 512 512
ReadX 13892 512 511 511
ReadX 13892 1023 512 512
ReadX 13892 1535 512 512
Close 13892
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13893
ReadX 13893 0 512 512
ReadX 13893 512 510 510
ReadX 13893 1022 512 512
ReadX 13893 1534 510 510
ReadX 13893 2044 510 510
Close 13893
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13894
ReadX 13894 0 512 512
ReadX 13894 512 512 512
ReadX 13894 1024 512 512
ReadX 13894 1536 512 512
ReadX 13894 2048 512 512
ReadX 13894 2560 512 512
ReadX 13894 3072 512 512
ReadX 13894 3584 512 512
ReadX 13894 4096 512 512
ReadX 13894 4608 512 512
ReadX 13894 5120 512 512
ReadX 13894 5632 512 512
ReadX 13894 6144 512 512
ReadX 13894 6656 512 512
ReadX 13894 7168 512 512
ReadX 13894 7680 512 512
ReadX 13894 8192 512 512
ReadX 13894 8704 512 512
Close 13894
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13895
Close 13895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13896
QUERY_FILE_INFORMATION 13896
Close 13896
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13897
ReadX 13897 0 8192 8192
Close 13897
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13898
Close 13898
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13899
QUERY_FILE_INFORMATION 13899
Close 13899
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13900
ReadX 13900 0 8192 8192
Close 13900
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13901
Close 13901
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13902
QUERY_FILE_INFORMATION 13902
Close 13902
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13903
ReadX 13903 0 8192 8192
Close 13903
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13904
ReadX 13904 0 8192 8192
ReadX 13904 8192 8192 8192
ReadX 13904 16384 8192 8192
ReadX 13904 24576 8192 8192
Close 13904
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13906
Close 13906
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13908
WriteX 13908 8191 1 1
QUERY_FILE_INFORMATION 13908
WriteX 13908 0 10438 10438
Close 13908
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13909
Close 13909
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13910
QUERY_FILE_INFORMATION 13910
QUERY_FILE_INFORMATION 13910
Close 13910
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13911
QUERY_FILE_INFORMATION 13911
QUERY_FILE_INFORMATION 13911
Close 13911
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13912
Close 13912
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13913
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
Close 13913
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13914
QUERY_FILE_INFORMATION 13914
QUERY_FILE_INFORMATION 13914
Close 13914
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13915
Close 13915
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13916
QUERY_FILE_INFORMATION 13916
QUERY_FILE_INFORMATION 13916
Close 13916
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13917
QUERY_FILE_INFORMATION 13917
QUERY_FILE_INFORMATION 13917
Close 13917
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13918
Close 13918
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13919
QUERY_FILE_INFORMATION 13919
QUERY_FILE_INFORMATION 13919
Close 13919
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13920
ReadX 13920 0 8 8
ReadX 13920 8 4 4
ReadX 13920 12 8 8
ReadX 13920 22 8 8
ReadX 13920 520 8 8
ReadX 13920 525 8 8
ReadX 13920 533 4 4
ReadX 13920 543 8 8
ReadX 13920 551 4 4
ReadX 13920 1058 8 8
ReadX 13920 1066 4 4
ReadX 13920 1081 8 8
ReadX 13920 1089 4 4
ReadX 13920 660 8 8
Close 13920
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13921
ReadX 13921 0 8192 8192
Close 13921
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13922
ReadX 13922 0 8192 8192
ReadX 13922 520 8192 8192
ReadX 13922 8712 8192 8192
ReadX 13922 16904 8192 8192
ReadX 13922 25096 8192 8192
ReadX 13922 33288 8192 8192
ReadX 13922 41480 8192 8192
ReadX 13922 49672 8192 8192
ReadX 13922 57864 8192 8192
ReadX 13922 66056 8192 8192
ReadX 13922 74248 8192 8192
ReadX 13922 82440 8192 8192
ReadX 13922 90632 8192 8192
ReadX 13922 98824 8192 8192
ReadX 13922 107016 8192 8192
ReadX 13922 115208 8192 8192
ReadX 13922 123400 8192 8192
ReadX 13922 131592 8192 8192
ReadX 13922 139784 8192 8192
ReadX 13922 147976 8192 8192
ReadX 13922 156168 8192 8192
Close 13922
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13923
QUERY_FILE_INFORMATION 13923
Close 13923
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13924
Close 13924
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13926
WriteX 13926 8191 1 1
QUERY_FILE_INFORMATION 13926
WriteX 13926 0 28489 28489
Close 13926
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13927
Close 13927
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13928
Close 13928
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13929
QUERY_FILE_INFORMATION 13929
Close 13929
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13930
ReadX 13930 0 8192 8192
Close 13930
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13931
Close 13931
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13932
QUERY_FILE_INFORMATION 13932
Close 13932
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13933
ReadX 13933 0 8192 8192
Close 13933
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13934
ReadX 13934 0 8192 8192
ReadX 13934 8192 8192 8192
ReadX 13934 16384 8192 8192
ReadX 13934 24576 8192 8192
ReadX 13934 32768 16384 16384
ReadX 13934 49152 8192 8192
ReadX 13934 57344 8192 8192
ReadX 13934 65536 8192 8192
Close 13934
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13936
Close 13936
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13938
WriteX 13938 8191 1 1
QUERY_FILE_INFORMATION 13938
WriteX 13938 0 29253 29253
Close 13938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13939
Close 13939
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13940
QUERY_FILE_INFORMATION 13940
QUERY_FILE_INFORMATION 13940
Close 13940
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13941
QUERY_FILE_INFORMATION 13941
QUERY_FILE_INFORMATION 13941
Close 13941
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13942
QUERY_FILE_INFORMATION 13942
Close 13942
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13943
Close 13943
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13945
WriteX 13945 8191 1 1
QUERY_FILE_INFORMATION 13945
WriteX 13945 0 30183 30183
Close 13945
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13946
Close 13946
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13947
WriteX 13947 0 510 510
WriteX 13947 510 512 512
WriteX 13947 1022 510 510
WriteX 13947 1532 510 510
WriteX 13947 2042 168 168
Close 13947
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13948
Close 13948
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13949
WriteX 13949 0 511 511
WriteX 13949 511 512 512
WriteX 13949 1023 512 512
WriteX 13949 1535 488 488
Close 13949
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13950
ReadX 13950 0 65471 65471
ReadX 13950 65471 63 63
ReadX 13950 65534 65471 65471
ReadX 13950 131005 63 63
ReadX 13950 131068 65471 65471
ReadX 13950 196539 63 63
ReadX 13950 196602 65471 65471
ReadX 13950 262073 63 63
ReadX 13950 262136 65471 65471
ReadX 13950 327607 63 63
ReadX 13950 327670 10 10
Close 13950
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13951
ReadX 13951 0 65471 65471
ReadX 13951 65471 63 63
ReadX 13951 65534 65471 65471
ReadX 13951 131005 63 63
ReadX 13951 131068 65471 65471
ReadX 13951 196539 63 63
ReadX 13951 196602 65471 65471
ReadX 13951 262073 63 63
ReadX 13951 262136 65471 65471
ReadX 13951 327607 63 63
ReadX 13951 327670 65471 65471
ReadX 13951 393141 63 63
ReadX 13951 393204 65471 65471
ReadX 13951 458675 63 63
ReadX 13951 458738 65471 65471
ReadX 13951 524209 63 63
ReadX 13951 524272 65471 65471
ReadX 13951 589743 63 63
ReadX 13951 589806 65471 65471
ReadX 13951 655277 63 63
ReadX 13951 655340 32 32
Close 13951
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13952
ReadX 13952 0 65471 65471
ReadX 13952 65471 63 63
ReadX 13952 65534 65471 65471
ReadX 13952 131005 63 63
ReadX 13952 131068 65471 65471
ReadX 13952 196539 63 63
ReadX 13952 196602 65471 65471
ReadX 13952 262073 63 63
ReadX 13952 262136 65471 65471
ReadX 13952 327607 63 63
ReadX 13952 327670 65471 65471
ReadX 13952 393141 63 63
ReadX 13952 393204 65471 65471
ReadX 13952 458675 63 63
ReadX 13952 458738 65471 65471
ReadX 13952 524209 63 63
ReadX 13952 524272 65471 65471
ReadX 13952 589743 63 63
ReadX 13952 589806 65471 65471
ReadX 13952 655277 63 63
ReadX 13952 655340 65471 65471
ReadX 13952 720811 63 63
ReadX 13952 720874 65471 65471
ReadX 13952 786345 63 63
ReadX 13952 786408 65471 65471
ReadX 13952 851879 63 63
ReadX 13952 851942 65471 65471
ReadX 13952 917413 63 63
ReadX 13952 917476 65471 65471
ReadX 13952 982947 63 63
ReadX 13952 983010 65471 65471
ReadX 13952 1048481 63 63
ReadX 13952 1048544 65471 65471
ReadX 13952 1114015 63 63
ReadX 13952 1114078 65471 65471
ReadX 13952 1179549 63 63
ReadX 13952 1179612 65471 65471
ReadX 13952 1245083 63 63
ReadX 13952 1245146 65471 65471
ReadX 13952 1310617 63 63
ReadX 13952 1310680 65471 65471
ReadX 13952 1376151 63 63
ReadX 13952 1376214 65471 65471
ReadX 13952 1441685 63 63
ReadX 13952 1441748 65471 65471
ReadX 13952 1507219 63 63
ReadX 13952 1507282 65471 65471
ReadX 13952 1572753 63 63
ReadX 13952 1572816 65471 65471
ReadX 13952 1638287 63 63
ReadX 13952 1638350 65471 65471
ReadX 13952 1703821 63 63
ReadX 13952 1703884 65471 65471
ReadX 13952 1769355 63 63
ReadX 13952 1769418 65471 65471
ReadX 13952 1834889 63 63
ReadX 13952 1834952 32824 32824
Close 13952
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13953
QUERY_FILE_INFORMATION 13953
ReadX 13953 0 512 512
ReadX 13953 512 512 512
ReadX 13953 1024 512 512
QUERY_FILE_INFORMATION 13953
QUERY_FILE_INFORMATION 13953
ReadX 13953 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13953
QUERY_FILE_INFORMATION 13953
ReadX 13953 512 4096 4096
QUERY_FILE_INFORMATION 13953
QUERY_FILE_INFORMATION 13953
QUERY_FILE_INFORMATION 13953
WriteX 13953 512 4096 4096
WriteX 13953 1024 512 512
ReadX 13953 502 512 512
QUERY_FILE_INFORMATION 13953
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13953 2560 512 512
ReadX 13953 1536 512 512
ReadX 13953 2176 384 384
ReadX 13953 3072 128 128
ReadX 13953 3107 512 512
ReadX 13953 3619 512 512
ReadX 13953 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13953 286 123 123
ReadX 13953 292 24 24
ReadX 13953 512 2048 2048
ReadX 13953 512 2048 2048
ReadX 13953 2560 2048 2048
ReadX 13953 416 1536 1536
ReadX 13953 768 512 512
ReadX 13953 1280 2048 2048
ReadX 13953 3328 2048 2048
ReadX 13953 5376 2048 2048
ReadX 13953 7424 2048 2048
ReadX 13953 9472 2048 2048
ReadX 13953 11520 2048 2048
ReadX 13953 13568 2048 2048
ReadX 13953 15616 2048 2048
ReadX 13953 17664 2048 2048
ReadX 13953 19712 2048 2048
ReadX 13953 21760 2048 2048
ReadX 13953 23808 2048 2048
ReadX 13953 25856 2048 2048
ReadX 13953 27904 2048 2048
ReadX 13953 29952 2048 2048
ReadX 13953 32000 2048 2048
ReadX 13953 34048 2048 2048
ReadX 13953 36096 2048 2048
ReadX 13953 38144 2048 2048
ReadX 13953 40192 2048 2048
ReadX 13953 42240 512 512
ReadX 13953 42752 2048 2048
ReadX 13953 44800 2048 2048
ReadX 13953 46848 2048 2048
ReadX 13953 48896 2048 2048
ReadX 13953 50944 2048 2048
ReadX 13953 52992 2048 2048
ReadX 13953 55040 2048 2048
ReadX 13953 57088 2048 2048
ReadX 13953 316 2048 2048
ReadX 13953 2364 2048 2048
ReadX 13953 4412 2048 2048
ReadX 13953 6460 2048 2048
ReadX 13953 8508 2048 2048
ReadX 13953 10556 2048 2048
ReadX 13953 12604 2048 2048
ReadX 13953 14652 2048 2048
ReadX 13953 16700 2048 2048
ReadX 13953 18748 2048 2048
ReadX 13953 20796 2048 2048
ReadX 13953 22844 2048 2048
ReadX 13953 24892 2048 2048
ReadX 13953 26940 2048 2048
ReadX 13953 28988 2048 2048
ReadX 13953 31036 2048 2048
ReadX 13953 436 2048 2048
ReadX 13953 2484 2048 2048
ReadX 13953 4532 2048 2048
ReadX 13953 6580 2048 2048
ReadX 13953 8628 2048 2048
ReadX 13953 10676 2048 2048
ReadX 13953 476 2048 2048
ReadX 13953 476 2048 2048
ReadX 13953 476 2048 2048
ReadX 13953 2524 2048 2048
ReadX 13953 484 2048 2048
ReadX 13953 484 2048 2048
ReadX 13953 484 2048 2048
ReadX 13953 2532 665 665
ReadX 13953 492 665 665
ReadX 13953 492 665 665
ReadX 13953 492 665 665
ReadX 13953 296 512 512
ReadX 13953 318 512 512
ReadX 13953 300 512 512
ReadX 13953 312 512 512
ReadX 13953 320 512 512
ReadX 13953 832 354 354
ReadX 13953 504 4096 4096
ReadX 13953 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13954
Close 13954
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13955
WriteX 13955 1535 1 1
QUERY_FILE_INFORMATION 13955
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13953 296 1251 1251
ReadX 13953 2176 384 384
ReadX 13953 3072 1634 1634
QUERY_FILE_INFORMATION 13955
WriteX 13955 0 57088 57088
WriteX 13955 0 4096 4096
Flush 13955
Close 13953
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13956
Close 13956
WriteX 13955 0 4096 4096
Close 13955
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13957
Close 13957
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13958
QUERY_FILE_INFORMATION 13958
ReadX 13958 0 512 512
ReadX 13958 512 512 512
ReadX 13958 1024 512 512
QUERY_FILE_INFORMATION 13958
QUERY_FILE_INFORMATION 13958
ReadX 13958 512 2048 2048
QUERY_FILE_INFORMATION 13958
QUERY_FILE_INFORMATION 13958
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13958 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13959
WriteX 13959 1535 1 1
QUERY_FILE_INFORMATION 13959
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13958 1536 512 512
ReadX 13958 288 1251 1251
ReadX 13958 2048 2018 2018
QUERY_FILE_INFORMATION 13959
WriteX 13959 0 51456 51456
WriteX 13959 0 4096 4096
Flush 13959
QUERY_FILE_INFORMATION 13958
QUERY_FILE_INFORMATION 13958
Close 13958
WriteX 13959 0 4096 4096
Close 13959
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13960
Close 13960
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13961
QUERY_FILE_INFORMATION 13961
ReadX 13961 0 512 512
ReadX 13961 512 512 512
ReadX 13961 1024 512 512
QUERY_FILE_INFORMATION 13961
QUERY_FILE_INFORMATION 13961
ReadX 13961 512 2048 2048
QUERY_FILE_INFORMATION 13961
QUERY_FILE_INFORMATION 13961
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13961 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13963
Close 13963
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13965
WriteX 13965 4045 1 1
QUERY_FILE_INFORMATION 13965
WriteX 13965 0 53077 53077
Close 13965
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13966
WriteX 13966 1535 1 1
QUERY_FILE_INFORMATION 13966
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13961 1536 512 512
ReadX 13961 288 1251 1251
ReadX 13961 2048 2018 2018
QUERY_FILE_INFORMATION 13966
WriteX 13966 0 65471 65471
WriteX 13966 65471 65 65
WriteX 13966 65536 1856 1856
WriteX 13966 0 4096 4096
Flush 13966
QUERY_FILE_INFORMATION 13961
QUERY_FILE_INFORMATION 13961
Close 13961
WriteX 13966 0 4096 4096
Close 13966
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13967
Close 13967
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13968
QUERY_FILE_INFORMATION 13968
ReadX 13968 0 512 512
ReadX 13968 512 512 512
ReadX 13968 1024 512 512
QUERY_FILE_INFORMATION 13968
QUERY_FILE_INFORMATION 13968
ReadX 13968 576 2048 2048
QUERY_FILE_INFORMATION 13968
QUERY_FILE_INFORMATION 13968
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13970
Close 13970
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13972
WriteX 13972 4076 1 1
QUERY_FILE_INFORMATION 13972
WriteX 13972 0 7983 7983
Close 13972
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13974
Close 13974
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13976
WriteX 13976 4095 1 1
QUERY_FILE_INFORMATION 13976
WriteX 13976 0 65471 65471
WriteX 13976 65471 65 65
WriteX 13976 65536 65471 65471
WriteX 13976 131007 65 65
WriteX 13976 131072 65471 65471
WriteX 13976 196543 65 65
WriteX 13976 196608 65471 65471
WriteX 13976 262079 65 65
WriteX 13976 262144 65471 65471
WriteX 13976 327615 65 65
WriteX 13976 327680 65471 65471
WriteX 13976 393151 65 65
WriteX 13976 393216 65471 65471
WriteX 13976 458687 65 65
WriteX 13976 458752 46731 46731
Close 13976
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13977
WriteX 13977 1535 1 1
QUERY_FILE_INFORMATION 13977
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13968 1536 512 512
ReadX 13968 2048 2018 2018
ReadX 13968 4096 512 512
ReadX 13968 4608 2197 2197
QUERY_FILE_INFORMATION 13977
WriteX 13977 0 65471 65471
WriteX 13977 65471 65 65
WriteX 13977 65536 22848 22848
WriteX 13977 0 4096 4096
Flush 13977
QUERY_FILE_INFORMATION 13968
QUERY_FILE_INFORMATION 13968
Close 13968
WriteX 13977 0 4096 4096
Close 13977
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13978
Close 13978
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13979
QUERY_FILE_INFORMATION 13979
ReadX 13979 0 512 512
ReadX 13979 512 512 512
ReadX 13979 1024 512 512
QUERY_FILE_INFORMATION 13979
QUERY_FILE_INFORMATION 13979
ReadX 13979 576 2048 2048
QUERY_FILE_INFORMATION 13979
QUERY_FILE_INFORMATION 13979
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13979 4096 512 512
Close 13979
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13980
QUERY_FILE_INFORMATION 13980
ReadX 13980 0 512 512
ReadX 13980 512 512 512
ReadX 13980 1024 512 512
QUERY_FILE_INFORMATION 13980
QUERY_FILE_INFORMATION 13980
ReadX 13980 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13980
QUERY_FILE_INFORMATION 13980
ReadX 13980 288 4096 4096
QUERY_FILE_INFORMATION 13980
QUERY_FILE_INFORMATION 13980
QUERY_FILE_INFORMATION 13980
WriteX 13980 288 4096 4096
WriteX 13980 1024 512 512
ReadX 13980 1536 512 512
QUERY_FILE_INFORMATION 13980
ReadX 13980 288 2048 2048
ReadX 13980 2336 2048 2048
ReadX 13980 3072 1536 1536
ReadX 13980 544 512 512
ReadX 13980 1056 2048 2048
ReadX 13980 3104 2048 2048
ReadX 13980 5152 2048 2048
ReadX 13980 7200 2048 2048
ReadX 13980 9248 2048 2048
ReadX 13980 11296 2048 2048
ReadX 13980 13344 2048 2048
ReadX 13980 15392 2048 2048
ReadX 13980 17440 2048 2048
ReadX 13980 19488 2048 2048
ReadX 13980 21536 2048 2048
ReadX 13980 23584 2048 2048
ReadX 13980 25632 2048 2048
ReadX 13980 27680 2048 2048
ReadX 13980 29728 2048 2048
ReadX 13980 31776 2048 2048
ReadX 13980 33824 2048 2048
ReadX 13980 35872 2048 2048
ReadX 13980 37920 2048 2048
ReadX 13980 39968 2048 2048
ReadX 13980 42016 512 512
ReadX 13980 42528 512 512
ReadX 13980 43040 1536 1536
ReadX 13980 44576 2048 2048
ReadX 13980 46624 2048 2048
ReadX 13980 48672 2048 2048
ReadX 13980 50720 2048 2048
ReadX 13980 52768 2048 2048
ReadX 13980 54816 2048 2048
ReadX 13980 56864 2048 2048
ReadX 13980 58912 2048 2048
ReadX 13980 60960 2048 2048
ReadX 13980 63008 2048 2048
ReadX 13980 65056 2048 2048
ReadX 13980 67104 2048 2048
ReadX 13980 69152 2048 2048
ReadX 13980 71200 2048 2048
ReadX 13980 73248 2048 2048
ReadX 13980 75296 2048 2048
ReadX 13980 77344 2048 2048
ReadX 13980 79392 2048 2048
ReadX 13980 81440 2048 2048
ReadX 13980 83488 2048 2048
ReadX 13980 85536 512 512
ReadX 13980 86048 512 512
ReadX 13980 86560 1536 1536
ReadX 13980 88096 2048 2048
ReadX 13980 90144 2048 2048
ReadX 13980 92192 2048 2048
ReadX 13980 94240 2048 2048
ReadX 13980 96288 2048 2048
ReadX 13980 552 2048 2048
ReadX 13980 2600 2048 2048
ReadX 13980 4648 2048 2048
ReadX 13980 6696 2048 2048
ReadX 13980 8744 2048 2048
ReadX 13980 10792 2048 2048
ReadX 13980 12840 2048 2048
ReadX 13980 14888 2048 2048
ReadX 13980 16936 2048 2048
ReadX 13980 18984 2048 2048
ReadX 13980 21032 2048 2048
ReadX 13980 23080 2048 2048
ReadX 13980 25128 2048 2048
ReadX 13980 27176 2048 2048
ReadX 13980 29224 2048 2048
ReadX 13980 31272 2048 2048
ReadX 13980 33320 2048 2048
ReadX 13980 35368 2048 2048
ReadX 13980 37416 2048 2048
ReadX 13980 39464 2048 2048
ReadX 13980 41512 512 512
ReadX 13980 42024 512 512
ReadX 13980 42536 1536 1536
ReadX 13980 44072 2048 2048
ReadX 13980 46120 2048 2048
ReadX 13980 48168 2048 2048
ReadX 13980 50216 2048 2048
ReadX 13980 52264 2048 2048
ReadX 13980 54312 2048 2048
ReadX 13980 56360 2048 2048
ReadX 13980 58408 2048 2048
ReadX 13980 60456 2048 2048
ReadX 13980 62504 2048 2048
ReadX 13980 64552 2048 2048
ReadX 13980 66600 2048 2048
ReadX 13980 68648 2048 2048
ReadX 13980 70696 2048 2048
ReadX 13980 72744 2048 2048
ReadX 13980 74792 2048 2048
ReadX 13980 76840 2048 2048
ReadX 13980 78888 2048 2048
ReadX 13980 80936 2048 2048
ReadX 13980 82984 2048 2048
ReadX 13980 85032 512 512
ReadX 13980 85544 2048 2048
ReadX 13980 87592 2048 2048
ReadX 13980 89640 2048 2048
ReadX 13980 91688 2048 2048
ReadX 13980 93736 2048 2048
ReadX 13980 95784 2048 2048
ReadX 13980 97832 2048 2048
ReadX 13980 99880 2048 2048
ReadX 13980 101928 2048 2048
ReadX 13980 103976 2048 2048
ReadX 13980 106024 2048 2048
ReadX 13980 108072 2048 2048
ReadX 13980 110120 2048 2048
ReadX 13980 112168 2048 2048
ReadX 13980 114216 2048 2048
ReadX 13980 116264 2048 2048
ReadX 13980 118312 2048 2048
ReadX 13980 120360 2048 2048
ReadX 13980 122408 2048 2048
ReadX 13980 124456 512 512
ReadX 13980 124968 512 512
ReadX 13980 125480 1536 1536
ReadX 13980 127016 2048 2048
ReadX 13980 129064 2048 2048
ReadX 13980 131112 2048 2048
ReadX 13980 133160 2048 2048
ReadX 13980 135208 2048 2048
ReadX 13980 137256 2048 2048
ReadX 13980 139304 2048 2048
ReadX 13980 141352 2048 2048
ReadX 13980 143400 2048 2048
ReadX 13980 145448 2048 2048
ReadX 13980 147496 2048 2048
ReadX 13980 149544 2048 2048
ReadX 13980 151592 2048 2048
ReadX 13980 153640 2048 2048
ReadX 13980 155688 2048 2048
ReadX 13980 157736 2048 2048
ReadX 13980 159784 2048 2048
ReadX 13980 161832 2048 2048
ReadX 13980 163880 2048 2048
ReadX 13980 165928 2048 2048
ReadX 13980 167976 2048 2048
ReadX 13980 170024 512 512
ReadX 13980 1538 1536 1536
ReadX 13980 3074 2048 2048
ReadX 13980 5122 2048 2048
ReadX 13980 7170 2048 2048
ReadX 13980 9218 2048 2048
ReadX 13980 11266 2048 2048
ReadX 13980 13314 2048 2048
ReadX 13980 15362 2048 2048
ReadX 13980 17410 2048 2048
ReadX 13980 19458 2048 2048
ReadX 13980 21506 2048 2048
ReadX 13980 23554 2048 2048
ReadX 13980 25602 2048 2048
ReadX 13980 27650 2048 2048
ReadX 13980 29698 2048 2048
ReadX 13980 31746 2048 2048
ReadX 13980 33794 2048 2048
ReadX 13980 35842 2048 2048
ReadX 13980 37890 2048 2048
ReadX 13980 39938 2048 2048
ReadX 13980 41986 2048 2048
ReadX 13980 44034 875 875
ReadX 13980 1730 4096 4096
ReadX 13980 1724 1536 1536
ReadX 13980 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13981
Close 13981
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13982
WriteX 13982 2047 1 1
QUERY_FILE_INFORMATION 13982
Close 13980
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13983
Close 13983
WriteX 13982 0 42388 42388
Close 13982
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13984
Close 13984
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13985
QUERY_FILE_INFORMATION 13985
ReadX 13985 0 512 512
ReadX 13985 1756 512 512
ReadX 13985 2268 512 512
QUERY_FILE_INFORMATION 13985
QUERY_FILE_INFORMATION 13985
ReadX 13985 1744 512 512
ReadX 13985 2256 512 512
ReadX 13985 2768 512 512
ReadX 13985 3280 512 512
ReadX 13985 3792 512 512
ReadX 13985 4304 512 512
ReadX 13985 512 2048 2048
QUERY_FILE_INFORMATION 13985
QUERY_FILE_INFORMATION 13985
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13986
WriteX 13986 2047 1 1
QUERY_FILE_INFORMATION 13986
QUERY_FILE_INFORMATION 13985
QUERY_FILE_INFORMATION 13985
Close 13985
WriteX 13986 0 42652 42652
Close 13986
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13987
Close 13987
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13988
QUERY_FILE_INFORMATION 13988
ReadX 13988 0 512 512
ReadX 13988 1762 512 512
ReadX 13988 2274 512 512
QUERY_FILE_INFORMATION 13988
QUERY_FILE_INFORMATION 13988
ReadX 13988 1750 512 512
ReadX 13988 2262 512 512
ReadX 13988 2774 512 512
ReadX 13988 3286 512 512
ReadX 13988 3798 512 512
ReadX 13988 4310 512 512
ReadX 13988 512 2048 2048
QUERY_FILE_INFORMATION 13988
QUERY_FILE_INFORMATION 13988
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13990
Close 13990
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13992
WriteX 13992 4080 1 1
QUERY_FILE_INFORMATION 13992
WriteX 13992 0 65471 65471
WriteX 13992 65471 65 65
WriteX 13992 65536 49 49
Close 13992
Close 13988
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13993
WriteX 13993 0 65471 65471
WriteX 13993 65471 63 63
WriteX 13993 65534 65471 65471
WriteX 13993 131005 63 63
Close 13993
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13994
WriteX 13994 0 65471 65471
WriteX 13994 65471 63 63
WriteX 13994 65534 65471 65471
WriteX 13994 131005 63 63
WriteX 13994 131068 65471 65471
WriteX 13994 196539 63 63
WriteX 13994 196602 65471 65471
WriteX 13994 262073 63 63
Close 13994
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13995
WriteX 13995 0 65471 65471
WriteX 13995 65471 63 63
WriteX 13995 65534 65471 65471
WriteX 13995 131005 63 63
WriteX 13995 131068 65471 65471
WriteX 13995 196539 63 63
WriteX 13995 196602 65471 65471
WriteX 13995 262073 63 63
WriteX 13995 262136 65471 65471
WriteX 13995 327607 63 63
WriteX 13995 327670 65471 65471
WriteX 13995 393141 63 63
WriteX 13995 393204 65471 65471
WriteX 13995 458675 63 63
WriteX 13995 458738 65471 65471
WriteX 13995 524209 63 63
Close 13995
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13996
Close 13996
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13997
Close 13997
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14000
Close 14000
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 14002
Close 14002
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 14003
Close 14003
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14006
Close 14006
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14008
Close 14008
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14009
Close 14009
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14012
Close 14012
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14016
Close 14016
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14020
Close 14020
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14024
Close 14024
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14032
Close 14032
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14036
Close 14036
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 14040
Close 14040
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 14042
Close 14042
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14044
Close 14044
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14046
WriteX 14046 4095 1 1
QUERY_FILE_INFORMATION 14046
QUERY_FS_INFORMATION 259
WriteX 14046 0 65471 65471
WriteX 14046 65471 65 65
WriteX 14046 65536 65471 65471
WriteX 14046 131007 65 65
WriteX 14046 131072 65471 65471
WriteX 14046 196543 65 65
WriteX 14046 196608 65471 65471
WriteX 14046 262079 65 65
WriteX 14046 262144 26634 26634
Close 14046
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14051
QUERY_FILE_INFORMATION 14051
QUERY_FILE_INFORMATION 14051
Close 14051
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14052
Close 14052
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14053
Close 14053
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14054
QUERY_FILE_INFORMATION 14054
ReadX 14054 0 512 512
ReadX 14054 288 512 512
ReadX 14054 800 512 512
Close 14054
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14055
ReadX 14055 0 24 24
Close 14055
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14056
ReadX 14056 0 24 24
Close 14056
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 14057
QUERY_FILE_INFORMATION 14057
ReadX 14057 0 512 512
ReadX 14057 288 512 512
ReadX 14057 800 512 512
ReadX 14057 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 14057 1759 2849 2849
Close 14057
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14058
Close 14058
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14061
Close 14061
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14063
Close 14063
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14064
Close 14064
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14067
Close 14067
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14069
Close 14069
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14070
Close 14070
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14073
Close 14073
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14077
Close 14077
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14081
Close 14081
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14085
Close 14085
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14089
Close 14089
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14093
Close 14093
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12421
Close 12421
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12425
Close 12425
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12429
Close 12429
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12431
Close 12431
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12432
Close 12432
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12441
QUERY_FILE_INFORMATION 12441
QUERY_FILE_INFORMATION 12441
Close 12441
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12442
Close 12442
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12443
Close 12443
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12444
QUERY_FILE_INFORMATION 12444
ReadX 12444 0 512 512
ReadX 12444 288 512 512
ReadX 12444 800 512 512
Close 12444
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12445
ReadX 12445 0 24 24
Close 12445
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12446
QUERY_FILE_INFORMATION 12446
ReadX 12446 0 512 512
ReadX 12446 288 512 512
ReadX 12446 800 512 512
ReadX 12446 512 36 36
Close 12446
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12447
QUERY_FILE_INFORMATION 12447
ReadX 12447 0 512 512
ReadX 12447 288 512 512
ReadX 12447 800 512 512
ReadX 12447 512 682 682
ReadX 12447 3584 106 106
ReadX 12447 3712 10 10
ReadX 12447 3722 10 10
ReadX 12447 512 2048 2048
ReadX 12447 3072 512 512
ReadX 12447 276 84 84
ReadX 12447 273 49 49
ReadX 12447 2560 512 512
Close 12447
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12457
QUERY_FILE_INFORMATION 12457
QUERY_FILE_INFORMATION 12457
Close 12457
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12458
Close 12458
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12459
Close 12459
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12460
QUERY_FILE_INFORMATION 12460
ReadX 12460 0 512 512
ReadX 12460 288 512 512
ReadX 12460 800 512 512
Close 12460
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12461
ReadX 12461 0 24 24
Close 12461
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12462
QUERY_FILE_INFORMATION 12462
ReadX 12462 0 512 512
ReadX 12462 288 512 512
ReadX 12462 800 512 512
ReadX 12462 512 36 36
Close 12462
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12463
QUERY_FILE_INFORMATION 12463
ReadX 12463 0 512 512
ReadX 12463 288 512 512
ReadX 12463 800 512 512
ReadX 12463 512 682 682
ReadX 12463 3072 106 106
ReadX 12463 3200 10 10
ReadX 12463 3210 10 10
ReadX 12463 512 2048 2048
ReadX 12463 2560 512 512
ReadX 12463 3887 84 84
ReadX 12463 3838 49 49
ReadX 12463 2048 512 512
Close 12463
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12464
Close 12464
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12465
QUERY_FILE_INFORMATION 12465
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 12465
QUERY_FILE_INFORMATION 12465
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12466
QUERY_FILE_INFORMATION 12466
QUERY_FILE_INFORMATION 12466
QUERY_FILE_INFORMATION 12466
ReadX 12466 2156 24 24
ReadX 12466 2139 276 276
ReadX 12466 2136 14 14
ReadX 12466 2136 7 7
ReadX 12466 2138 12 12
ReadX 12466 2137 8 8
ReadX 12466 2135 15 15
ReadX 12466 0 16 16
ReadX 12466 16 2048 2048
ReadX 12466 2064 2048 2048
ReadX 12466 257 2048 2048
ReadX 12466 385 2048 2048
ReadX 12466 513 2048 2048
ReadX 12466 641 2048 2048
ReadX 12466 769 2048 2048
ReadX 12466 897 2048 2048
ReadX 12466 1025 2048 2048
ReadX 12466 1153 2048 2048
ReadX 12466 1281 2048 2048
ReadX 12466 1409 2048 2048
ReadX 12466 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12468
Close 12468
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12470
WriteX 12470 15 1 1
QUERY_FILE_INFORMATION 12470
WriteX 12470 0 10575 10575
Flush 12470
Close 12470
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12471
Close 12471
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12472
QUERY_FILE_INFORMATION 12472
QUERY_FILE_INFORMATION 12472
QUERY_FILE_INFORMATION 12472
ReadX 12472 2157 24 24
ReadX 12472 2139 276 276
ReadX 12472 2137 14 14
ReadX 12472 2137 7 7
ReadX 12472 2139 12 12
ReadX 12472 2138 8 8
ReadX 12472 2136 15 15
Close 12466
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12473
Close 12473
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12474
QUERY_FILE_INFORMATION 12474
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12475
QUERY_FILE_INFORMATION 12475
ReadX 12475 0 512 512
ReadX 12475 512 512 512
ReadX 12475 1024 512 512
QUERY_FILE_INFORMATION 12475
QUERY_FILE_INFORMATION 12475
Close 12475
QUERY_FILE_INFORMATION 12474
ReadX 12474 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12476
QUERY_FILE_INFORMATION 12476
ReadX 12476 0 512 512
ReadX 12476 512 512 512
ReadX 12476 1024 512 512
ReadX 12476 288 20 20
ReadX 12476 308 2084 2084
ReadX 12476 388 2084 2084
ReadX 12476 388 2084 2084
ReadX 12465 2157 1386 1386
ReadX 12476 2472 399 399
ReadX 12476 3072 1536 1536
ReadX 12476 544 149 149
ReadX 12476 693 485 485
Close 12476
ReadX 12465 2157 4096 4096
ReadX 12465 6253 4096 4096
ReadX 12465 10349 4096 4096
ReadX 12465 14445 4096 4096
ReadX 12465 18541 4096 4096
ReadX 12465 22637 256 256
ReadX 12465 22893 4096 4096
ReadX 12465 26989 4096 4096
ReadX 12465 31085 4096 4096
ReadX 12465 35181 4096 4096
ReadX 12465 39277 4096 4096
ReadX 12465 43373 4096 4096
ReadX 12465 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12465 2157 1024 1024
ReadX 12465 1667 4688 4688
ReadX 12465 6355 3516 3516
ReadX 12465 9871 16384 16384
ReadX 12465 26255 3771 3771
ReadX 12465 30026 2048 2048
ReadX 12465 32074 1024 1024
ReadX 12465 33098 6652 6652
ReadX 12465 39750 16384 16384
ReadX 12465 56134 10496 10496
ReadX 12465 66630 1784 1784
ReadX 12465 68414 90 90
ReadX 12465 68504 273 273
ReadX 12465 68777 1600 1600
ReadX 12465 70377 640 640
ReadX 12465 71017 1280 1280
ReadX 12465 72297 8464 8464
ReadX 12465 80761 158 158
ReadX 12465 80919 912 912
ReadX 12465 81831 1980 1980
ReadX 12465 83811 2256 2256
ReadX 12465 86067 400 400
ReadX 12465 86467 252 252
ReadX 12465 86719 42 42
ReadX 12465 86761 725 725
ReadX 12465 2009 512 512
ReadX 12465 3895 9 9
ReadX 12465 3781 46 46
ReadX 12465 4059 92 92
ReadX 12465 3781 92 92
ReadX 12465 3986 184 184
ReadX 12465 3987 16384 16384
ReadX 12465 3902 16384 16384
ReadX 12465 3781 10240 10240
ReadX 12465 3821 16384 16384
ReadX 12465 3891 935 935
ReadX 12465 4060 10240 10240
ReadX 12465 4059 184 184
ReadX 12465 256 184 184
ReadX 12465 256 1026 1026
ReadX 12465 3901 326 326
ReadX 12465 3899 652 652
ReadX 12465 256 2 2
ReadX 12465 258 4948 4948
Close 12465
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12478
Close 12478
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12480
WriteX 12480 4055 1 1
QUERY_FILE_INFORMATION 12480
WriteX 12480 0 65471 65471
WriteX 12480 65471 65 65
WriteX 12480 65536 65471 65471
WriteX 12480 131007 65 65
WriteX 12480 131072 65471 65471
WriteX 12480 196543 65 65
WriteX 12480 196608 65471 65471
WriteX 12480 262079 65 65
WriteX 12480 262144 65471 65471
WriteX 12480 327615 65 65
WriteX 12480 327680 65471 65471
WriteX 12480 393151 65 65
WriteX 12480 393216 65471 65471
WriteX 12480 458687 65 65
WriteX 12480 458752 65471 65471
WriteX 12480 524223 65 65
WriteX 12480 524288 65471 65471
WriteX 12480 589759 65 65
WriteX 12480 589824 35257 35257
Close 12480
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12482
Close 12482
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12484
WriteX 12484 4055 1 1
QUERY_FILE_INFORMATION 12484
WriteX 12484 0 65471 65471
WriteX 12484 65471 65 65
WriteX 12484 65536 65471 65471
WriteX 12484 131007 65 65
WriteX 12484 131072 65471 65471
WriteX 12484 196543 65 65
WriteX 12484 196608 65471 65471
WriteX 12484 262079 65 65
WriteX 12484 262144 65471 65471
WriteX 12484 327615 65 65
WriteX 12484 327680 65471 65471
WriteX 12484 393151 65 65
WriteX 12484 393216 65471 65471
WriteX 12484 458687 65 65
WriteX 12484 458752 65471 65471
WriteX 12484 524223 65 65
WriteX 12484 524288 65471 65471
WriteX 12484 589759 65 65
WriteX 12484 589824 57598 57598
Close 12484
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12486
WriteX 12486 15 1 1
QUERY_FILE_INFORMATION 12486
WriteX 12486 0 12543 12543
Flush 12486
Close 12486
Close 12472
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12487
Close 12487
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12488
QUERY_FILE_INFORMATION 12488
QUERY_FILE_INFORMATION 12488
QUERY_FILE_INFORMATION 12488
ReadX 12488 288 24 24
ReadX 12488 287 276 276
ReadX 12488 286 14 14
ReadX 12488 286 7 7
ReadX 12488 287 12 12
ReadX 12488 287 8 8
ReadX 12488 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12489
Close 12489
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12490
QUERY_FILE_INFORMATION 12490
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 12490
QUERY_FILE_INFORMATION 12490
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12491
QUERY_FILE_INFORMATION 12491
QUERY_FILE_INFORMATION 12491
QUERY_FILE_INFORMATION 12491
ReadX 12491 1938 24 24
ReadX 12491 1920 276 276
ReadX 12491 1918 14 14
ReadX 12491 1918 7 7
ReadX 12491 1919 12 12
ReadX 12491 1919 8 8
ReadX 12491 1917 15 15
ReadX 12491 0 16 16
ReadX 12491 16 2048 2048
ReadX 12491 2064 2048 2048
ReadX 12491 257 2048 2048
ReadX 12491 385 2048 2048
ReadX 12491 513 2048 2048
ReadX 12491 641 2048 2048
ReadX 12491 769 2048 2048
ReadX 12491 897 2048 2048
ReadX 12491 1025 2048 2048
ReadX 12491 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12493
Close 12493
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12495
WriteX 12495 15 1 1
QUERY_FILE_INFORMATION 12495
WriteX 12495 0 11588 11588
Flush 12495
Close 12495
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12496
Close 12496
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12497
QUERY_FILE_INFORMATION 12497
QUERY_FILE_INFORMATION 12497
QUERY_FILE_INFORMATION 12497
ReadX 12497 1909 24 24
ReadX 12497 1892 276 276
ReadX 12497 1889 14 14
ReadX 12497 1889 7 7
ReadX 12497 1891 12 12
ReadX 12497 1890 8 8
ReadX 12497 1888 15 15
Close 12491
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12499
WriteX 12499 15 1 1
QUERY_FILE_INFORMATION 12499
WriteX 12499 0 11615 11615
Flush 12499
Close 12499
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12497
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12500
Close 12500
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12501
QUERY_FILE_INFORMATION 12501
QUERY_FILE_INFORMATION 12501
QUERY_FILE_INFORMATION 12501
ReadX 12501 1947 24 24
ReadX 12501 1929 276 276
ReadX 12501 1927 14 14
ReadX 12501 1927 7 7
ReadX 12501 1929 12 12
ReadX 12501 1928 8 8
ReadX 12501 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12503
Close 12503
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12505
WriteX 12505 4088 1 1
QUERY_FILE_INFORMATION 12505
WriteX 12505 0 65471 65471
WriteX 12505 65471 65 65
WriteX 12505 65536 16050 16050
Close 12505
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12490 1939 64 64
ReadX 12490 128 248 248
ReadX 12490 128 568 568
ReadX 12490 3872 1536 1536
ReadX 12490 3456 2560 2560
ReadX 12490 3136 512 512
ReadX 12490 2880 4096 4096
ReadX 12490 3264 3072 3072
ReadX 12490 320 4096 4096
ReadX 12490 1024 4096 4096
ReadX 12490 3616 4096 4096
ReadX 12490 1939 64 64
ReadX 12490 128 248 248
ReadX 12490 128 608 608
ReadX 12490 2858 1024 1024
ReadX 12490 2810 4096 4096
ReadX 12490 2826 4096 4096
ReadX 12490 2580 2048 2048
ReadX 12490 2800 2560 2560
ReadX 12490 2100 4096 4096
ReadX 12490 2084 4096 4096
ReadX 12490 868 4096 4096
ReadX 12490 2324 4096 4096
ReadX 12490 884 4096 4096
ReadX 12490 2604 1024 1024
ReadX 12490 580 4096 4096
ReadX 12490 596 4096 4096
ReadX 12490 2752 4096 4096
ReadX 12490 2842 1024 1024
ReadX 12490 660 4096 4096
ReadX 12490 2720 4096 4096
ReadX 12490 2736 4096 4096
ReadX 12490 628 4096 4096
ReadX 12490 2704 4096 4096
ReadX 12490 1556 4096 4096
ReadX 12490 576 4096 4096
ReadX 12490 3168 1536 1536
ReadX 12490 832 4096 4096
ReadX 12490 1088 4096 4096
ReadX 12490 1344 4096 4096
ReadX 12490 1600 4096 4096
ReadX 12490 1856 4096 4096
ReadX 12490 2112 4096 4096
ReadX 12490 1892 4096 4096
ReadX 12490 820 4096 4096
ReadX 12490 788 4096 4096
ReadX 12490 1604 4096 4096
ReadX 12490 3648 4096 4096
ReadX 12490 2608 4096 4096
ReadX 12490 548 4096 4096
ReadX 12490 740 4096 4096
ReadX 12490 1344 4096 4096
ReadX 12490 3392 4096 4096
ReadX 12490 3904 4096 4096
ReadX 12490 644 4096 4096
ReadX 12490 676 4096 4096
ReadX 12490 2688 4096 4096
ReadX 12490 320 4096 4096
ReadX 12490 900 4096 4096
ReadX 12490 1908 4096 4096
ReadX 12490 852 4096 4096
ReadX 12490 724 4096 4096
ReadX 12490 2292 4096 4096
ReadX 12490 612 4096 4096
ReadX 12490 388 4096 4096
ReadX 12490 2368 4096 4096
ReadX 12490 2624 4096 4096
ReadX 12490 500 4096 4096
ReadX 12490 356 4096 4096
ReadX 12490 1024 4096 4096
ReadX 12490 576 4096 4096
ReadX 12490 340 4096 4096
ReadX 12490 420 4096 4096
ReadX 12490 1600 4096 4096
ReadX 12490 404 4096 4096
ReadX 12490 1428 4096 4096
ReadX 12490 2656 4096 4096
ReadX 12490 2624 4096 4096
ReadX 12490 452 4096 4096
ReadX 12490 692 4096 4096
ReadX 12490 564 4096 4096
ReadX 12490 372 4096 4096
ReadX 12490 468 4096 4096
ReadX 12490 484 4096 4096
ReadX 12490 1088 4096 4096
ReadX 12490 1924 4096 4096
ReadX 12490 2768 4096 4096
ReadX 12490 832 4096 4096
ReadX 12490 836 4096 4096
ReadX 12490 1856 4096 4096
ReadX 12490 2640 4096 4096
ReadX 12490 436 4096 4096
ReadX 12490 1828 4096 4096
ReadX 12490 804 4096 4096
ReadX 12490 1860 4096 4096
ReadX 12490 1812 4096 4096
ReadX 12490 756 4096 4096
ReadX 12490 1636 4096 4096
ReadX 12490 772 4096 4096
ReadX 12490 2036 4096 4096
ReadX 12490 1220 4096 4096
ReadX 12490 1652 4096 4096
ReadX 12490 2588 4096 4096
ReadX 12490 916 4096 4096
ReadX 12490 260 4096 4096
ReadX 12490 932 4096 4096
ReadX 12490 2624 4096 4096
ReadX 12490 308 4096 4096
ReadX 12490 292 4096 4096
ReadX 12490 1140 4096 4096
ReadX 12490 276 4096 4096
ReadX 12490 2020 4096 4096
ReadX 12490 2880 4096 4096
ReadX 12490 516 4096 4096
ReadX 12490 1844 4096 4096
ReadX 12490 1124 4096 4096
ReadX 12490 3136 4096 4096
ReadX 12490 324 4096 4096
ReadX 12490 1156 4096 4096
ReadX 12490 1172 4096 4096
ReadX 12490 2112 4096 4096
ReadX 12490 2368 4096 4096
ReadX 12490 964 4096 4096
ReadX 12490 980 4096 4096
ReadX 12490 1012 4096 4096
ReadX 12490 532 4096 4096
ReadX 12490 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12490 1620 4096 4096
ReadX 12490 1604 4096 4096
ReadX 12490 2116 4096 4096
ReadX 12490 2132 4096 4096
ReadX 12490 2148 4096 4096
ReadX 12490 2276 4096 4096
ReadX 12490 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12507
Close 12507
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12509
QUERY_FILE_INFORMATION 12474
WriteX 12509 4088 1 1
QUERY_FILE_INFORMATION 12509
QUERY_FILE_INFORMATION 12474
Close 12474
WriteX 12509 0 65471 65471
WriteX 12509 65471 65 65
WriteX 12509 65536 64850 64850
Close 12509
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12511
WriteX 12511 15 1 1
QUERY_FILE_INFORMATION 12511
ReadX 12490 2068 4096 4096
ReadX 12490 1588 4096 4096
ReadX 12490 1572 4096 4096
WriteX 12511 0 18630 18630
Flush 12511
Close 12511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12501
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12512
Close 12512
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12513
QUERY_FILE_INFORMATION 12513
QUERY_FILE_INFORMATION 12513
QUERY_FILE_INFORMATION 12513
ReadX 12513 661 24 24
ReadX 12513 659 356 356
ReadX 12513 659 14 14
ReadX 12513 659 7 7
ReadX 12513 659 12 12
ReadX 12513 659 8 8
ReadX 12513 659 15 15
ReadX 12513 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12490 612 4096 4096
ReadX 12490 564 4096 4096
ReadX 12490 1876 4096 4096
ReadX 12490 628 4096 4096
ReadX 12490 740 4096 4096
ReadX 12490 724 4096 4096
ReadX 12490 644 4096 4096
ReadX 12490 2324 4096 4096
ReadX 12490 660 4096 4096
ReadX 12490 852 4096 4096
ReadX 12490 868 4096 4096
Close 12513
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 12488
ReadX 12490 2368 4096 4096
ReadX 12490 1024 4096 4096
ReadX 12490 320 4096 4096
ReadX 12490 580 4096 4096
ReadX 12490 3136 512 512
ReadX 12490 2880 4096 4096
Close 12490
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12514
WriteX 12514 0 65471 65471
WriteX 12514 65471 63 63
WriteX 12514 65534 65471 65471
WriteX 12514 131005 63 63
Close 12514
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12515
WriteX 12515 0 65471 65471
WriteX 12515 65471 63 63
WriteX 12515 65534 65471 65471
WriteX 12515 131005 63 63
WriteX 12515 131068 65471 65471
WriteX 12515 196539 63 63
WriteX 12515 196602 65471 65471
WriteX 12515 262073 63 63
Close 12515
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12516
WriteX 12516 0 65471 65471
WriteX 12516 65471 63 63
WriteX 12516 65534 65471 65471
WriteX 12516 131005 63 63
WriteX 12516 131068 65471 65471
WriteX 12516 196539 63 63
WriteX 12516 196602 65471 65471
WriteX 12516 262073 63 63
WriteX 12516 262136 65471 65471
WriteX 12516 327607 63 63
WriteX 12516 327670 65471 65471
WriteX 12516 393141 63 63
WriteX 12516 393204 65471 65471
WriteX 12516 458675 63 63
WriteX 12516 458738 65471 65471
WriteX 12516 524209 63 63
Close 12516
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12517
Close 12517
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12518
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12518 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12519
ReadX 12519 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12520
ReadX 12520 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12521
ReadX 12521 0 511 511
ReadX 12518 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12518
Close 12519
Close 12520
Close 12521
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12522
ReadX 12522 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12523
ReadX 12523 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12524
ReadX 12524 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12525
ReadX 12525 0 511 511
ReadX 12522 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12526
FIND_FIRST \clients\client1\~dmtmp\*
Close 12526
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12527
QUERY_FILE_INFORMATION 12527
WriteX 12527 2047 1 1
QUERY_FILE_INFORMATION 12527
WriteX 12527 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12528
Close 12528
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12529
WriteX 12529 52 1 1
QUERY_FILE_INFORMATION 12529
WriteX 12529 0 53 53
WriteX 12529 53 28 28
WriteX 12529 81 4 4
WriteX 12529 85 28 28
WriteX 12529 113 38 38
WriteX 12529 151 28 28
WriteX 12529 179 2 2
WriteX 12529 181 28 28
WriteX 12529 209 3 3
WriteX 12529 212 279 279
WriteX 12529 9 4 4
Close 12529
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12530
ReadX 12530 0 53 53
ReadX 12530 53 28 28
ReadX 12530 81 4 4
ReadX 12530 85 28 28
ReadX 12530 113 38 38
ReadX 12530 151 28 28
ReadX 12530 179 2 2
ReadX 12530 181 28 28
ReadX 12530 209 3 3
Close 12530
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12522
Close 12523
Close 12524
Close 12525
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12531
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12532
ReadX 12532 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12533
ReadX 12533 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12534
ReadX 12534 0 511 511
ReadX 12531 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12536
Close 12536
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12537
WriteX 12537 52 1 1
QUERY_FILE_INFORMATION 12537
WriteX 12537 0 53 53
WriteX 12537 53 28 28
WriteX 12537 81 28 28
WriteX 12537 109 28 28
WriteX 12537 137 28 28
WriteX 12537 165 28 28
WriteX 12537 193 28 28
WriteX 12537 221 28 28
WriteX 12537 249 4 4
WriteX 12537 253 4 4
WriteX 12537 257 4 4
WriteX 12537 261 28 28
WriteX 12537 289 2 2
WriteX 12537 291 2 2
WriteX 12537 293 2 2
WriteX 12537 295 248 248
WriteX 12537 9 4 4
Close 12537
Close 12531
Close 12532
Close 12533
Close 12534
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12538
ReadX 12538 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12539
ReadX 12539 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12540
ReadX 12540 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12541
ReadX 12541 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12542
ReadX 12542 0 53 53
ReadX 12542 53 28 28
ReadX 12542 81 28 28
ReadX 12542 109 28 28
ReadX 12542 137 28 28
ReadX 12542 165 28 28
ReadX 12542 193 28 28
ReadX 12542 221 28 28
ReadX 12542 249 4 4
ReadX 12542 253 4 4
ReadX 12542 257 4 4
ReadX 12542 261 28 28
ReadX 12542 289 2 2
ReadX 12542 291 2 2
ReadX 12542 293 2 2
Close 12542
ReadX 12538 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12538
Close 12539
Close 12540
Close 12541
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12543
Close 12543
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12544
ReadX 12544 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12545
ReadX 12545 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12546
ReadX 12546 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12547
ReadX 12547 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12548
ReadX 12548 0 53 53
ReadX 12548 53 28 28
ReadX 12548 81 28 28
ReadX 12548 109 28 28
ReadX 12548 137 28 28
ReadX 12548 165 28 28
ReadX 12548 193 28 28
ReadX 12548 221 28 28
ReadX 12548 249 4 4
ReadX 12548 253 4 4
ReadX 12548 257 4 4
ReadX 12548 261 28 28
ReadX 12548 289 2 2
ReadX 12548 291 2 2
ReadX 12548 293 2 2
Close 12548
ReadX 12544 2048 2048 2048
Close 12544
Close 12545
Close 12546
Close 12547
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12549
ReadX 12549 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12550
ReadX 12550 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12551
ReadX 12551 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12552
ReadX 12552 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12553
ReadX 12553 0 53 53
ReadX 12553 53 28 28
ReadX 12553 81 28 28
ReadX 12553 109 28 28
ReadX 12553 137 28 28
ReadX 12553 165 28 28
ReadX 12553 193 28 28
ReadX 12553 221 28 28
ReadX 12553 249 4 4
ReadX 12553 253 4 4
ReadX 12553 257 4 4
ReadX 12553 261 28 28
ReadX 12553 289 2 2
ReadX 12553 291 2 2
ReadX 12553 293 2 2
Close 12553
ReadX 12549 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12557
FIND_FIRST \clients\client1\~dmtmp\*
Close 12557
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12558
QUERY_FILE_INFORMATION 12558
WriteX 12558 2047 1 1
QUERY_FILE_INFORMATION 12558
WriteX 12558 0 2048 2048
Close 12558
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12559
ReadX 12559 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12559
Close 12549
Close 12550
Close 12551
Close 12552
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12560
ReadX 12560 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12560 4095 1 1
QUERY_FILE_INFORMATION 12560
WriteX 12560 2048 2048 2048
QUERY_FILE_INFORMATION 12560
Flush 12560
WriteX 12560 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12561
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12561 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12562
ReadX 12562 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12563
ReadX 12563 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12564
ReadX 12564 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12565
ReadX 12565 0 53 53
ReadX 12565 53 28 28
ReadX 12565 81 28 28
ReadX 12565 109 28 28
ReadX 12565 137 28 28
ReadX 12565 165 28 28
ReadX 12565 193 28 28
ReadX 12565 221 28 28
ReadX 12565 249 4 4
ReadX 12565 253 4 4
ReadX 12565 257 4 4
ReadX 12565 261 28 28
ReadX 12565 289 2 2
ReadX 12565 291 2 2
ReadX 12565 293 2 2
Close 12565
ReadX 12561 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12569
FIND_FIRST \clients\client1\~dmtmp\*
Close 12569
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12570
QUERY_FILE_INFORMATION 12570
WriteX 12570 2047 1 1
QUERY_FILE_INFORMATION 12570
WriteX 12570 0 2048 2048
Close 12570
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12571
ReadX 12571 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12575
Close 12575
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12576
QUERY_FILE_INFORMATION 12576
WriteX 12576 2047 1 1
QUERY_FILE_INFORMATION 12576
WriteX 12576 0 2048 2048
Close 12576
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12577
ReadX 12577 0 511 511
ReadX 12561 384 2048 2048
ReadX 12561 768 16384 16384
ReadX 12561 1792 14336 14336
Close 12577
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12578
ReadX 12578 0 511 511
Close 12578
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12580
Close 12580
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12571 4095 1 1
QUERY_FILE_INFORMATION 12571
WriteX 12571 2048 2048 2048
WriteX 12571 0 88 88
Close 12571
WriteX 12561 1152 2048 2048
WriteX 12561 1408 6144 6144
WriteX 12561 1920 2048 2048
WriteX 12561 0 88 88
Close 12561
WriteX 12562 0 88 88
Close 12562
WriteX 12563 0 88 88
Close 12563
Close 12564
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12581
ReadX 12581 0 511 511
ReadX 12581 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12581
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12582
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12582 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12583
ReadX 12583 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12584
ReadX 12584 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12585
ReadX 12585 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12586
ReadX 12586 0 53 53
ReadX 12586 53 28 28
ReadX 12586 81 28 28
ReadX 12586 109 28 28
ReadX 12586 137 28 28
ReadX 12586 165 28 28
ReadX 12586 193 28 28
ReadX 12586 221 28 28
ReadX 12586 249 4 4
ReadX 12586 253 4 4
ReadX 12586 257 4 4
ReadX 12586 261 28 28
ReadX 12586 289 2 2
ReadX 12586 291 2 2
ReadX 12586 293 2 2
Close 12586
ReadX 12582 2048 2048 2048
Close 12582
Close 12583
Close 12584
Close 12585
Close 12560
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12587
QUERY_FILE_INFORMATION 12587
Close 12587
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12588
Close 12588
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12589
ReadX 12589 0 511 511
ReadX 12589 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12590
ReadX 12590 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12591
ReadX 12591 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12592
ReadX 12592 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12593
ReadX 12593 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12594
ReadX 12594 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12595
ReadX 12595 0 53 53
ReadX 12595 53 2 2
ReadX 12595 55 2 2
ReadX 12595 57 184 184
ReadX 12595 241 298 298
Close 12595
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12596
ReadX 12596 0 41 41
ReadX 12589 2048 2048 2048
Close 12596
Close 12589
Close 12590
Close 12593
Close 12594
Close 12591
Close 12592
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12597
ReadX 12597 0 511 511
ReadX 12597 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12598
ReadX 12598 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12599
ReadX 12599 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12600
ReadX 12600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12601
ReadX 12601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12602
ReadX 12602 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12603
ReadX 12603 0 53 53
ReadX 12603 53 2 2
ReadX 12603 55 2 2
ReadX 12603 57 184 184
ReadX 12603 241 298 298
Close 12603
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12604
ReadX 12604 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12605
ReadX 12605 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12606
ReadX 12606 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12607
ReadX 12607 0 511 511
ReadX 12606 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12608
ReadX 12608 0 53 53
ReadX 12608 53 2 2
ReadX 12608 55 480 480
ReadX 12608 535 2 2
Close 12608
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12609
ReadX 12609 0 41 41
ReadX 12597 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12613
FIND_FIRST \clients\client1\~dmtmp\*
Close 12613
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12614
QUERY_FILE_INFORMATION 12614
WriteX 12614 2047 1 1
QUERY_FILE_INFORMATION 12614
WriteX 12614 0 2048 2048
Close 12614
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12615
ReadX 12615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12615
Close 12604
Close 12605
Close 12606
Close 12607
Close 12609
Close 12597
Close 12598
Close 12601
Close 12602
Close 12599
Close 12600
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12616
ReadX 12616 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12617
Close 12617
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12618
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12618 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12619
ReadX 12619 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12620
ReadX 12620 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12621
ReadX 12621 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12622
ReadX 12622 0 53 53
ReadX 12622 53 2 2
ReadX 12622 55 480 480
ReadX 12622 535 2 2
Close 12622
ReadX 12618 2048 2048 2048
Close 12618
Close 12619
Close 12620
Close 12621
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12623
ReadX 12623 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12624
ReadX 12624 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12625
ReadX 12625 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12626
ReadX 12626 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12627
ReadX 12627 0 53 53
ReadX 12627 53 2 2
ReadX 12627 55 480 480
ReadX 12627 535 2 2
Close 12627
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12628
ReadX 12628 0 511 511
ReadX 12628 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12629
ReadX 12629 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12630
ReadX 12630 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12631
ReadX 12631 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12632
ReadX 12632 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12633
ReadX 12633 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12634
ReadX 12634 0 41 41
ReadX 12628 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12635
ReadX 12635 0 53 53
ReadX 12635 53 2 2
ReadX 12635 55 2 2
ReadX 12635 57 184 184
ReadX 12635 241 298 298
Close 12635
ReadX 12623 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12639
FIND_FIRST \clients\client1\~dmtmp\*
Close 12639
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12640
QUERY_FILE_INFORMATION 12640
WriteX 12640 2047 1 1
QUERY_FILE_INFORMATION 12640
WriteX 12640 0 2048 2048
Close 12640
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12641
ReadX 12641 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12641
Close 12634
Close 12628
Close 12629
Close 12632
Close 12633
Close 12630
Close 12631
Close 12623
Close 12624
Close 12625
Close 12626
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12642
ReadX 12642 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12616 4095 1 1
QUERY_FILE_INFORMATION 12616
WriteX 12616 2048 2048 2048
QUERY_FILE_INFORMATION 12616
Flush 12616
WriteX 12616 0 88 88
WriteX 12642 4095 1 1
QUERY_FILE_INFORMATION 12642
WriteX 12642 2048 2048 2048
QUERY_FILE_INFORMATION 12642
Flush 12642
WriteX 12642 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12643
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12643 0 511 511
ReadX 12643 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12644
ReadX 12644 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12645
ReadX 12645 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12646
ReadX 12646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12647
ReadX 12647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12648
ReadX 12648 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12649
ReadX 12649 0 53 53
ReadX 12649 53 2 2
ReadX 12649 55 2 2
ReadX 12649 57 184 184
ReadX 12649 241 298 298
Close 12649
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12650
ReadX 12650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12651
ReadX 12651 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12652
ReadX 12652 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12653
ReadX 12653 0 511 511
ReadX 12652 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12654
ReadX 12654 0 53 53
ReadX 12654 53 2 2
ReadX 12654 55 480 480
ReadX 12654 535 2 2
Close 12654
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12655
ReadX 12655 0 41 41
ReadX 12643 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12656
ReadX 12656 0 53 53
ReadX 12656 53 2 2
ReadX 12656 55 480 480
ReadX 12656 535 2 2
Close 12656
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12657
ReadX 12657 0 53 53
ReadX 12657 53 2 2
ReadX 12657 55 2 2
ReadX 12657 57 184 184
ReadX 12657 241 298 298
Close 12657
ReadX 12650 2048 2048 2048
ReadX 12651 2048 2048 2048
ReadX 12650 320 16384 16384
ReadX 12650 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12658
FIND_FIRST \clients\client1\~dmtmp\*
Close 12658
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12659
QUERY_FILE_INFORMATION 12659
WriteX 12659 4095 1 1
QUERY_FILE_INFORMATION 12659
WriteX 12659 0 4096 4096
Close 12659
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12660
ReadX 12660 0 41 41
Close 12650
Close 12651
Close 12652
Close 12653
Close 12655
Close 12643
Close 12644
Close 12647
Close 12648
Close 12645
Close 12646
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12661
Close 12661
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12662
QUERY_FILE_INFORMATION 12662
WriteX 12662 4095 1 1
QUERY_FILE_INFORMATION 12662
WriteX 12662 0 4096 4096
Close 12662
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12663
ReadX 12663 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 12660
ReadX 12660 0 4096 4096
WriteX 12663 0 4096 4096
Close 12663
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12665
ReadX 12665 0 41 41
Close 12660
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12665
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12666
Close 12666
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12667
ReadX 12667 0 41 41
Close 12667
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12668
Close 12668
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12669
QUERY_FILE_INFORMATION 12669
WriteX 12669 2047 1 1
QUERY_FILE_INFORMATION 12669
WriteX 12669 0 2048 2048
Close 12669
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12670
ReadX 12670 0 511 511
ReadX 12670 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12671
ReadX 12671 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12671
Close 12670
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12672
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12672 0 511 511
ReadX 12672 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12673
ReadX 12673 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12674
ReadX 12674 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12675
ReadX 12675 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12676
ReadX 12676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12677
ReadX 12677 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12678
ReadX 12678 0 53 53
ReadX 12678 53 2 2
ReadX 12678 55 2 2
ReadX 12678 57 184 184
ReadX 12678 241 298 298
Close 12678
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12679
ReadX 12679 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12680
ReadX 12680 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12681
ReadX 12681 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12682
ReadX 12682 0 511 511
ReadX 12681 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12683
ReadX 12683 0 53 53
ReadX 12683 53 2 2
ReadX 12683 55 480 480
ReadX 12683 535 2 2
Close 12683
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12684
ReadX 12684 0 41 41
ReadX 12672 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12685
ReadX 12685 0 53 53
ReadX 12685 53 2 2
ReadX 12685 55 480 480
ReadX 12685 535 2 2
Close 12685
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12686
ReadX 12686 0 53 53
ReadX 12686 53 2 2
ReadX 12686 55 2 2
ReadX 12686 57 184 184
ReadX 12686 241 298 298
Close 12686
ReadX 12679 2048 2048 2048
Close 12679
Close 12680
Close 12681
Close 12682
Close 12684
Close 12672
Close 12673
Close 12676
Close 12677
Close 12674
Close 12675
Close 12616
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12687
QUERY_FILE_INFORMATION 12687
Close 12687
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12642
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12688
QUERY_FILE_INFORMATION 12688
Close 12688
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12689
Close 12689
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12690
ReadX 12690 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12691
ReadX 12691 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12692
ReadX 12692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12693
ReadX 12693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12694
ReadX 12694 0 53 53
ReadX 12694 53 2 2
ReadX 12694 55 480 480
ReadX 12694 535 2 2
Close 12694
ReadX 12690 2048 2048 2048
Close 12690
Close 12691
Close 12692
Close 12693
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12695
ReadX 12695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12696
ReadX 12696 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12697
ReadX 12697 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12698
ReadX 12698 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12699
ReadX 12699 0 53 53
ReadX 12699 53 2 2
ReadX 12699 55 480 480
ReadX 12699 535 2 2
Close 12699
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12700
ReadX 12700 0 511 511
ReadX 12700 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12701
ReadX 12701 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12702
ReadX 12702 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12703
ReadX 12703 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12704
ReadX 12704 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12705
ReadX 12705 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12706
ReadX 12706 0 41 41
ReadX 12700 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12707
ReadX 12707 0 53 53
ReadX 12707 53 2 2
ReadX 12707 55 2 2
ReadX 12707 57 184 184
ReadX 12707 241 298 298
Close 12707
ReadX 12695 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12711
FIND_FIRST \clients\client1\~dmtmp\*
Close 12711
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12712
QUERY_FILE_INFORMATION 12712
WriteX 12712 2047 1 1
QUERY_FILE_INFORMATION 12712
WriteX 12712 0 2048 2048
Close 12712
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12713
ReadX 12713 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12713
Close 12706
Close 12700
Close 12701
Close 12704
Close 12705
Close 12702
Close 12703
Close 12695
Close 12696
Close 12697
Close 12698
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12714
ReadX 12714 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
Close 12715
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12716
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12717
ReadX 12717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12718
ReadX 12718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12719
ReadX 12719 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12720
ReadX 12720 0 53 53
ReadX 12720 53 28 28
ReadX 12720 81 28 28
ReadX 12720 109 28 28
ReadX 12720 137 28 28
ReadX 12720 165 28 28
ReadX 12720 193 28 28
ReadX 12720 221 28 28
ReadX 12720 249 4 4
ReadX 12720 253 4 4
ReadX 12720 257 4 4
ReadX 12720 261 28 28
ReadX 12720 289 2 2
ReadX 12720 291 2 2
ReadX 12720 293 2 2
Close 12720
ReadX 12716 2048 2048 2048
Close 12716
Close 12717
Close 12718
Close 12719
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12721
ReadX 12721 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12722
ReadX 12722 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12723
ReadX 12723 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12724
ReadX 12724 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12725
ReadX 12725 0 53 53
ReadX 12725 53 28 28
ReadX 12725 81 28 28
ReadX 12725 109 28 28
ReadX 12725 137 28 28
ReadX 12725 165 28 28
ReadX 12725 193 28 28
ReadX 12725 221 28 28
ReadX 12725 249 4 4
ReadX 12725 253 4 4
ReadX 12725 257 4 4
ReadX 12725 261 28 28
ReadX 12725 289 2 2
ReadX 12725 291 2 2
ReadX 12725 293 2 2
Close 12725
ReadX 12721 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12729
FIND_FIRST \clients\client1\~dmtmp\*
Close 12729
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12730
QUERY_FILE_INFORMATION 12730
WriteX 12730 2047 1 1
QUERY_FILE_INFORMATION 12730
WriteX 12730 0 2048 2048
Close 12730
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12731
ReadX 12731 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12731
Close 12721
Close 12722
Close 12723
Close 12724
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12732
ReadX 12732 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12733
Close 12733
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12734
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12734 0 511 511
ReadX 12734 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12735
ReadX 12735 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12736
ReadX 12736 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12737
ReadX 12737 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12738
ReadX 12738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12739
ReadX 12739 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12740
ReadX 12740 0 53 53
ReadX 12740 53 2 2
ReadX 12740 55 2 2
ReadX 12740 57 184 184
ReadX 12740 241 298 298
Close 12740
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12741
ReadX 12741 0 41 41
ReadX 12734 2048 2048 2048
Close 12741
Close 12734
Close 12735
Close 12738
Close 12739
Close 12736
Close 12737
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12742
ReadX 12742 0 511 511
ReadX 12742 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12743
ReadX 12743 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12744
ReadX 12744 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12745
ReadX 12745 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12746
ReadX 12746 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12747
ReadX 12747 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12748
ReadX 12748 0 53 53
ReadX 12748 53 2 2
ReadX 12748 55 2 2
ReadX 12748 57 184 184
ReadX 12748 241 298 298
Close 12748
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12749
ReadX 12749 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12750
ReadX 12750 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12751
ReadX 12751 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12752
ReadX 12752 0 511 511
ReadX 12751 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12753
ReadX 12753 0 53 53
ReadX 12753 53 2 2
ReadX 12753 55 480 480
ReadX 12753 535 2 2
Close 12753
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12754
ReadX 12754 0 41 41
ReadX 12742 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12758
FIND_FIRST \clients\client1\~dmtmp\*
Close 12758
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12759
QUERY_FILE_INFORMATION 12759
WriteX 12759 2047 1 1
QUERY_FILE_INFORMATION 12759
WriteX 12759 0 2048 2048
Close 12759
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12760
ReadX 12760 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12760
Close 12749
Close 12750
Close 12751
Close 12752
Close 12754
Close 12742
Close 12743
Close 12746
Close 12747
Close 12744
Close 12745
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12761
ReadX 12761 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12714 4095 1 1
QUERY_FILE_INFORMATION 12714
WriteX 12714 2048 2048 2048
QUERY_FILE_INFORMATION 12714
Flush 12714
WriteX 12714 0 88 88
WriteX 12732 4095 1 1
QUERY_FILE_INFORMATION 12732
WriteX 12732 2048 2048 2048
QUERY_FILE_INFORMATION 12732
Flush 12732
WriteX 12732 0 88 88
WriteX 12761 4095 1 1
QUERY_FILE_INFORMATION 12761
WriteX 12761 2048 2048 2048
QUERY_FILE_INFORMATION 12761
Flush 12761
WriteX 12761 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12762
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12762 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12763
ReadX 12763 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12764
ReadX 12764 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12765
ReadX 12765 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12766
ReadX 12766 0 53 53
ReadX 12766 53 2 2
ReadX 12766 55 480 480
ReadX 12766 535 2 2
Close 12766
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12767
ReadX 12767 0 511 511
ReadX 12767 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12768
ReadX 12768 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12769
ReadX 12769 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12770
ReadX 12770 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12771
ReadX 12771 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12772
ReadX 12772 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12773
ReadX 12773 0 41 41
ReadX 12767 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12774
ReadX 12774 0 53 53
ReadX 12774 53 2 2
ReadX 12774 55 2 2
ReadX 12774 57 184 184
ReadX 12774 241 298 298
Close 12774
ReadX 12762 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12775
ReadX 12775 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12776
ReadX 12776 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12777
ReadX 12777 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12778
ReadX 12778 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12779
ReadX 12779 0 53 53
ReadX 12779 53 28 28
ReadX 12779 81 28 28
ReadX 12779 109 28 28
ReadX 12779 137 28 28
ReadX 12779 165 28 28
ReadX 12779 193 28 28
ReadX 12779 221 28 28
ReadX 12779 249 4 4
ReadX 12779 253 4 4
ReadX 12779 257 4 4
ReadX 12779 261 28 28
ReadX 12779 289 2 2
ReadX 12779 291 2 2
ReadX 12779 293 2 2
Close 12779
ReadX 12775 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12780
ReadX 12780 0 53 53
ReadX 12780 53 2 2
ReadX 12780 55 2 2
ReadX 12780 57 184 184
ReadX 12780 241 298 298
Close 12780
ReadX 12764 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12781
ReadX 12781 0 53 53
ReadX 12781 53 2 2
ReadX 12781 55 480 480
ReadX 12781 535 2 2
Close 12781
ReadX 12775 4096 16384 16384
ReadX 12775 1280 16384 16384
ReadX 12775 2304 6144 6144
ReadX 12775 2688 2048 2048
ReadX 12762 4096 16384 16384
ReadX 12762 1280 16384 16384
ReadX 12762 2304 16384 16384
ReadX 12762 3328 16384 16384
ReadX 12762 272 16384 16384
ReadX 12762 336 16384 16384
ReadX 12762 400 16384 16384
ReadX 12762 464 16384 16384
ReadX 12762 528 16384 16384
ReadX 12762 592 16384 16384
ReadX 12762 656 16384 16384
ReadX 12762 720 16384 16384
ReadX 12762 784 16384 16384
ReadX 12762 848 16384 16384
ReadX 12762 912 16384 16384
ReadX 12768 2048 2048 2048
ReadX 12767 760 2048 2048
ReadX 12767 1144 2048 2048
ReadX 12767 408 2048 2048
ReadX 12767 912 2048 2048
ReadX 12767 1096 2048 2048
ReadX 12767 776 2048 2048
ReadX 12767 560 2048 2048
ReadX 12767 376 2048 2048
ReadX 12767 320 2048 2048
ReadX 12767 3072 2048 2048
ReadX 12767 784 2048 2048
ReadX 12767 2176 2048 2048
ReadX 12767 792 2048 2048
ReadX 12767 576 2048 2048
ReadX 12767 600 2048 2048
ReadX 12767 728 2048 2048
ReadX 12767 1112 2048 2048
ReadX 12767 664 2048 2048
ReadX 12767 976 2048 2048
ReadX 12767 3840 2048 2048
ReadX 12767 296 2048 2048
ReadX 12767 480 2048 2048
ReadX 12767 680 2048 2048
ReadX 12767 696 2048 2048
ReadX 12767 832 2048 2048
ReadX 12767 1016 2048 2048
ReadX 12767 1104 2048 2048
ReadX 12767 3200 2048 2048
ReadX 12767 264 2048 2048
ReadX 12767 448 2048 2048
ReadX 12767 648 2048 2048
ReadX 12767 1136 2048 2048
ReadX 12767 288 2048 2048
ReadX 12767 352 2048 2048
ReadX 12767 536 2048 2048
ReadX 12767 800 2048 2048
ReadX 12767 736 2048 2048
ReadX 12767 392 2048 2048
ReadX 12767 752 2048 2048
ReadX 12767 880 2048 2048
ReadX 12767 1064 2048 2048
ReadX 12767 1128 2048 2048
ReadX 12767 1536 2048 2048
ReadX 12767 2432 2048 2048
ReadX 12767 688 2048 2048
ReadX 12767 872 2048 2048
ReadX 12767 1072 2048 2048
ReadX 12767 984 2048 2048
ReadX 12767 704 2048 2048
ReadX 12767 3328 2048 2048
ReadX 12767 888 2048 2048
ReadX 12767 496 2048 2048
ReadX 12767 624 2048 2048
ReadX 12767 808 2048 2048
ReadX 12767 1008 2048 2048
ReadX 12767 1152 2048 2048
ReadX 12767 416 2048 2048
ReadX 12767 584 2048 2048
ReadX 12767 384 2048 2048
ReadX 12767 568 2048 2048
ReadX 12767 512 2048 2048
ReadX 12767 1408 2048 2048
ReadX 12767 472 2048 2048
ReadX 12767 672 2048 2048
ReadX 12767 2560 2048 2048
ReadX 12767 544 2048 2048
ReadX 12767 920 2048 2048
ReadX 12767 1120 2048 2048
ReadX 12767 2304 2048 2048
ReadX 12767 1080 2048 2048
ReadX 12767 1664 2048 2048
ReadX 12767 608 2048 2048
ReadX 12767 2688 2048 2048
ReadX 12767 3712 2048 2048
ReadX 12767 616 2048 2048
ReadX 12767 632 2048 2048
ReadX 12767 944 2048 2048
ReadX 12767 856 2048 2048
ReadX 12767 768 2048 2048
ReadX 12767 720 2048 2048
ReadX 12767 640 2048 2048
ReadX 12767 1048 2048 2048
ReadX 12767 1040 2048 2048
ReadX 12767 1032 2048 2048
ReadX 12767 1000 2048 2048
ReadX 12767 992 2048 2048
ReadX 12767 968 2048 2048
ReadX 12767 952 2048 2048
ReadX 12767 1056 2048 2048
ReadX 12767 816 2048 2048
ReadX 12767 864 2048 2048
ReadX 12767 2816 2048 2048
ReadX 12767 640 2048 2048
ReadX 12767 1024 2048 2048
ReadX 12767 504 2048 2048
ReadX 12767 424 2048 2048
ReadX 12767 840 2048 2048
ReadX 12767 896 2048 2048
ReadX 12767 520 2048 2048
ReadX 12767 960 2048 2048
ReadX 12767 552 2048 2048
ReadX 12767 488 2048 2048
ReadX 12767 824 2048 2048
ReadX 12767 304 2048 2048
ReadX 12767 768 2048 2048
ReadX 12767 712 2048 2048
ReadX 12767 512 2048 2048
ReadX 12767 432 2048 2048
ReadX 12767 384 2048 2048
ReadX 12767 2944 2048 2048
ReadX 12767 1088 2048 2048
ReadX 12767 928 2048 2048
ReadX 12767 280 2048 2048
ReadX 12767 744 2048 2048
ReadX 12767 3968 2048 2048
ReadX 12767 336 2048 2048
ReadX 12767 592 2048 2048
ReadX 12767 312 2048 2048
ReadX 12767 400 2048 2048
ReadX 12767 904 2048 2048
ReadX 12767 464 2048 2048
ReadX 12767 3456 2048 2048
ReadX 12767 848 2048 2048
ReadX 12767 936 2048 2048
ReadX 12767 656 2048 2048
ReadX 12767 344 2048 2048
ReadX 12767 440 2048 2048
ReadX 12767 4096 2048 2048
ReadX 12767 528 2048 2048
ReadX 12767 2048 2048 2048
ReadX 12767 1024 2048 2048
ReadX 12767 456 2048 2048
ReadX 12767 1792 2048 2048
ReadX 12767 1152 2048 2048
ReadX 12767 3584 2048 2048
ReadX 12767 1920 2048 2048
ReadX 12767 1280 2048 2048
ReadX 12767 896 2048 2048
ReadX 12767 328 2048 2048
Close 12775
Close 12776
Close 12777
Close 12778
Close 12773
Close 12767
Close 12768
Close 12771
Close 12772
Close 12769
Close 12770
Close 12762
Close 12763
Close 12764
Close 12765
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12782
FIND_FIRST \clients\client1\~dmtmp\*
Close 12782
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12783
QUERY_FILE_INFORMATION 12783
WriteX 12783 0 2048 2048
WriteX 12783 18431 1 1
QUERY_FILE_INFORMATION 12783
WriteX 12783 2048 16384 16384
WriteX 12783 1152 16384 16384
WriteX 12783 2176 16384 16384
WriteX 12783 3200 16384 16384
WriteX 12783 264 16384 16384
WriteX 12783 328 16384 16384
WriteX 12783 392 16384 16384
WriteX 12783 456 16384 16384
WriteX 12783 520 16384 16384
WriteX 12783 584 16384 16384
WriteX 12783 648 16384 16384
WriteX 12783 712 16384 16384
WriteX 12783 776 16384 16384
WriteX 12783 840 16384 16384
WriteX 12783 904 16384 16384
WriteX 12783 968 16384 16384
WriteX 12783 1032 16384 16384
WriteX 12783 1096 16384 16384
WriteX 12783 1160 16384 16384
WriteX 12783 1224 16384 16384
WriteX 12783 1288 16384 16384
WriteX 12783 1352 16384 16384
WriteX 12783 1416 16384 16384
WriteX 12783 1480 16384 16384
WriteX 12783 1544 16384 16384
WriteX 12783 1608 16384 16384
WriteX 12783 1672 16384 16384
WriteX 12783 1736 16384 16384
WriteX 12783 1800 16384 16384
WriteX 12783 1864 16384 16384
WriteX 12783 1928 16384 16384
WriteX 12783 1992 16384 16384
WriteX 12783 2056 16384 16384
WriteX 12783 2120 16384 16384
WriteX 12783 2184 16384 16384
WriteX 12783 2248 16384 16384
WriteX 12783 2312 16384 16384
WriteX 12783 2376 16384 16384
WriteX 12783 2440 16384 16384
WriteX 12783 0 88 88
Close 12783
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12784
ReadX 12784 0 511 511
ReadX 12784 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12784
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12785
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12785 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12786
ReadX 12786 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12787
ReadX 12787 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12788
ReadX 12788 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12789
ReadX 12789 0 53 53
ReadX 12789 53 2 2
ReadX 12789 55 480 480
ReadX 12789 535 2 2
Close 12789
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12790
ReadX 12790 0 511 511
ReadX 12790 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12791
ReadX 12791 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12792
ReadX 12792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12793
ReadX 12793 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12794
ReadX 12794 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12795
ReadX 12795 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12796
ReadX 12796 0 41 41
ReadX 12790 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12797
ReadX 12797 0 53 53
ReadX 12797 53 2 2
ReadX 12797 55 2 2
ReadX 12797 57 184 184
ReadX 12797 241 298 298
Close 12797
ReadX 12785 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12798
ReadX 12798 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12799
ReadX 12799 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12800
ReadX 12800 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12801
ReadX 12801 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12802
ReadX 12802 0 53 53
ReadX 12802 53 28 28
ReadX 12802 81 28 28
ReadX 12802 109 28 28
ReadX 12802 137 28 28
ReadX 12802 165 28 28
ReadX 12802 193 28 28
ReadX 12802 221 28 28
ReadX 12802 249 4 4
ReadX 12802 253 4 4
ReadX 12802 257 4 4
ReadX 12802 261 28 28
ReadX 12802 289 2 2
ReadX 12802 291 2 2
ReadX 12802 293 2 2
Close 12802
ReadX 12798 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12803
ReadX 12803 0 53 53
ReadX 12803 53 2 2
ReadX 12803 55 2 2
ReadX 12803 57 184 184
ReadX 12803 241 298 298
Close 12803
ReadX 12787 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12804
ReadX 12804 0 53 53
ReadX 12804 53 2 2
ReadX 12804 55 480 480
ReadX 12804 535 2 2
Close 12804
Close 12798
Close 12799
Close 12800
Close 12801
Close 12796
Close 12790
Close 12791
Close 12794
Close 12795
Close 12792
Close 12793
Close 12785
Close 12786
Close 12787
Close 12788
Close 12714
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12805
QUERY_FILE_INFORMATION 12805
Close 12805
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12732
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12806
QUERY_FILE_INFORMATION 12806
Close 12806
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12761
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12807
QUERY_FILE_INFORMATION 12807
Close 12807
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12808
Close 12808
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12809
ReadX 12809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12810
ReadX 12810 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12811
ReadX 12811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12812
ReadX 12812 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12813
ReadX 12813 0 53 53
ReadX 12813 53 28 28
ReadX 12813 81 28 28
ReadX 12813 109 28 28
ReadX 12813 137 28 28
ReadX 12813 165 28 28
ReadX 12813 193 28 28
ReadX 12813 221 28 28
ReadX 12813 249 4 4
ReadX 12813 253 4 4
ReadX 12813 257 4 4
ReadX 12813 261 28 28
ReadX 12813 289 2 2
ReadX 12813 291 2 2
ReadX 12813 293 2 2
Close 12813
ReadX 12809 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12809 384 2048 2048
ReadX 12809 768 16384 16384
ReadX 12809 1792 14336 14336
ReadX 12812 2048 2048 2048
ReadX 12811 2048 2048 2048
WriteX 12809 1152 2048 2048
WriteX 12812 2048 2048 2048
WriteX 12811 2048 2048 2048
WriteX 12809 0 88 88
WriteX 12810 0 88 88
WriteX 12811 0 88 88
WriteX 12812 0 88 88
Close 12809
Close 12810
Close 12811
Close 12812
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12814
Close 12814
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12815
ReadX 12815 0 511 511
ReadX 12815 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12816
ReadX 12816 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12817
ReadX 12817 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12818
ReadX 12818 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12819
ReadX 12819 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12820
ReadX 12820 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12821
ReadX 12821 0 53 53
ReadX 12821 53 2 2
ReadX 12821 55 2 2
ReadX 12821 57 184 184
ReadX 12821 241 298 298
Close 12821
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12822
ReadX 12822 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12823
ReadX 12823 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12824
ReadX 12824 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12825
ReadX 12825 0 511 511
ReadX 12824 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12826
ReadX 12826 0 53 53
ReadX 12826 53 2 2
ReadX 12826 55 480 480
ReadX 12826 535 2 2
Close 12826
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12827
ReadX 12827 0 41 41
ReadX 12815 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12828
QUERY_FILE_INFORMATION 12828
QUERY_FILE_INFORMATION 12828
ReadX 12828 0 8192 8192
Close 12828
ReadX 12815 1152 2048 2048
ReadX 12815 4096 16384 16384
Close 12822
Close 12823
Close 12824
Close 12825
Close 12827
Close 12815
Close 12816
Close 12819
Close 12820
Close 12817
Close 12818
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12829
Close 12829
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12830
QUERY_FILE_INFORMATION 12830
ReadX 12830 0 64 64
ReadX 12830 144 64 64
ReadX 12830 224 156 156
ReadX 12830 1193 128 128
ReadX 12830 1201 128 128
ReadX 12830 1072 4 4
ReadX 12830 1076 1925 1925
ReadX 12830 758 4 4
ReadX 12830 762 4557 4557
ReadX 12830 1052 4 4
ReadX 12830 1056 314 314
ReadX 12830 1056 11056 11056
Close 12830
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12831
ReadX 12831 0 511 511
ReadX 12831 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12832
ReadX 12832 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12833
ReadX 12833 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12834
ReadX 12834 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12835
ReadX 12835 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12836
ReadX 12836 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12837
ReadX 12837 0 53 53
ReadX 12837 53 2 2
ReadX 12837 55 2 2
ReadX 12837 57 184 184
ReadX 12837 241 298 298
Close 12837
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12838
ReadX 12838 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12839
ReadX 12839 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12840
ReadX 12840 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12841
ReadX 12841 0 511 511
ReadX 12840 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12842
ReadX 12842 0 53 53
ReadX 12842 53 2 2
ReadX 12842 55 480 480
ReadX 12842 535 2 2
Close 12842
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12843
ReadX 12843 0 41 41
ReadX 12831 2048 2048 2048
ReadX 12832 2048 2048 2048
ReadX 12831 1144 2048 2048
ReadX 12831 1152 2048 2048
ReadX 12831 4096 16384 16384
WriteX 12831 2048 2048 2048
WriteX 12832 2048 2048 2048
WriteX 12831 0 88 88
WriteX 12832 0 88 88
Close 12838
Close 12839
Close 12840
Close 12841
Close 12843
Close 12831
Close 12832
Close 12835
Close 12836
Close 12833
Close 12834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12844
Close 12844
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12845
QUERY_FILE_INFORMATION 12845
ReadX 12845 0 64 64
ReadX 12845 144 64 64
ReadX 12845 224 84 84
ReadX 12845 478 16 16
ReadX 12845 1056 6176 6176
Close 12845
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12846
ReadX 12846 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12847
ReadX 12847 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12848
ReadX 12848 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12849
ReadX 12849 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12850
ReadX 12850 0 53 53
ReadX 12850 53 28 28
ReadX 12850 81 28 28
ReadX 12850 109 28 28
ReadX 12850 137 28 28
ReadX 12850 165 28 28
ReadX 12850 193 28 28
ReadX 12850 221 28 28
ReadX 12850 249 4 4
ReadX 12850 253 4 4
ReadX 12850 257 4 4
ReadX 12850 261 28 28
ReadX 12850 289 2 2
ReadX 12850 291 2 2
ReadX 12850 293 2 2
Close 12850
ReadX 12846 2048 2048 2048
ReadX 12847 2048 2048 2048
ReadX 12846 1280 2048 2048
ReadX 12849 2048 2048 2048
ReadX 12848 2048 2048 2048
WriteX 12846 1280 2048 2048
WriteX 12849 2048 2048 2048
WriteX 12848 2048 2048 2048
WriteX 12847 2048 2048 2048
WriteX 12846 0 88 88
WriteX 12847 0 88 88
WriteX 12848 0 88 88
WriteX 12849 0 88 88
WriteX 12846 1280 2048 2048
WriteX 12849 2048 2048 2048
WriteX 12848 2048 2048 2048
WriteX 12847 2048 2048 2048
WriteX 12846 0 88 88
WriteX 12847 0 88 88
WriteX 12848 0 88 88
WriteX 12849 0 88 88
WriteX 12846 1280 2048 2048
WriteX 12849 2048 2048 2048
WriteX 12848 2048 2048 2048
WriteX 12847 2048 2048 2048
WriteX 12846 0 88 88
WriteX 12847 0 88 88
WriteX 12848 0 88 88
WriteX 12849 0 88 88
Close 12846
Close 12847
Close 12848
Close 12849
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12851
ReadX 12851 0 511 511
ReadX 12851 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12852
ReadX 12852 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12853
ReadX 12853 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12854
ReadX 12854 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12855
ReadX 12855 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12856
ReadX 12856 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12857
ReadX 12857 0 53 53
ReadX 12857 53 2 2
ReadX 12857 55 2 2
ReadX 12857 57 184 184
ReadX 12857 241 298 298
Close 12857
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12858
ReadX 12858 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12859
ReadX 12859 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12860
ReadX 12860 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12861
ReadX 12861 0 511 511
ReadX 12860 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12862
ReadX 12862 0 53 53
ReadX 12862 53 2 2
ReadX 12862 55 480 480
ReadX 12862 535 2 2
Close 12862
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12863
ReadX 12863 0 41 41
ReadX 12851 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12867
FIND_FIRST \clients\client1\~dmtmp\*
Close 12867
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12868
QUERY_FILE_INFORMATION 12868
WriteX 12868 2047 1 1
QUERY_FILE_INFORMATION 12868
WriteX 12868 0 2048 2048
Close 12868
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12869
ReadX 12869 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12869 4095 1 1
QUERY_FILE_INFORMATION 12869
WriteX 12869 2048 2048 2048
WriteX 12869 0 88 88
Close 12869
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12870
ReadX 12870 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12870 2048 2048 2048
Close 12858
Close 12859
Close 12860
Close 12861
Close 12863
Close 12851
Close 12852
Close 12855
Close 12856
Close 12853
Close 12854
WriteX 12870 2048 2048 2048
WriteX 12870 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12871
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12871 0 511 511
ReadX 12871 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12872
ReadX 12872 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12873
ReadX 12873 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12874
ReadX 12874 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12875
ReadX 12875 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12876
ReadX 12876 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12877
ReadX 12877 0 53 53
ReadX 12877 53 2 2
ReadX 12877 55 2 2
ReadX 12877 57 184 184
ReadX 12877 241 298 298
Close 12877
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12878
ReadX 12878 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12879
ReadX 12879 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12880
ReadX 12880 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12881
ReadX 12881 0 511 511
ReadX 12880 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12882
ReadX 12882 0 53 53
ReadX 12882 53 2 2
ReadX 12882 55 480 480
ReadX 12882 535 2 2
Close 12882
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12883
ReadX 12883 0 41 41
ReadX 12871 2048 2048 2048
ReadX 12871 1152 2048 2048
ReadX 12871 4096 16384 16384
ReadX 12871 1280 16384 16384
ReadX 12871 2304 16384 16384
ReadX 12871 3328 16384 16384
ReadX 12871 272 16384 16384
ReadX 12871 336 16384 16384
ReadX 12871 400 16384 16384
ReadX 12871 464 16384 16384
ReadX 12871 528 16384 16384
ReadX 12871 592 16384 16384
ReadX 12871 656 16384 16384
ReadX 12871 720 16384 16384
ReadX 12871 784 16384 16384
ReadX 12871 848 16384 16384
ReadX 12871 912 16384 16384
ReadX 12871 976 16384 16384
ReadX 12871 1040 16384 16384
ReadX 12871 1104 12288 12288
Close 12878
Close 12879
Close 12880
Close 12881
Close 12883
Close 12871
Close 12872
Close 12875
Close 12876
Close 12873
Close 12874
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12884
FIND_FIRST \clients\client1\~dmtmp\*
Close 12884
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12885
QUERY_FILE_INFORMATION 12885
WriteX 12885 0 2048 2048
WriteX 12885 2048 4096 4096
WriteX 12885 0 88 88
Close 12885
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12886
ReadX 12886 0 511 511
ReadX 12886 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12886
WriteX 12870 2048 2048 2048
WriteX 12870 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12887
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12887 0 511 511
ReadX 12887 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12888
ReadX 12888 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12889
ReadX 12889 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12890
ReadX 12890 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12891
ReadX 12891 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12892
ReadX 12892 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12893
ReadX 12893 0 53 53
ReadX 12893 53 2 2
ReadX 12893 55 2 2
ReadX 12893 57 184 184
ReadX 12893 241 298 298
Close 12893
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12894
ReadX 12894 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12895
ReadX 12895 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12896
ReadX 12896 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12897
ReadX 12897 0 511 511
ReadX 12896 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12898
ReadX 12898 0 53 53
ReadX 12898 53 2 2
ReadX 12898 55 480 480
ReadX 12898 535 2 2
Close 12898
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12899
ReadX 12899 0 41 41
ReadX 12887 2048 2048 2048
ReadX 12887 1152 2048 2048
ReadX 12887 4096 16384 16384
ReadX 12887 1280 16384 16384
ReadX 12887 2304 16384 16384
ReadX 12887 3328 16384 16384
ReadX 12887 272 16384 16384
ReadX 12887 336 16384 16384
ReadX 12887 400 16384 16384
ReadX 12887 464 16384 16384
ReadX 12887 528 16384 16384
ReadX 12887 592 16384 16384
ReadX 12887 656 16384 16384
ReadX 12887 720 16384 16384
ReadX 12887 784 16384 16384
ReadX 12887 848 16384 16384
ReadX 12887 912 16384 16384
ReadX 12887 976 16384 16384
ReadX 12887 1040 16384 16384
ReadX 12887 1104 12288 12288
Close 12894
Close 12895
Close 12896
Close 12897
Close 12899
Close 12887
Close 12888
Close 12891
Close 12892
Close 12889
Close 12890
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12900
FIND_FIRST \clients\client1\~dmtmp\*
Close 12900
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12901
QUERY_FILE_INFORMATION 12901
WriteX 12901 0 2048 2048
WriteX 12901 2048 4096 4096
WriteX 12901 0 88 88
Close 12901
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12902
ReadX 12902 0 511 511
ReadX 12902 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12902
Close 12870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12903
QUERY_FILE_INFORMATION 12903
Close 12903
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12904
Close 12904
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12905
QUERY_FILE_INFORMATION 12905
ReadX 12905 0 64 64
ReadX 12905 144 64 64
ReadX 12905 224 156 156
ReadX 12905 1193 128 128
ReadX 12905 1201 128 128
ReadX 12905 1072 4 4
ReadX 12905 1076 1925 1925
ReadX 12905 758 4 4
ReadX 12905 762 4557 4557
ReadX 12905 1052 4 4
ReadX 12905 1056 314 314
ReadX 12905 1056 11056 11056
Close 12905
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12906
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12906 0 511 511
ReadX 12906 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12907
ReadX 12907 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12908
ReadX 12908 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12909
ReadX 12909 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12910
ReadX 12910 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12911
ReadX 12911 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12912
ReadX 12912 0 53 53
ReadX 12912 53 2 2
ReadX 12912 55 2 2
ReadX 12912 57 184 184
ReadX 12912 241 298 298
Close 12912
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12913
ReadX 12913 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12914
ReadX 12914 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12915
ReadX 12915 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12916
ReadX 12916 0 511 511
ReadX 12915 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12917
ReadX 12917 0 53 53
ReadX 12917 53 2 2
ReadX 12917 55 480 480
ReadX 12917 535 2 2
Close 12917
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12918
ReadX 12918 0 41 41
ReadX 12906 2048 2048 2048
ReadX 12906 1152 2048 2048
ReadX 12906 4096 16384 16384
Close 12913
Close 12914
Close 12915
Close 12916
Close 12918
Close 12906
Close 12907
Close 12910
Close 12911
Close 12908
Close 12909
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12919
ReadX 12919 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12920
ReadX 12920 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12921
ReadX 12921 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12922
ReadX 12922 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12923
ReadX 12923 0 53 53
ReadX 12923 53 2 2
ReadX 12923 55 480 480
ReadX 12923 535 2 2
Close 12923
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12924
ReadX 12924 0 511 511
ReadX 12924 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12925
ReadX 12925 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12926
ReadX 12926 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12927
ReadX 12927 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12928
ReadX 12928 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12929
ReadX 12929 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12930
ReadX 12930 0 41 41
ReadX 12924 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12931
ReadX 12931 0 53 53
ReadX 12931 53 2 2
ReadX 12931 55 2 2
ReadX 12931 57 184 184
ReadX 12931 241 298 298
Close 12931
ReadX 12919 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12935
FIND_FIRST \clients\client1\~dmtmp\*
Close 12935
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12936
QUERY_FILE_INFORMATION 12936
WriteX 12936 2047 1 1
QUERY_FILE_INFORMATION 12936
WriteX 12936 0 2048 2048
Close 12936
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12937
ReadX 12937 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12937 4095 1 1
QUERY_FILE_INFORMATION 12937
WriteX 12937 2048 2048 2048
WriteX 12937 0 88 88
Close 12937
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12938
ReadX 12938 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12938 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12942
Close 12942
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12943
QUERY_FILE_INFORMATION 12943
WriteX 12943 2047 1 1
QUERY_FILE_INFORMATION 12943
WriteX 12943 0 2048 2048
Close 12943
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12944
ReadX 12944 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12944 4095 1 1
QUERY_FILE_INFORMATION 12944
WriteX 12944 2048 2048 2048
WriteX 12944 0 88 88
Close 12944
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12945
ReadX 12945 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12945 2048 2048 2048
Close 12930
Close 12924
Close 12925
Close 12928
Close 12929
Close 12926
Close 12927
Close 12919
Close 12920
Close 12921
Close 12922
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12946
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12946 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12947
ReadX 12947 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12948
ReadX 12948 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12949
ReadX 12949 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12950
ReadX 12950 0 53 53
ReadX 12950 53 2 2
ReadX 12950 55 480 480
ReadX 12950 535 2 2
Close 12950
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12951
ReadX 12951 0 511 511
ReadX 12951 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12952
ReadX 12952 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12953
ReadX 12953 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12954
ReadX 12954 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12955
ReadX 12955 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12956
ReadX 12956 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12957
ReadX 12957 0 41 41
ReadX 12951 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12958
ReadX 12958 0 53 53
ReadX 12958 53 2 2
ReadX 12958 55 2 2
ReadX 12958 57 184 184
ReadX 12958 241 298 298
Close 12958
ReadX 12946 2048 2048 2048
ReadX 12946 384 16384 16384
ReadX 12946 1408 16384 16384
ReadX 12946 2560 16384 16384
ReadX 12946 3584 16384 16384
ReadX 12946 288 16384 16384
ReadX 12946 352 16384 16384
ReadX 12946 416 16384 16384
ReadX 12946 480 16384 16384
ReadX 12946 552 16384 16384
ReadX 12946 616 16384 16384
ReadX 12946 680 16384 16384
ReadX 12946 744 16384 16384
ReadX 12946 808 16384 16384
ReadX 12946 872 16384 16384
ReadX 12946 936 10240 10240
Close 12957
Close 12951
Close 12952
Close 12955
Close 12956
Close 12953
Close 12954
Close 12946
Close 12947
Close 12948
Close 12949
Close 12938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12959
QUERY_FILE_INFORMATION 12959
Close 12959
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12945
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12960
QUERY_FILE_INFORMATION 12960
Close 12960
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12961
ReadX 12961 0 65471 65471
ReadX 12961 65471 63 63
ReadX 12961 65534 65471 65471
ReadX 12961 131005 63 63
ReadX 12961 131068 65471 65471
ReadX 12961 196539 63 63
ReadX 12961 196602 65471 65471
ReadX 12961 262073 63 63
ReadX 12961 262136 65471 65471
ReadX 12961 327607 63 63
ReadX 12961 327670 10 10
Close 12961
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12962
ReadX 12962 0 65471 65471
ReadX 12962 65471 63 63
ReadX 12962 65534 65471 65471
ReadX 12962 131005 63 63
ReadX 12962 131068 65471 65471
ReadX 12962 196539 63 63
ReadX 12962 196602 65471 65471
ReadX 12962 262073 63 63
ReadX 12962 262136 65471 65471
ReadX 12962 327607 63 63
ReadX 12962 327670 65471 65471
ReadX 12962 393141 63 63
ReadX 12962 393204 65471 65471
ReadX 12962 458675 63 63
ReadX 12962 458738 65471 65471
ReadX 12962 524209 63 63
ReadX 12962 524272 65471 65471
ReadX 12962 589743 63 63
ReadX 12962 589806 65471 65471
ReadX 12962 655277 63 63
ReadX 12962 655340 32 32
Close 12962
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12963
ReadX 12963 0 65471 65471
ReadX 12963 65471 63 63
ReadX 12963 65534 65471 65471
ReadX 12963 131005 63 63
ReadX 12963 131068 65471 65471
ReadX 12963 196539 63 63
ReadX 12963 196602 65471 65471
ReadX 12963 262073 63 63
ReadX 12963 262136 65471 65471
ReadX 12963 327607 63 63
ReadX 12963 327670 65471 65471
ReadX 12963 393141 63 63
ReadX 12963 393204 65471 65471
ReadX 12963 458675 63 63
ReadX 12963 458738 65471 65471
ReadX 12963 524209 63 63
ReadX 12963 524272 65471 65471
ReadX 12963 589743 63 63
ReadX 12963 589806 65471 65471
ReadX 12963 655277 63 63
ReadX 12963 655340 65471 65471
ReadX 12963 720811 63 63
ReadX 12963 720874 65471 65471
ReadX 12963 786345 63 63
ReadX 12963 786408 65471 65471
ReadX 12963 851879 63 63
ReadX 12963 851942 65471 65471
ReadX 12963 917413 63 63
ReadX 12963 917476 65471 65471
ReadX 12963 982947 63 63
ReadX 12963 983010 65471 65471
ReadX 12963 1048481 63 63
ReadX 12963 1048544 65471 65471
ReadX 12963 1114015 63 63
ReadX 12963 1114078 65471 65471
ReadX 12963 1179549 63 63
ReadX 12963 1179612 65471 65471
ReadX 12963 1245083 63 63
ReadX 12963 1245146 65471 65471
ReadX 12963 1310617 63 63
ReadX 12963 1310680 65471 65471
ReadX 12963 1376151 63 63
ReadX 12963 1376214 65471 65471
ReadX 12963 1441685 63 63
ReadX 12963 1441748 65471 65471
ReadX 12963 1507219 63 63
ReadX 12963 1507282 65471 65471
ReadX 12963 1572753 63 63
ReadX 12963 1572816 65471 65471
ReadX 12963 1638287 63 63
ReadX 12963 1638350 65471 65471
ReadX 12963 1703821 63 63
ReadX 12963 1703884 65471 65471
ReadX 12963 1769355 63 63
ReadX 12963 1769418 65471 65471
ReadX 12963 1834889 63 63
ReadX 12963 1834952 32824 32824
Close 12963
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12964
QUERY_FILE_INFORMATION 12964
ReadX 12964 0 512 512
ReadX 12964 512 512 512
ReadX 12964 1024 512 512
QUERY_FILE_INFORMATION 12964
QUERY_FILE_INFORMATION 12964
ReadX 12964 2560 2048 2048
ReadX 12964 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 12965
WriteX 12965 52 1 1
QUERY_FILE_INFORMATION 12965
WriteX 12965 0 53 53
Close 12965
ReadX 12964 2208 650 650
ReadX 12964 1920 2048 2048
ReadX 12964 2112 2048 2048
ReadX 12964 1856 2048 2048
ReadX 12964 1824 2048 2048
ReadX 12964 1536 512 512
ReadX 12964 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12966
Close 12966
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12964 1568 512 512
ReadX 12964 1536 512 512
ReadX 12964 2176 384 384
ReadX 12964 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12967
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12964 288 2048 2048
ReadX 12964 2336 2048 2048
ReadX 12964 4384 2048 2048
ReadX 12964 6432 2048 2048
ReadX 12964 8480 2048 2048
ReadX 12964 10528 2048 2048
ReadX 12964 12576 2048 2048
WriteX 12967 15359 1 1
QUERY_FILE_INFORMATION 12967
ReadX 12964 14624 2048 2048
ReadX 12964 16672 2048 2048
ReadX 12964 18720 2048 2048
ReadX 12964 1728 2048 2048
WriteX 12967 0 15360 15360
Close 12967
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 12968
QUERY_FILE_INFORMATION 12968
ReadX 12968 0 512 512
ReadX 12968 2048 512 512
ReadX 12968 2560 512 512
QUERY_FILE_INFORMATION 12968
QUERY_FILE_INFORMATION 12968
QUERY_FILE_INFORMATION 12968
QUERY_FILE_INFORMATION 12968
QUERY_FILE_INFORMATION 12968
WriteX 12968 2152 384 384
QUERY_FILE_INFORMATION 12968
WriteX 12968 2150 22 22
WriteX 12968 2144 106 106
QUERY_FILE_INFORMATION 12968
WriteX 12968 2176 496 496
ReadX 12968 2176 496 496
QUERY_FILE_INFORMATION 12968
WriteX 12968 2440 384 384
QUERY_FILE_INFORMATION 12968
WriteX 12968 2152 384 384
WriteX 12968 2432 112 112
QUERY_FILE_INFORMATION 12968
WriteX 12968 2439 16 16
QUERY_FILE_INFORMATION 12968
WriteX 12968 2208 220 220
ReadX 12968 2208 220 220
QUERY_FILE_INFORMATION 12968
QUERY_FILE_INFORMATION 12968
WriteX 12968 2440 220 220
QUERY_FILE_INFORMATION 12968
WriteX 12968 2453 36 36
WriteX 12968 2080 512 512
WriteX 12968 2176 512 512
WriteX 12968 2112 512 512
WriteX 12968 2048 512 512
WriteX 12968 0 512 512
QUERY_FILE_INFORMATION 12964
QUERY_FILE_INFORMATION 12964
WriteX 12968 2080 512 512
Close 12968
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 12969
Close 12969
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12970
QUERY_FILE_INFORMATION 12970
ReadX 12970 0 512 512
ReadX 12970 2048 512 512
ReadX 12970 2560 512 512
QUERY_FILE_INFORMATION 12970
QUERY_FILE_INFORMATION 12970
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 12971
Close 12971
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 12964
ReadX 12970 1408 512 512
ReadX 12970 2048 512 512
ReadX 12970 1536 512 512
ReadX 12970 2560 512 512
ReadX 12970 3072 512 512
ReadX 12970 3584 512 512
ReadX 12970 4096 512 512
ReadX 12970 4608 512 512
ReadX 12970 5120 512 512
ReadX 12970 5632 512 512
ReadX 12970 6144 512 512
ReadX 12970 6656 512 512
ReadX 12970 7168 512 512
ReadX 12970 7680 512 512
ReadX 12970 8192 512 512
ReadX 12970 8704 512 512
ReadX 12970 9216 512 512
ReadX 12970 9728 512 512
ReadX 12970 10240 512 512
ReadX 12970 10752 512 512
ReadX 12970 11264 512 512
ReadX 12970 11776 512 512
ReadX 12970 12288 512 512
ReadX 12970 12800 512 512
ReadX 12970 13312 512 512
ReadX 12970 13824 512 512
ReadX 12970 14336 512 512
ReadX 12970 14848 512 512
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 15360 512 0
ReadX 12970 2560 2048 2048
ReadX 12970 4608 2048 2048
ReadX 12970 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12972
QUERY_FILE_INFORMATION 12972
ReadX 12972 0 512 512
ReadX 12972 512 512 512
ReadX 12972 1024 512 512
QUERY_FILE_INFORMATION 12972
QUERY_FILE_INFORMATION 12972
ReadX 12972 352 2048 2048
ReadX 12972 608 1097 1097
ReadX 12972 576 1609 1609
ReadX 12972 4096 512 512
ReadX 12972 1536 512 512
ReadX 12972 3840 256 256
ReadX 12972 288 576 576
ReadX 12972 512 512 512
ReadX 12972 480 512 512
ReadX 12972 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12973
ReadX 12973 0 4096 4096
ReadX 12973 4096 4096 4096
ReadX 12973 8192 4096 4096
Close 12972
Close 12973
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12974
WriteX 12974 15359 1 1
QUERY_FILE_INFORMATION 12974
WriteX 12974 0 15360 15360
Close 12974
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 12975
QUERY_FILE_INFORMATION 12975
ReadX 12975 0 512 512
ReadX 12975 2048 512 512
ReadX 12975 2560 512 512
QUERY_FILE_INFORMATION 12975
QUERY_FILE_INFORMATION 12975
QUERY_FILE_INFORMATION 12975
QUERY_FILE_INFORMATION 12975
QUERY_FILE_INFORMATION 12975
WriteX 12975 2152 384 384
QUERY_FILE_INFORMATION 12975
WriteX 12975 2150 22 22
WriteX 12975 2144 106 106
QUERY_FILE_INFORMATION 12975
WriteX 12975 2176 476 476
ReadX 12975 2176 476 476
QUERY_FILE_INFORMATION 12975
WriteX 12975 2440 384 384
QUERY_FILE_INFORMATION 12975
WriteX 12975 2152 384 384
WriteX 12975 2432 92 92
QUERY_FILE_INFORMATION 12975
WriteX 12975 2437 36 36
QUERY_FILE_INFORMATION 12975
WriteX 12975 2208 220 220
ReadX 12975 2208 220 220
QUERY_FILE_INFORMATION 12975
QUERY_FILE_INFORMATION 12975
WriteX 12975 2440 220 220
QUERY_FILE_INFORMATION 12975
WriteX 12975 2453 36 36
WriteX 12975 2080 512 512
WriteX 12975 2176 512 512
WriteX 12975 2112 512 512
WriteX 12975 2048 512 512
WriteX 12975 0 512 512
QUERY_FILE_INFORMATION 12970
QUERY_FILE_INFORMATION 12970
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 12970
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12976
Close 12976
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12977
QUERY_FILE_INFORMATION 12977
ReadX 12977 0 512 512
ReadX 12977 2048 512 512
ReadX 12977 2560 512 512
QUERY_FILE_INFORMATION 12977
QUERY_FILE_INFORMATION 12977
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 12978
Close 12978
WriteX 12975 2080 512 512
Close 12975
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 12979
Close 12979
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 0 512 512
ReadX 12980 2048 512 512
ReadX 12980 2560 512 512
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 1312 512 512
ReadX 12980 1536 512 512
ReadX 12980 2048 512 512
ReadX 12980 576 512 512
ReadX 12980 1088 512 512
ReadX 12980 1056 512 512
ReadX 12980 1120 512 512
ReadX 12980 1184 512 512
ReadX 12980 2560 2048 2048
ReadX 12980 4608 2048 2048
ReadX 12980 6656 2048 2048
ReadX 12980 8704 2048 2048
ReadX 12980 10752 2048 2048
ReadX 12980 12800 2048 2048
ReadX 12980 14848 2048 512
ReadX 12980 15360 1536 0
ReadX 12980 1088 2048 2048
ReadX 12980 3136 2048 2048
ReadX 12980 1665 5835 5835
ReadX 12980 1856 2048 2048
ReadX 12980 2112 512 512
ReadX 12980 2152 384 384
ReadX 12980 2432 92 92
ReadX 12980 2176 512 512
ReadX 12980 2440 220 220
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 2432 512 512
WriteX 12980 2272 512 512
ReadX 12980 2144 512 512
WriteX 12980 2304 512 512
WriteX 12980 2272 92 92
WriteX 12980 2208 512 512
WriteX 12980 2720 512 512
WriteX 12980 0 512 512
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 1312 4096 4096
ReadX 12980 5408 4096 4096
ReadX 12980 9504 3305 3305
ReadX 12980 512 4096 4096
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
WriteX 12980 3132 50 50
WriteX 12980 3182 4096 4096
WriteX 12980 7278 4096 4096
WriteX 12980 15469 1 1
QUERY_FILE_INFORMATION 12980
WriteX 12980 11374 4096 4096
WriteX 12980 15470 3584 3584
WriteX 12980 2144 512 512
WriteX 12980 2336 4096 4096
WriteX 12980 6432 4096 4096
WriteX 12980 10528 4096 4096
WriteX 12980 14624 462 462
WriteX 12980 2048 512 512
WriteX 12980 2560 512 512
WriteX 12980 0 512 512
QUERY_FILE_INFORMATION 12980
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12981
QUERY_FILE_INFORMATION 12981
ReadX 12981 0 512 512
ReadX 12981 1152 512 512
ReadX 12981 1664 512 512
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
ReadX 12981 512 2048 2048
ReadX 12981 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 12982
WriteX 12982 52 1 1
QUERY_FILE_INFORMATION 12982
WriteX 12982 0 53 53
Close 12982
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
ReadX 12981 1120 504 504
ReadX 12981 896 2048 2048
ReadX 12981 1056 1528 1528
ReadX 12981 864 2048 2048
ReadX 12981 832 2048 2048
ReadX 12981 736 2048 2048
ReadX 12981 1216 512 512
ReadX 12981 1256 384 384
ReadX 12981 1536 140 140
ReadX 12981 1280 512 512
ReadX 12981 1548 252 252
ReadX 12980 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12983
Close 12983
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12981 2560 2048 2048
ReadX 12981 4608 2048 2048
ReadX 12981 6656 2048 2048
ReadX 12981 8704 2048 2048
ReadX 12981 10752 2048 2048
WriteX 12984 12005 1 1
QUERY_FILE_INFORMATION 12984
WriteX 12984 0 12006 12006
Close 12984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 12985
QUERY_FILE_INFORMATION 12985
ReadX 12985 0 512 512
ReadX 12985 1152 512 512
ReadX 12985 1664 512 512
QUERY_FILE_INFORMATION 12985
QUERY_FILE_INFORMATION 12985
QUERY_FILE_INFORMATION 12985
QUERY_FILE_INFORMATION 12985
QUERY_FILE_INFORMATION 12985
QUERY_FILE_INFORMATION 12985
QUERY_FILE_INFORMATION 12985
WriteX 12985 1256 384 384
QUERY_FILE_INFORMATION 12985
WriteX 12985 1254 22 22
WriteX 12985 1248 106 106
QUERY_FILE_INFORMATION 12985
WriteX 12985 1280 508 508
ReadX 12985 1280 508 508
QUERY_FILE_INFORMATION 12985
WriteX 12985 1544 384 384
QUERY_FILE_INFORMATION 12985
WriteX 12985 1256 384 384
WriteX 12985 1536 124 124
QUERY_FILE_INFORMATION 12985
WriteX 12985 1543 4 4
QUERY_FILE_INFORMATION 12985
WriteX 12985 1312 252 252
ReadX 12985 1312 252 252
QUERY_FILE_INFORMATION 12985
QUERY_FILE_INFORMATION 12985
WriteX 12985 1544 252 252
QUERY_FILE_INFORMATION 12985
WriteX 12985 1559 4 4
WriteX 12985 1184 512 512
WriteX 12985 1280 512 512
WriteX 12985 1216 512 512
WriteX 12985 1152 512 512
WriteX 12985 0 512 512
QUERY_FILE_INFORMATION 12981
QUERY_FILE_INFORMATION 12981
WriteX 12985 1184 512 512
Close 12985
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 12986
Close 12986
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12987
QUERY_FILE_INFORMATION 12987
ReadX 12987 0 512 512
ReadX 12987 1152 512 512
ReadX 12987 1664 512 512
QUERY_FILE_INFORMATION 12987
QUERY_FILE_INFORMATION 12987
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 12988
Close 12988
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 12981
ReadX 12987 736 512 512
ReadX 12987 1536 2048 2048
ReadX 12987 3584 2048 2048
ReadX 12987 5632 2048 2048
ReadX 12987 7680 2048 2048
ReadX 12987 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12989
WriteX 12989 11990 1 1
QUERY_FILE_INFORMATION 12989
WriteX 12989 0 11991 11991
Close 12989
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 12990
QUERY_FILE_INFORMATION 12990
ReadX 12990 0 512 512
ReadX 12990 1184 512 512
ReadX 12990 1696 512 512
QUERY_FILE_INFORMATION 12990
QUERY_FILE_INFORMATION 12990
QUERY_FILE_INFORMATION 12990
QUERY_FILE_INFORMATION 12990
QUERY_FILE_INFORMATION 12990
QUERY_FILE_INFORMATION 12990
QUERY_FILE_INFORMATION 12990
WriteX 12990 1288 384 384
QUERY_FILE_INFORMATION 12990
WriteX 12990 1286 22 22
WriteX 12990 1280 106 106
QUERY_FILE_INFORMATION 12990
WriteX 12990 1312 508 508
ReadX 12990 1312 508 508
QUERY_FILE_INFORMATION 12990
WriteX 12990 1576 384 384
QUERY_FILE_INFORMATION 12990
WriteX 12990 1288 384 384
WriteX 12990 1568 124 124
QUERY_FILE_INFORMATION 12990
WriteX 12990 1575 4 4
QUERY_FILE_INFORMATION 12990
WriteX 12990 1344 252 252
ReadX 12990 1344 252 252
QUERY_FILE_INFORMATION 12990
QUERY_FILE_INFORMATION 12990
WriteX 12990 1576 252 252
QUERY_FILE_INFORMATION 12990
WriteX 12990 1591 4 4
WriteX 12990 1216 512 512
WriteX 12990 1312 512 512
WriteX 12990 1248 512 512
WriteX 12990 1184 512 512
WriteX 12990 0 512 512
QUERY_FILE_INFORMATION 12987
QUERY_FILE_INFORMATION 12987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 12987
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12991
Close 12991
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12992
QUERY_FILE_INFORMATION 12992
ReadX 12992 0 512 512
ReadX 12992 1152 512 512
ReadX 12992 1664 512 512
QUERY_FILE_INFORMATION 12992
QUERY_FILE_INFORMATION 12992
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 12993
Close 12993
WriteX 12990 1216 512 512
Close 12990
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 12994
Close 12994
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12995
QUERY_FILE_INFORMATION 12995
ReadX 12995 0 512 512
ReadX 12995 1184 512 512
ReadX 12995 1696 512 512
QUERY_FILE_INFORMATION 12995
QUERY_FILE_INFORMATION 12995
ReadX 12995 1536 512 512
ReadX 12995 736 512 512
ReadX 12995 2048 512 512
ReadX 12995 2560 512 512
ReadX 12995 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12996
Close 12996
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 12995 914 3899 3899
ReadX 12995 1248 512 512
ReadX 12995 1288 384 384
ReadX 12995 1568 124 124
ReadX 12995 1312 512 512
ReadX 12995 1576 252 252
QUERY_FILE_INFORMATION 12995
QUERY_FILE_INFORMATION 12995
ReadX 12995 1568 512 512
WriteX 12995 1408 512 512
ReadX 12995 1280 512 512
WriteX 12995 1440 512 512
WriteX 12995 1408 124 124
WriteX 12995 1344 512 512
WriteX 12995 1856 512 512
WriteX 12995 0 512 512
QUERY_FILE_INFORMATION 12995
QUERY_FILE_INFORMATION 12995
ReadX 12995 544 4096 4096
ReadX 12995 4640 4096 4096
ReadX 12995 8736 1637 1637
ReadX 12995 512 4096 4096
QUERY_FILE_INFORMATION 12995
QUERY_FILE_INFORMATION 12995
WriteX 12995 1280 512 512
WriteX 12995 1472 3584 3584
WriteX 12995 5056 4096 4096
WriteX 12995 13247 1 1
QUERY_FILE_INFORMATION 12995
WriteX 12995 9152 4096 4096
WriteX 12995 13248 1736 1736
WriteX 12995 1184 512 512
WriteX 12995 1696 512 512
WriteX 12995 0 512 512
QUERY_FILE_INFORMATION 12995
ReadX 12995 1632 1024 1024
ReadX 12995 288 1024 1024
ReadX 12995 1312 2048 2048
ReadX 12995 3360 1024 1024
ReadX 12995 1696 1024 1024
ReadX 12995 2720 512 512
ReadX 12995 3232 512 512
ReadX 12995 3744 512 512
ReadX 12995 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12995 2066 3998 3998
ReadX 12995 1448 384 384
ReadX 12995 1408 124 124
ReadX 12995 1416 252 252
QUERY_FILE_INFORMATION 12995
QUERY_FILE_INFORMATION 12995
ReadX 12995 1408 512 512
WriteX 12995 1536 512 512
ReadX 12995 1440 512 512
WriteX 12995 2048 512 512
WriteX 12995 1536 124 124
WriteX 12995 512 512 512
WriteX 12995 1024 512 512
WriteX 12995 0 512 512
QUERY_FILE_INFORMATION 12995
ReadX 12995 1696 4096 4096
ReadX 12995 5792 4096 4096
ReadX 12995 9888 1736 1736
ReadX 12995 1280 512 512
ReadX 12995 1472 3584 3584
QUERY_FILE_INFORMATION 12995
QUERY_FILE_INFORMATION 12995
WriteX 12995 3940 156 156
WriteX 12995 4096 512 512
WriteX 12995 544 3584 3584
WriteX 12995 4128 4096 4096
WriteX 12995 8224 3584 3584
WriteX 12995 1344 512 512
WriteX 12995 1856 1536 1536
WriteX 12995 2336 512 512
WriteX 12995 3584 356 356
WriteX 12995 2560 512 512
WriteX 12995 3072 512 512
WriteX 12995 0 512 512
QUERY_FILE_INFORMATION 12995
Close 12977
Close 12980
Close 12995
Close 12992
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12997
Close 12997
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12998
Close 12998
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12999
WriteX 12999 0 65471 65471
WriteX 12999 65471 63 63
WriteX 12999 65534 65471 65471
WriteX 12999 131005 63 63
Close 12999
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13000
WriteX 13000 0 65471 65471
WriteX 13000 65471 63 63
WriteX 13000 65534 65471 65471
WriteX 13000 131005 63 63
WriteX 13000 131068 65471 65471
WriteX 13000 196539 63 63
WriteX 13000 196602 65471 65471
WriteX 13000 262073 63 63
Close 13000
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13001
WriteX 13001 0 65471 65471
WriteX 13001 65471 63 63
WriteX 13001 65534 65471 65471
WriteX 13001 131005 63 63
WriteX 13001 131068 65471 65471
WriteX 13001 196539 63 63
WriteX 13001 196602 65471 65471
WriteX 13001 262073 63 63
WriteX 13001 262136 65471 65471
WriteX 13001 327607 63 63
WriteX 13001 327670 65471 65471
WriteX 13001 393141 63 63
WriteX 13001 393204 65471 65471
WriteX 13001 458675 63 63
WriteX 13001 458738 65471 65471
WriteX 13001 524209 63 63
Close 13001
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13002
QUERY_FILE_INFORMATION 13002
QUERY_FILE_INFORMATION 13002
ReadX 13002 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13003
Close 13003
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13004
WriteX 13004 63 1 1
QUERY_FILE_INFORMATION 13004
WriteX 13004 0 64 64
ReadX 13002 992 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 344 2048 2048
ReadX 13002 1344 2048 2048
ReadX 13002 1352 2048 2048
ReadX 13002 1320 2048 2048
ReadX 13002 1360 2048 2048
ReadX 13002 1344 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2304 2048 2048
ReadX 13002 1472 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 1480 2048 2048
ReadX 13002 1488 2048 2048
ReadX 13002 1496 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 1504 2048 2048
ReadX 13002 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 1000 2048 2048
ReadX 13002 1416 2048 2048
ReadX 13002 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13002 360 2048 2048
ReadX 13002 368 2048 2048
ReadX 13002 360 2048 2048
ReadX 13002 376 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 1232 2048 2048
ReadX 13002 2432 6144 6144
ReadX 13002 2376 2048 2048
ReadX 13002 2360 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 2376 2048 2048
ReadX 13002 2384 2048 2048
ReadX 13002 2368 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 1296 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 13002 0 2048 2048
ReadX 13002 2688 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 2688 2048 2048
WriteX 13002 2688 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 2688 2048 2048
ReadX 13002 2688 2048 2048
ReadX 13002 2688 2048 2048
WriteX 13002 2688 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13002 2688 2048 2048
ReadX 13002 2688 2048 2048
WriteX 13002 2688 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 320 4096 4096
ReadX 13002 0 2048 2048
ReadX 13002 3584 2048 2048
ReadX 13002 3584 2048 2048
ReadX 13002 3584 2048 2048
ReadX 13002 0 2048 2048
WriteX 13002 3584 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2688 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 2688 2048 2048
ReadX 13002 2688 2048 2048
WriteX 13002 2688 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 3200 2048 2048
ReadX 13002 3200 2048 2048
ReadX 13002 3200 2048 2048
WriteX 13002 3200 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 3456 2048 2048
ReadX 13002 3456 2048 2048
ReadX 13002 3456 2048 2048
WriteX 13002 3456 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2496 2048 2048
ReadX 13002 2472 2048 2048
ReadX 13002 2456 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 2472 2048 2048
ReadX 13002 2480 2048 2048
ReadX 13002 2464 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 2488 2048 2048
ReadX 13002 2568 8192 8192
ReadX 13002 1000 2048 2048
ReadX 13002 328 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 2048 2048 2048
ReadX 13002 2560 2048 2048
ReadX 13002 920 2048 2048
WriteX 13002 2048 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 312 2048 2048
WriteX 13002 336 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 328 2048 2048
WriteX 13002 2560 2048 2048
WriteX 13002 3840 2048 2048
WriteX 13002 920 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2432 2048 2048
WriteX 13002 2432 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2456 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 328 2048 2048
ReadX 13002 2560 2048 2048
ReadX 13002 2048 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 336 2048 2048
ReadX 13002 920 2048 2048
WriteX 13002 1536 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 2048 2048 2048
WriteX 13002 2560 2048 2048
WriteX 13002 336 2048 2048
WriteX 13002 920 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2048 2048 2048
ReadX 13002 2432 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 2048 2048 2048
WriteX 13002 2432 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2456 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1536 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 336 2048 2048
ReadX 13002 920 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 1536 2048 2048
WriteX 13002 336 2048 2048
WriteX 13002 920 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2432 2048 2048
WriteX 13002 2432 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2456 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1536 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 336 2048 2048
ReadX 13002 920 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 1536 2048 2048
WriteX 13002 336 2048 2048
WriteX 13002 920 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2432 2048 2048
WriteX 13002 2432 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2456 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1536 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 336 2048 2048
ReadX 13002 920 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 1536 2048 2048
WriteX 13002 336 2048 2048
WriteX 13002 920 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2432 2048 2048
WriteX 13002 2432 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2456 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1536 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 336 2048 2048
ReadX 13002 920 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 1536 2048 2048
WriteX 13002 336 2048 2048
WriteX 13002 920 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2432 2048 2048
WriteX 13002 2432 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
Flush 13002
ReadX 13002 2456 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1536 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 336 2048 2048
ReadX 13002 920 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 1536 2048 2048
WriteX 13002 336 2048 2048
WriteX 13002 920 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2432 2048 2048
WriteX 13002 2432 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2624 6144 6144
ReadX 13002 2616 2048 2048
ReadX 13002 2688 2048 2048
ReadX 13002 2600 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 2616 2048 2048
ReadX 13002 2608 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 344 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 520 2048 2048
ReadX 13002 1392 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 400 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 536 2048 2048
ReadX 13002 824 2048 2048
ReadX 13002 832 2048 2048
ReadX 13002 384 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 408 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 552 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 824 2048 2048
ReadX 13002 840 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 768 2048 2048
ReadX 13002 2048 2048 2048
WriteX 13002 1415 1 1
WriteX 13002 352 2048 2048
WriteX 13002 1112 2048 2048
WriteX 13002 1400 2048 2048
WriteX 13002 1408 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 2048 2048 2048
WriteX 13002 768 2048 2048
WriteX 13002 344 2048 2048
WriteX 13002 1000 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 416 2048 2048
ReadX 13002 424 2048 2048
ReadX 13002 432 2048 2048
ReadX 13002 440 2048 2048
ReadX 13002 576 16384 16384
ReadX 13002 448 2048 2048
ReadX 13002 456 2048 2048
ReadX 13002 464 2048 2048
ReadX 13002 640 16384 16384
ReadX 13002 704 16384 16384
ReadX 13002 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 13002 848 2048 2048
ReadX 13002 560 2048 2048
ReadX 13002 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 2600 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 352 2048 2048
ReadX 13002 1928 8192 8192
ReadX 13002 528 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 824 2048 2048
ReadX 13002 0 2048 2048
Flush 13002
ReadX 13002 2600 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 352 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 824 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 856 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 392 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 472 2048 2048
ReadX 13002 480 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 488 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 928 2048 2048
ReadX 13002 936 2048 2048
ReadX 13002 976 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 392 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 952 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 528 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 528 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 816 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13002 1336 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 528 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 528 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1240 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2200 4096 4096
ReadX 13002 2152 2048 2048
ReadX 13002 2160 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1312 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 1928 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 824 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1416 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 352 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 824 2048 2048
ReadX 13002 384 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13002 352 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 768 2048 2048
ReadX 13002 2048 2048 2048
ReadX 13002 352 2048 2048
WriteX 13002 1551 1 1
WriteX 13002 1512 2048 2048
WriteX 13002 1520 2048 2048
WriteX 13002 1528 2048 2048
WriteX 13002 1544 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 2048 2048 2048
WriteX 13002 768 2048 2048
WriteX 13002 344 2048 2048
WriteX 13002 1000 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2048 2048 2048
WriteX 13002 2048 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 1000 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1240 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 344 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 384 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 768 2048 2048
WriteX 13002 1567 1 1
WriteX 13002 1552 2048 2048
WriteX 13002 1560 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 768 2048 2048
WriteX 13002 344 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 1328 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1240 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2200 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1240 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 344 2048 2048
ReadX 13002 384 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 2048 2048 2048
ReadX 13002 768 2048 2048
WriteX 13002 1583 1 1
WriteX 13002 1568 2048 2048
WriteX 13002 1576 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 2048 2048 2048
WriteX 13002 768 2048 2048
WriteX 13002 344 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 864 2048 2048
ReadX 13002 872 2048 2048
ReadX 13002 912 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 2688 2048 2048
ReadX 13002 1000 2048 2048
WriteX 13002 2688 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 2944 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 0 2048 2048
Flush 13002
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 2688 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 2688 2048 2048
WriteX 13002 2688 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 392 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 416 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 416 2048 2048
ReadX 13002 864 2048 2048
ReadX 13002 872 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 312 2048 2048
ReadX 13002 888 2048 2048
ReadX 13002 400 2048 2048
ReadX 13002 896 2048 2048
WriteX 13002 1584 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 400 2048 2048
WriteX 13002 416 2048 2048
WriteX 13002 864 2048 2048
WriteX 13002 872 2048 2048
WriteX 13002 888 2048 2048
WriteX 13002 896 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 584 2048 2048
ReadX 13002 392 2048 2048
WriteX 13002 392 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 1328 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 0 2048 2048
ReadX 13002 408 2048 2048
ReadX 13002 1328 2048 2048
ReadX 13002 864 2048 2048
ReadX 13002 912 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 3840 2048 2048
ReadX 13002 312 2048 2048
ReadX 13002 1584 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 408 2048 2048
WriteX 13002 912 2048 2048
WriteX 13002 1584 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 408 2048 2048
ReadX 13002 392 2048 2048
WriteX 13002 392 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 528 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 528 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 552 2048 2048
ReadX 13002 1336 2048 2048
WriteX 13002 552 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 0 2048 2048
ReadX 13002 552 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 2664 2048 2048
ReadX 13002 2648 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 2672 2048 2048
ReadX 13002 2656 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13002 528 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 1336 2048 2048
ReadX 13002 2680 2048 2048
ReadX 13002 2760 8192 8192
ReadX 13002 544 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 568 2048 2048
ReadX 13002 544 2048 2048
ReadX 13002 0 2048 2048
Flush 13002
ReadX 13002 2816 6144 6144
ReadX 13002 2760 2048 2048
ReadX 13002 2744 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 2752 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 528 2048 2048
ReadX 13002 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13006
Close 13006
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13008
WriteX 13008 4065 1 1
QUERY_FILE_INFORMATION 13008
WriteX 13008 0 62591 62591
Close 13008
ReadX 13002 0 2048 2048
ReadX 13002 2808 2048 2048
ReadX 13002 2792 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 2800 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 384 2048 2048
ReadX 13002 392 2048 2048
ReadX 13002 1384 2048 2048
ReadX 13002 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13010
Close 13010
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13012
WriteX 13012 4094 1 1
QUERY_FILE_INFORMATION 13012
WriteX 13012 0 10845 10845
Close 13012
ReadX 13002 1432 2048 2048
ReadX 13002 1304 2048 2048
ReadX 13002 1368 2048 2048
ReadX 13002 2304 2048 2048
ReadX 13002 1440 2048 2048
ReadX 13002 1424 2048 2048
ReadX 13002 1448 2048 2048
ReadX 13002 1456 2048 2048
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13014
Close 13014
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13016
ReadX 13002 0 2048 2048
WriteX 13016 4081 1 1
QUERY_FILE_INFORMATION 13016
WriteX 13016 0 30118 30118
Close 13016
ReadX 13002 1344 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1152 2048 2048
ReadX 13002 1152 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 1000 2048 2048
ReadX 13002 768 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 344 2048 2048
WriteX 13002 1000 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 1416 2048 2048
ReadX 13002 1416 2048 2048
ReadX 13002 344 2048 2048
ReadX 13002 896 2048 2048
WriteX 13002 1538 2 2
WriteX 13002 344 2048 2048
WriteX 13002 1416 2048 2048
WriteX 13002 1538 2 2
ReadX 13002 2048 2048 2048
WriteX 13002 2048 2048 2048
WriteX 13002 1538 2 2
Close 13002
Close 13004
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13017
ReadX 13017 0 65471 65471
ReadX 13017 65471 63 63
ReadX 13017 65534 65471 65471
ReadX 13017 131005 63 63
ReadX 13017 131068 65471 65471
ReadX 13017 196539 63 63
ReadX 13017 196602 65471 65471
ReadX 13017 262073 63 63
ReadX 13017 262136 65471 65471
ReadX 13017 327607 63 63
ReadX 13017 327670 10 10
Close 13017
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13018
ReadX 13018 0 65471 65471
ReadX 13018 65471 63 63
ReadX 13018 65534 65471 65471
ReadX 13018 131005 63 63
ReadX 13018 131068 65471 65471
ReadX 13018 196539 63 63
ReadX 13018 196602 65471 65471
ReadX 13018 262073 63 63
ReadX 13018 262136 65471 65471
ReadX 13018 327607 63 63
ReadX 13018 327670 65471 65471
ReadX 13018 393141 63 63
ReadX 13018 393204 65471 65471
ReadX 13018 458675 63 63
ReadX 13018 458738 65471 65471
ReadX 13018 524209 63 63
ReadX 13018 524272 65471 65471
ReadX 13018 589743 63 63
ReadX 13018 589806 65471 65471
ReadX 13018 655277 63 63
ReadX 13018 655340 32 32
Close 13018
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13019
ReadX 13019 0 65471 65471
ReadX 13019 65471 63 63
ReadX 13019 65534 65471 65471
ReadX 13019 131005 63 63
ReadX 13019 131068 65471 65471
ReadX 13019 196539 63 63
ReadX 13019 196602 65471 65471
ReadX 13019 262073 63 63
ReadX 13019 262136 65471 65471
ReadX 13019 327607 63 63
ReadX 13019 327670 65471 65471
ReadX 13019 393141 63 63
ReadX 13019 393204 65471 65471
ReadX 13019 458675 63 63
ReadX 13019 458738 65471 65471
ReadX 13019 524209 63 63
ReadX 13019 524272 65471 65471
ReadX 13019 589743 63 63
ReadX 13019 589806 65471 65471
ReadX 13019 655277 63 63
ReadX 13019 655340 65471 65471
ReadX 13019 720811 63 63
ReadX 13019 720874 65471 65471
ReadX 13019 786345 63 63
ReadX 13019 786408 65471 65471
ReadX 13019 851879 63 63
ReadX 13019 851942 65471 65471
ReadX 13019 917413 63 63
ReadX 13019 917476 65471 65471
ReadX 13019 982947 63 63
ReadX 13019 983010 65471 65471
ReadX 13019 1048481 63 63
ReadX 13019 1048544 65471 65471
ReadX 13019 1114015 63 63
ReadX 13019 1114078 65471 65471
ReadX 13019 1179549 63 63
ReadX 13019 1179612 65471 65471
ReadX 13019 1245083 63 63
ReadX 13019 1245146 65471 65471
ReadX 13019 1310617 63 63
ReadX 13019 1310680 65471 65471
ReadX 13019 1376151 63 63
ReadX 13019 1376214 65471 65471
ReadX 13019 1441685 63 63
ReadX 13019 1441748 65471 65471
ReadX 13019 1507219 63 63
ReadX 13019 1507282 65471 65471
ReadX 13019 1572753 63 63
ReadX 13019 1572816 65471 65471
ReadX 13019 1638287 63 63
ReadX 13019 1638350 65471 65471
ReadX 13019 1703821 63 63
ReadX 13019 1703884 65471 65471
ReadX 13019 1769355 63 63
ReadX 13019 1769418 65471 65471
ReadX 13019 1834889 63 63
ReadX 13019 1834952 32824 32824
Close 13019
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13020
Close 13020
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13021
ReadX 13021 0 24 24
Close 13021
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13022
QUERY_FILE_INFORMATION 13022
ReadX 13022 0 512 512
ReadX 13022 464 512 512
ReadX 13022 498 512 512
ReadX 13022 472 512 512
ReadX 13022 466 512 512
ReadX 13022 978 512 512
ReadX 13022 497 57 57
Close 13022
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13023
QUERY_FILE_INFORMATION 13023
ReadX 13023 0 512 512
ReadX 13023 464 512 512
ReadX 13023 498 512 512
ReadX 13023 472 512 512
ReadX 13023 462 512 512
ReadX 13023 468 512 512
ReadX 13023 466 512 512
QUERY_FILE_INFORMATION 13023
WriteX 13023 482 60 60
WriteX 13023 482 4 4
QUERY_FILE_INFORMATION 13023
WriteX 13023 482 11 11
ReadX 13023 497 57 57
ReadX 13023 497 57 57
ReadX 13023 368 4096 4096
ReadX 13023 460 512 512
ReadX 13023 512 4096 4096
ReadX 13023 4608 4096 4096
ReadX 13023 8704 4096 4096
ReadX 13023 12800 4096 4096
ReadX 13023 16896 4096 4096
ReadX 13023 20992 4096 4096
ReadX 13023 25088 4096 4096
ReadX 13023 29184 4096 4096
ReadX 13023 33280 4096 4096
ReadX 13023 37376 4096 4096
ReadX 13023 41472 4096 4096
ReadX 13023 45568 4096 4096
ReadX 13023 49664 4096 4096
ReadX 13023 53760 4096 4096
ReadX 13023 57856 4096 4096
ReadX 13023 61952 4096 4096
ReadX 13023 66048 4096 4096
ReadX 13023 70144 4096 4096
ReadX 13023 497 20 20
ReadX 13023 496 103 103
ReadX 13023 500 448 448
ReadX 13023 470 512 512
ReadX 13023 486 2692 2692
ReadX 13023 290 4096 4096
ReadX 13023 4386 4096 4096
ReadX 13023 8482 4096 4096
ReadX 13023 500 20 20
ReadX 13023 483 108 108
ReadX 13023 482 292 292
ReadX 13023 338 4096 4096
ReadX 13023 4434 3103 3103
ReadX 13023 384 28 28
ReadX 13023 412 20 20
ReadX 13023 432 8 8
ReadX 13023 440 136 136
ReadX 13023 576 8 8
ReadX 13023 584 4 4
ReadX 13023 588 4 4
ReadX 13023 592 39 39
ReadX 13023 384 4 4
ReadX 13023 388 4 4
ReadX 13023 392 23 23
ReadX 13023 385 4 4
ReadX 13023 389 4 4
ReadX 13023 393 12 12
ReadX 13023 405 4 4
ReadX 13023 409 4 4
ReadX 13023 413 1 1
ReadX 13023 385 4 4
ReadX 13023 389 4 4
ReadX 13023 393 1 1
ReadX 13023 385 4 4
ReadX 13023 389 4 4
ReadX 13023 393 12 12
ReadX 13023 405 4 4
ReadX 13023 409 4 4
ReadX 13023 413 2 2
ReadX 13023 385 4 4
ReadX 13023 389 4 4
ReadX 13023 393 25 25
ReadX 13023 385 4 4
ReadX 13023 389 8 8
ReadX 13023 397 4 4
ReadX 13023 401 8 8
ReadX 13023 409 4 4
ReadX 13023 413 8 8
ReadX 13023 421 4 4
ReadX 13023 425 8 8
ReadX 13023 433 4 4
ReadX 13023 437 4 4
ReadX 13023 441 4 4
ReadX 13023 445 4 4
ReadX 13023 449 4 4
ReadX 13023 453 4 4
ReadX 13023 457 4 4
ReadX 13023 461 4 4
ReadX 13023 465 10670 10670
ReadX 13023 428 4096 4096
WriteX 13023 498 512 512
WriteX 13023 472 512 512
WriteX 13023 462 512 512
WriteX 13023 468 512 512
Close 13023
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13024
Close 13024
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13025
QUERY_FILE_INFORMATION 13025
ReadX 13025 0 512 512
ReadX 13025 464 512 512
ReadX 13025 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13026
Close 13026
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13025
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13028
WriteX 13028 4607 1 1
QUERY_FILE_INFORMATION 13028
WriteX 13028 0 65471 65471
WriteX 13028 65471 65 65
WriteX 13028 65536 19979 19979
Close 13028
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13029
QUERY_FILE_INFORMATION 13029
ReadX 13029 0 512 512
ReadX 13029 462 512 512
ReadX 13029 974 512 512
ReadX 13029 1486 512 512
ReadX 13029 460 512 512
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
WriteX 13029 470 448 448
QUERY_FILE_INFORMATION 13029
WriteX 13029 470 60 60
WriteX 13029 470 4 4
QUERY_FILE_INFORMATION 13029
WriteX 13029 470 11 11
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
WriteX 13029 464 512 512
WriteX 13029 976 512 512
WriteX 13029 1488 512 512
WriteX 13029 462 512 512
WriteX 13029 0 512 512
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
ReadX 13029 470 512 512
WriteX 13029 482 512 512
WriteX 13029 482 292 292
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
WriteX 13029 483 20 20
WriteX 13029 483 108 108
QUERY_FILE_INFORMATION 13029
WriteX 13029 484 448 448
QUERY_FILE_INFORMATION 13029
WriteX 13029 484 44 44
WriteX 13029 484 20 20
WriteX 13029 480 512 512
WriteX 13029 472 512 512
WriteX 13029 476 512 512
WriteX 13029 988 512 512
WriteX 13029 474 512 512
Flush 13029
WriteX 13029 0 512 512
Flush 13029
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
WriteX 13029 480 512 512
WriteX 13029 472 512 512
WriteX 13029 476 512 512
QUERY_FILE_INFORMATION 13029
WriteX 13029 496 320 320
QUERY_FILE_INFORMATION 13029
WriteX 13029 496 60 60
ReadX 13029 484 512 512
WriteX 13029 500 512 512
WriteX 13029 470 512 512
WriteX 13029 486 2692 2692
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
WriteX 13029 497 25 25
WriteX 13029 496 103 103
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
WriteX 13029 497 44 44
WriteX 13029 497 20 20
WriteX 13029 498 512 512
WriteX 13029 462 512 512
WriteX 13029 466 512 512
WriteX 13029 978 512 512
WriteX 13029 464 512 512
Flush 13029
WriteX 13029 0 512 512
Flush 13029
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
QUERY_FILE_INFORMATION 13029
WriteX 13029 497 7 7
WriteX 13029 497 57 57
WriteX 13029 498 512 512
WriteX 13029 472 512 512
WriteX 13029 462 512 512
WriteX 13029 466 512 512
WriteX 13029 978 512 512
Flush 13029
WriteX 13029 498 512 512
Flush 13029
Close 13029
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13030
QUERY_FILE_INFORMATION 13030
ReadX 13030 0 512 512
ReadX 13030 464 512 512
ReadX 13030 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13031
ReadX 13031 0 20 20
ReadX 13031 14 40 40
ReadX 13031 54 64 64
ReadX 13031 118 1152 1152
Close 13031
Close 13030
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13032
Close 13032
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13033
ReadX 13033 0 24 24
Close 13033
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13034
QUERY_FILE_INFORMATION 13034
ReadX 13034 0 512 512
ReadX 13034 464 512 512
ReadX 13034 498 512 512
ReadX 13034 472 512 512
ReadX 13034 462 512 512
ReadX 13034 466 512 512
ReadX 13034 978 512 512
ReadX 13034 497 57 57
Close 13034
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13035
QUERY_FILE_INFORMATION 13035
ReadX 13035 0 512 512
ReadX 13035 464 512 512
ReadX 13035 498 512 512
ReadX 13035 472 512 512
ReadX 13035 468 512 512
ReadX 13035 462 512 512
ReadX 13035 466 512 512
QUERY_FILE_INFORMATION 13035
WriteX 13035 482 60 60
WriteX 13035 482 4 4
QUERY_FILE_INFORMATION 13035
WriteX 13035 482 11 11
WriteX 13035 498 512 512
WriteX 13035 472 512 512
WriteX 13035 462 512 512
WriteX 13035 466 512 512
WriteX 13035 978 512 512
Close 13035
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13036
Close 13036
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13037
Close 13037
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13039
WriteX 13039 4607 1 1
QUERY_FILE_INFORMATION 13039
WriteX 13039 0 65471 65471
WriteX 13039 65471 65 65
WriteX 13039 65536 17654 17654
Close 13039
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13040
QUERY_FILE_INFORMATION 13040
ReadX 13040 0 512 512
ReadX 13040 474 512 512
ReadX 13040 986 512 512
ReadX 13040 1498 512 512
ReadX 13040 472 512 512
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
WriteX 13040 482 448 448
QUERY_FILE_INFORMATION 13040
WriteX 13040 482 60 60
WriteX 13040 482 4 4
QUERY_FILE_INFORMATION 13040
WriteX 13040 482 11 11
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
WriteX 13040 476 512 512
WriteX 13040 988 512 512
WriteX 13040 1500 512 512
WriteX 13040 474 512 512
WriteX 13040 0 512 512
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
ReadX 13040 482 512 512
WriteX 13040 494 512 512
WriteX 13040 494 292 292
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
WriteX 13040 495 20 20
WriteX 13040 495 108 108
QUERY_FILE_INFORMATION 13040
WriteX 13040 496 448 448
QUERY_FILE_INFORMATION 13040
WriteX 13040 496 44 44
WriteX 13040 496 20 20
WriteX 13040 492 512 512
WriteX 13040 484 512 512
WriteX 13040 488 512 512
WriteX 13040 1000 512 512
WriteX 13040 486 512 512
Flush 13040
WriteX 13040 0 512 512
Flush 13040
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
WriteX 13040 492 512 512
WriteX 13040 484 512 512
WriteX 13040 488 512 512
QUERY_FILE_INFORMATION 13040
WriteX 13040 508 320 320
QUERY_FILE_INFORMATION 13040
WriteX 13040 508 60 60
ReadX 13040 496 512 512
WriteX 13040 512 512 512
WriteX 13040 482 512 512
WriteX 13040 498 2692 2692
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
WriteX 13040 509 25 25
WriteX 13040 508 103 103
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
WriteX 13040 509 44 44
WriteX 13040 509 20 20
WriteX 13040 510 512 512
WriteX 13040 474 512 512
WriteX 13040 478 512 512
WriteX 13040 990 512 512
WriteX 13040 476 512 512
Flush 13040
WriteX 13040 0 512 512
Flush 13040
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
QUERY_FILE_INFORMATION 13040
WriteX 13040 509 7 7
WriteX 13040 509 57 57
WriteX 13040 510 512 512
WriteX 13040 484 512 512
WriteX 13040 474 512 512
WriteX 13040 478 512 512
WriteX 13040 990 512 512
Flush 13040
WriteX 13040 510 512 512
Flush 13040
Close 13040
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13041
Close 13041
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13042
QUERY_FILE_INFORMATION 13042
ReadX 13042 0 512 512
ReadX 13042 476 512 512
ReadX 13042 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13043
Close 13043
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13044
QUERY_FILE_INFORMATION 13044
ReadX 13044 0 512 512
ReadX 13044 512 512 512
ReadX 13044 770 512 512
ReadX 13044 1282 512 512
ReadX 13044 1794 512 512
ReadX 13044 2562 512 512
ReadX 13044 3586 512 512
ReadX 13044 3828 512 512
ReadX 13044 288 512 512
ReadX 13044 1024 512 512
ReadX 13044 954 512 512
ReadX 13044 295 512 512
ReadX 13044 320 512 512
ReadX 13044 322 512 512
ReadX 13044 834 512 512
ReadX 13044 1346 512 512
ReadX 13044 1858 512 512
ReadX 13044 323 512 512
ReadX 13044 835 512 512
ReadX 13044 1347 512 512
ReadX 13044 1859 512 512
ReadX 13044 2371 345 345
ReadX 13044 322 167 167
ReadX 13044 489 512 512
ReadX 13044 1001 512 512
ReadX 13044 1513 512 512
ReadX 13044 2025 512 512
ReadX 13044 2537 512 512
ReadX 13044 3049 512 512
ReadX 13044 3561 345 345
ReadX 13044 323 167 167
ReadX 13044 490 512 512
ReadX 13044 1002 512 512
ReadX 13044 1514 512 512
ReadX 13044 2026 512 512
ReadX 13044 2538 512 512
ReadX 13044 3050 512 512
ReadX 13044 3562 512 512
ReadX 13044 4074 512 512
ReadX 13044 4586 512 512
ReadX 13044 5098 512 512
ReadX 13044 5610 512 512
ReadX 13044 6122 512 512
ReadX 13044 6634 512 512
ReadX 13044 7146 512 512
ReadX 13044 7658 512 512
ReadX 13044 8170 512 512
ReadX 13044 8682 512 512
ReadX 13044 9194 512 512
ReadX 13044 9706 512 512
ReadX 13044 10218 512 512
ReadX 13044 10730 345 345
ReadX 13044 11075 512 512
ReadX 13044 11587 167 167
ReadX 13044 11754 512 512
ReadX 13044 12266 512 512
ReadX 13044 12778 512 512
ReadX 13044 13290 512 512
ReadX 13044 13802 512 512
ReadX 13044 14314 512 512
ReadX 13044 14826 512 512
ReadX 13044 15338 512 512
ReadX 13044 337 512 512
ReadX 13044 337 512 512
ReadX 13044 849 34 34
ReadX 13044 352 512 512
ReadX 13044 864 512 512
ReadX 13044 1376 512 512
ReadX 13044 1888 512 512
ReadX 13044 2400 512 512
ReadX 13044 2912 512 512
ReadX 13044 3424 512 512
ReadX 13044 3936 512 512
ReadX 13044 1632 512 512
ReadX 13044 2144 512 512
ReadX 13044 1682 512 512
ReadX 13044 258 512 512
ReadX 13044 360 144 144
ReadX 13044 2517 512 512
ReadX 13044 3029 512 512
ReadX 13044 1751 512 512
ReadX 13044 2263 512 512
ReadX 13044 2775 512 512
ReadX 13044 3287 512 512
ReadX 13044 3799 512 512
ReadX 13044 4311 512 512
ReadX 13044 4823 512 512
ReadX 13044 5335 512 512
ReadX 13044 5847 512 512
ReadX 13044 6359 512 512
ReadX 13044 6871 512 512
ReadX 13044 7383 512 512
ReadX 13044 7895 512 512
ReadX 13044 8407 512 512
ReadX 13044 8919 512 512
ReadX 13044 9431 512 512
ReadX 13044 9943 512 512
ReadX 13044 10455 512 512
ReadX 13044 10967 512 512
ReadX 13044 11479 512 512
ReadX 13044 2556 512 512
ReadX 13044 3068 512 512
ReadX 13044 3580 512 512
ReadX 13044 4092 512 512
ReadX 13044 4604 512 512
ReadX 13044 5116 512 512
ReadX 13044 5628 512 512
ReadX 13044 6140 512 512
ReadX 13044 6652 512 512
ReadX 13044 7164 512 512
ReadX 13044 7676 512 512
ReadX 13044 8188 512 512
ReadX 13044 8700 512 512
ReadX 13044 9212 512 512
ReadX 13044 9724 512 512
ReadX 13044 10236 512 512
ReadX 13044 10748 512 512
ReadX 13044 11260 512 512
ReadX 13044 11772 512 512
ReadX 13044 12284 512 512
ReadX 13044 12796 49 49
ReadX 13044 260 463 463
ReadX 13044 723 512 512
ReadX 13044 1235 512 512
ReadX 13044 1747 512 512
ReadX 13044 2259 512 512
ReadX 13044 2771 512 512
ReadX 13044 3283 512 512
ReadX 13044 3795 512 512
ReadX 13044 4307 512 512
ReadX 13044 4819 512 512
ReadX 13044 5331 512 512
ReadX 13044 5843 512 512
ReadX 13044 6355 512 512
ReadX 13044 6867 512 512
ReadX 13044 7379 512 512
ReadX 13044 7891 512 512
ReadX 13044 8403 512 512
ReadX 13044 8915 512 512
ReadX 13044 9427 512 512
ReadX 13044 9939 512 512
ReadX 13044 10451 512 512
ReadX 13044 10963 402 402
ReadX 13044 593 240 240
ReadX 13044 2048 272 272
ReadX 13044 2320 512 512
ReadX 13044 2832 512 512
ReadX 13044 3344 512 512
ReadX 13044 3856 512 512
ReadX 13044 4368 512 512
ReadX 13044 4880 512 512
ReadX 13044 5392 240 240
ReadX 13044 608 272 272
ReadX 13044 880 512 512
ReadX 13044 1392 512 512
ReadX 13044 1904 512 512
ReadX 13044 2416 512 512
ReadX 13044 2928 512 512
ReadX 13044 3440 512 512
ReadX 13044 3952 512 512
ReadX 13044 4464 512 512
ReadX 13044 4976 512 512
ReadX 13044 5488 512 512
ReadX 13044 6000 512 512
ReadX 13044 6512 512 512
ReadX 13044 7024 512 512
ReadX 13044 7536 512 512
ReadX 13044 8048 512 512
ReadX 13044 8560 512 512
ReadX 13044 9072 512 512
ReadX 13044 9584 512 512
ReadX 13044 10096 512 512
ReadX 13044 1683 512 512
ReadX 13044 514 512 512
ReadX 13044 620 512 512
ReadX 13044 770 512 512
ReadX 13044 1282 512 512
ReadX 13044 1794 512 512
ReadX 13044 2000 512 512
ReadX 13044 1434 512 512
ReadX 13044 2050 512 512
ReadX 13044 2118 512 512
ReadX 13044 1715 512 512
ReadX 13044 1024 512 512
ReadX 13044 954 512 512
ReadX 13044 1880 512 512
ReadX 13044 1286 512 512
ReadX 13044 1510 512 512
ReadX 13044 2562 512 512
ReadX 13044 2610 512 512
ReadX 13044 3586 512 512
ReadX 13044 3812 512 512
ReadX 13044 3828 512 512
ReadX 13044 4046 512 512
ReadX 13044 4066 512 512
ReadX 13044 1747 512 512
ReadX 13044 1026 512 512
ReadX 13044 1538 512 512
ReadX 13044 514 512 512
ReadX 13044 751 512 512
ReadX 13044 1263 512 512
ReadX 13044 620 512 512
ReadX 13044 1132 512 512
ReadX 13044 1644 512 512
ReadX 13044 2156 512 512
ReadX 13044 2668 512 512
ReadX 13044 3180 512 512
ReadX 13044 3692 512 512
ReadX 13044 4204 394 394
ReadX 13044 606 118 118
ReadX 13044 724 512 512
ReadX 13044 1236 512 512
ReadX 13044 1748 512 512
ReadX 13044 2260 512 512
ReadX 13044 2772 512 512
ReadX 13044 3284 512 512
ReadX 13044 3796 394 394
ReadX 13044 636 118 118
ReadX 13044 754 512 512
ReadX 13044 1266 512 512
ReadX 13044 1778 512 512
ReadX 13044 2290 512 512
ReadX 13044 2802 512 512
ReadX 13044 3314 512 512
ReadX 13044 3826 512 512
ReadX 13044 4338 512 512
ReadX 13044 4850 512 512
ReadX 13044 5362 512 512
ReadX 13044 5874 512 512
ReadX 13044 6386 512 512
ReadX 13044 6898 512 512
ReadX 13044 7410 512 512
ReadX 13044 7922 512 512
ReadX 13044 8434 512 512
ReadX 13044 8946 512 512
ReadX 13044 9458 512 512
ReadX 13044 9970 512 512
ReadX 13044 10482 512 512
ReadX 13044 723 512 512
ReadX 13044 1235 512 512
ReadX 13044 725 512 512
ReadX 13044 729 512 512
ReadX 13044 1241 512 512
ReadX 13044 1753 512 512
ReadX 13044 2265 512 512
ReadX 13044 2777 512 512
ReadX 13044 3289 512 512
ReadX 13044 3801 512 512
ReadX 13044 4313 512 512
ReadX 13044 4825 512 512
ReadX 13044 5337 512 512
ReadX 13044 5849 512 512
ReadX 13044 6361 512 512
ReadX 13044 755 512 512
ReadX 13044 1267 512 512
ReadX 13044 1779 512 512
ReadX 13044 2291 512 512
ReadX 13044 2803 512 512
ReadX 13044 3315 512 512
ReadX 13044 3827 512 512
ReadX 13044 4339 244 244
ReadX 13044 4583 512 512
ReadX 13044 5095 268 268
ReadX 13044 5363 512 512
ReadX 13044 5875 512 512
ReadX 13044 6387 512 512
ReadX 13044 6899 512 512
ReadX 13044 7411 512 512
ReadX 13044 7923 512 512
ReadX 13044 8435 512 512
ReadX 13044 8947 512 512
ReadX 13044 9459 512 512
ReadX 13044 9971 512 512
ReadX 13044 10483 512 512
ReadX 13044 10995 512 512
ReadX 13044 11507 512 512
ReadX 13044 12019 512 512
ReadX 13044 12531 512 512
ReadX 13044 13043 512 512
ReadX 13044 13555 512 512
ReadX 13044 14067 512 512
ReadX 13044 14579 512 512
ReadX 13044 15091 512 512
ReadX 13044 15603 342 342
ReadX 13044 725 512 512
ReadX 13044 2000 512 512
ReadX 13044 3918 512 512
ReadX 13044 727 512 512
ReadX 13044 258 512 512
ReadX 13044 376 512 512
ReadX 13044 1109 512 512
ReadX 13044 1028 512 512
ReadX 13044 1540 512 512
ReadX 13044 2052 512 512
ReadX 13044 2564 512 512
ReadX 13044 3076 512 512
ReadX 13044 3588 512 512
ReadX 13044 4100 512 512
ReadX 13044 4612 412 412
ReadX 13044 1012 100 100
ReadX 13044 1112 512 512
ReadX 13044 1624 512 512
ReadX 13044 2136 512 512
ReadX 13044 2648 512 512
ReadX 13044 3160 512 512
ReadX 13044 3672 512 512
ReadX 13044 4184 412 412
ReadX 13044 1044 100 100
ReadX 13044 1144 512 512
ReadX 13044 1656 512 512
ReadX 13044 2168 512 512
ReadX 13044 2680 512 512
ReadX 13044 3192 512 512
ReadX 13044 3704 512 512
ReadX 13044 4216 512 512
ReadX 13044 4728 512 512
ReadX 13044 5240 512 512
ReadX 13044 5752 512 512
ReadX 13044 6264 512 512
ReadX 13044 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 13044 7288 512 512
ReadX 13044 7800 512 512
ReadX 13044 8312 512 512
ReadX 13044 8824 512 512
ReadX 13044 9336 512 512
ReadX 13044 9848 512 512
ReadX 13044 10360 512 512
ReadX 13044 10872 512 512
ReadX 13044 11384 512 512
ReadX 13044 11896 512 512
ReadX 13044 12408 512 512
ReadX 13044 1088 512 512
ReadX 13044 1600 512 512
ReadX 13044 1090 512 512
ReadX 13044 1094 512 512
ReadX 13044 1606 512 512
ReadX 13044 2118 512 512
ReadX 13044 2630 512 512
ReadX 13044 3142 512 512
ReadX 13044 3654 512 512
ReadX 13044 4166 512 512
ReadX 13044 4678 512 512
ReadX 13044 1111 512 512
ReadX 13044 1623 512 512
ReadX 13044 2135 512 512
ReadX 13044 2647 512 512
ReadX 13044 3159 512 512
ReadX 13044 3671 512 512
ReadX 13044 4183 512 512
ReadX 13044 4695 512 512
ReadX 13044 5207 512 512
ReadX 13044 5719 512 512
ReadX 13044 6231 512 512
ReadX 13044 6743 512 512
ReadX 13044 7255 512 512
ReadX 13044 7767 512 512
ReadX 13044 8279 512 512
ReadX 13044 8791 512 512
ReadX 13044 9303 512 512
ReadX 13044 9815 512 512
ReadX 13044 10327 512 512
ReadX 13044 10839 512 512
ReadX 13044 11351 294 294
ReadX 13044 1091 512 512
ReadX 13044 970 512 512
ReadX 13044 1093 512 512
ReadX 13044 1434 512 512
ReadX 13044 2050 512 512
ReadX 13044 2158 512 512
ReadX 13044 2118 512 512
ReadX 13044 2630 512 512
ReadX 13044 3142 512 512
ReadX 13044 3654 512 512
ReadX 13044 4166 512 512
ReadX 13044 4678 512 512
ReadX 13044 5190 512 512
ReadX 13044 5702 382 382
ReadX 13044 2104 130 130
ReadX 13044 2234 512 512
ReadX 13044 2746 512 512
ReadX 13044 3258 512 512
ReadX 13044 3770 512 512
ReadX 13044 4282 512 512
ReadX 13044 4794 512 512
ReadX 13044 5306 382 382
ReadX 13044 2134 130 130
ReadX 13044 2264 512 512
ReadX 13044 2776 512 512
ReadX 13044 3288 512 512
ReadX 13044 3800 512 512
ReadX 13044 4312 512 512
ReadX 13044 4824 512 512
ReadX 13044 5336 512 512
ReadX 13044 2147 512 512
ReadX 13044 2149 512 512
ReadX 13044 2152 512 512
ReadX 13044 2664 512 512
ReadX 13044 3176 512 512
ReadX 13044 3688 512 512
ReadX 13044 2159 512 512
ReadX 13044 2671 512 512
ReadX 13044 3183 512 512
ReadX 13044 3695 512 512
ReadX 13044 4207 512 512
ReadX 13044 4719 512 512
ReadX 13044 5231 512 512
ReadX 13044 5743 512 512
ReadX 13044 6255 512 512
ReadX 13044 6767 512 512
ReadX 13044 7279 512 512
ReadX 13044 7791 512 512
ReadX 13044 8303 512 512
ReadX 13044 8815 512 512
ReadX 13044 9327 512 512
ReadX 13044 9839 512 512
ReadX 13044 10351 512 512
ReadX 13044 10863 512 512
ReadX 13044 11375 512 512
ReadX 13044 11887 512 512
ReadX 13044 12399 38 38
ReadX 13044 2149 512 512
ReadX 13044 1794 512 512
ReadX 13044 2016 512 512
ReadX 13044 2151 512 512
ReadX 13044 1918 512 512
ReadX 13044 1880 512 512
ReadX 13044 2392 512 512
ReadX 13044 2904 512 512
ReadX 13044 3416 512 512
ReadX 13044 3928 512 512
ReadX 13044 4440 512 512
ReadX 13044 4952 512 512
ReadX 13044 5464 416 416
ReadX 13044 1866 96 96
ReadX 13044 1962 512 512
ReadX 13044 2474 512 512
ReadX 13044 2986 512 512
ReadX 13044 3498 512 512
ReadX 13044 4010 512 512
ReadX 13044 4522 512 512
ReadX 13044 5034 416 416
ReadX 13044 1896 96 96
ReadX 13044 1992 512 512
ReadX 13044 2504 512 512
ReadX 13044 3016 512 512
ReadX 13044 3528 512 512
ReadX 13044 1903 512 512
ReadX 13044 1905 512 512
ReadX 13044 1908 512 512
ReadX 13044 2420 512 512
ReadX 13044 2932 512 512
ReadX 13044 3444 512 512
ReadX 13044 3956 512 512
ReadX 13044 1919 512 512
ReadX 13044 2431 512 512
ReadX 13044 2943 512 512
ReadX 13044 3455 512 512
ReadX 13044 3967 512 512
ReadX 13044 4479 512 512
ReadX 13044 4991 512 512
ReadX 13044 5503 512 512
ReadX 13044 6015 512 512
ReadX 13044 6527 512 512
ReadX 13044 7039 512 512
ReadX 13044 7551 512 512
ReadX 13044 8063 512 512
ReadX 13044 8575 512 512
ReadX 13044 9087 512 512
ReadX 13044 9599 512 512
ReadX 13044 10111 512 512
ReadX 13044 10623 512 512
ReadX 13044 11135 512 512
ReadX 13044 11647 512 512
ReadX 13044 12159 322 322
ReadX 13044 1905 512 512
ReadX 13044 1846 512 512
ReadX 13044 1907 512 512
ReadX 13044 1860 268 268
ReadX 13044 1832 244 244
ReadX 13044 1846 512 512
ReadX 13044 2358 512 512
ReadX 13044 2870 512 512
ReadX 13044 3382 512 512
ReadX 13044 3894 512 512
ReadX 13044 4406 512 512
ReadX 13044 4918 512 512
ReadX 13044 1858 512 512
ReadX 13044 1859 512 512
ReadX 13044 1860 488 488
ReadX 13044 1832 24 24
ReadX 13044 1861 228 228
ReadX 13044 1832 284 284
ReadX 13044 2116 512 512
ReadX 13044 2628 512 512
ReadX 13044 3140 512 512
ReadX 13044 3652 512 512
ReadX 13044 4164 512 512
ReadX 13044 4676 512 512
ReadX 13044 5188 228 228
ReadX 13044 1862 284 284
ReadX 13044 2146 512 512
ReadX 13044 2658 38 38
ReadX 13044 1859 512 512
ReadX 13044 2047 512 512
ReadX 13044 2016 512 512
ReadX 13044 2528 512 512
ReadX 13044 3040 512 512
ReadX 13044 3552 512 512
ReadX 13044 4064 512 512
ReadX 13044 4576 512 512
ReadX 13044 5088 512 512
ReadX 13044 5600 424 424
ReadX 13044 2002 88 88
ReadX 13044 2090 512 512
ReadX 13044 2602 512 512
ReadX 13044 3114 512 512
ReadX 13044 3626 512 512
ReadX 13044 4138 512 512
ReadX 13044 4650 512 512
ReadX 13044 5162 424 424
ReadX 13044 2032 88 88
ReadX 13044 2120 512 512
ReadX 13044 2632 512 512
ReadX 13044 3144 512 512
ReadX 13044 3656 512 512
ReadX 13044 4168 512 512
ReadX 13044 4680 512 512
ReadX 13044 5192 512 512
ReadX 13044 2044 512 512
ReadX 13044 2045 512 512
ReadX 13044 2046 512 512
ReadX 13044 2047 512 512
ReadX 13044 2559 110 110
ReadX 13044 2052 402 402
ReadX 13044 2454 512 512
ReadX 13044 2966 512 512
ReadX 13044 3478 512 512
ReadX 13044 3990 512 512
ReadX 13044 4502 512 512
ReadX 13044 5014 512 512
ReadX 13044 5526 512 512
ReadX 13044 6038 512 512
ReadX 13044 6550 512 512
ReadX 13044 7062 512 512
ReadX 13044 7574 512 512
ReadX 13044 8086 512 512
ReadX 13044 8598 512 512
ReadX 13044 9110 512 512
ReadX 13044 9622 512 512
ReadX 13044 10134 512 512
ReadX 13044 10646 512 512
ReadX 13044 11158 512 512
ReadX 13044 11670 512 512
ReadX 13044 12182 512 512
ReadX 13044 12694 118 118
ReadX 13044 2045 512 512
ReadX 13044 1282 512 512
ReadX 13044 1343 512 512
ReadX 13044 1286 512 512
ReadX 13044 1798 512 512
ReadX 13044 2310 512 512
ReadX 13044 2822 512 512
ReadX 13044 3334 512 512
ReadX 13044 3846 512 512
ReadX 13044 4358 512 512
ReadX 13044 4870 416 416
ReadX 13044 1270 96 96
ReadX 13044 1366 512 512
ReadX 13044 1878 512 512
ReadX 13044 2390 512 512
ReadX 13044 2902 512 512
ReadX 13044 3414 512 512
ReadX 13044 3926 416 416
ReadX 13044 1284 96 96
ReadX 13044 1380 416 416
ReadX 13044 1302 96 96
ReadX 13044 1398 512 512
ReadX 13044 1910 512 512
ReadX 13044 2422 512 512
ReadX 13044 2934 512 512
ReadX 13044 3446 512 512
ReadX 13044 3958 512 512
ReadX 13044 4470 512 512
ReadX 13044 4982 512 512
ReadX 13044 5494 512 512
ReadX 13044 6006 512 512
ReadX 13044 6518 512 512
ReadX 13044 7030 512 512
ReadX 13044 7542 512 512
ReadX 13044 1328 512 512
ReadX 13044 1330 512 512
ReadX 13044 1333 512 512
ReadX 13044 1845 512 512
ReadX 13044 2357 512 512
ReadX 13044 2869 512 512
ReadX 13044 3381 512 512
ReadX 13044 1344 512 512
ReadX 13044 1856 512 512
ReadX 13044 2368 512 512
ReadX 13044 2880 512 512
ReadX 13044 3392 512 512
ReadX 13044 3904 512 512
ReadX 13044 4416 512 512
ReadX 13044 4928 512 512
ReadX 13044 5440 512 512
ReadX 13044 5952 512 512
ReadX 13044 6464 512 512
ReadX 13044 6976 512 512
ReadX 13044 7488 512 512
ReadX 13044 8000 512 512
ReadX 13044 8512 512 512
ReadX 13044 9024 512 512
ReadX 13044 9536 512 512
ReadX 13044 10048 512 512
ReadX 13044 10560 512 512
ReadX 13044 11072 512 512
ReadX 13044 11584 426 426
ReadX 13044 1330 512 512
ReadX 13044 1842 512 512
ReadX 13044 1250 512 512
ReadX 13044 1264 268 268
ReadX 13044 1236 244 244
ReadX 13044 1250 512 512
ReadX 13044 1762 512 512
ReadX 13044 2274 512 512
ReadX 13044 2786 512 512
ReadX 13044 3298 512 512
ReadX 13044 3810 512 512
ReadX 13044 4322 512 512
ReadX 13044 1262 512 512
ReadX 13044 1263 512 512
ReadX 13044 1264 488 488
ReadX 13044 1236 24 24
ReadX 13044 1265 228 228
ReadX 13044 1236 284 284
ReadX 13044 1520 512 512
ReadX 13044 2032 512 512
ReadX 13044 2544 512 512
ReadX 13044 3056 512 512
ReadX 13044 3568 512 512
ReadX 13044 4080 512 512
ReadX 13044 4592 228 228
ReadX 13044 1266 284 284
ReadX 13044 1550 512 512
ReadX 13044 2062 42 42
ReadX 13044 1263 512 512
ReadX 13044 1538 512 512
ReadX 13044 1640 512 512
ReadX 13044 1510 512 512
ReadX 13044 2022 512 512
ReadX 13044 2534 512 512
ReadX 13044 3046 512 512
ReadX 13044 3558 512 512
ReadX 13044 4070 512 512
ReadX 13044 4582 512 512
ReadX 13044 5094 408 408
ReadX 13044 1496 104 104
ReadX 13044 1600 512 512
ReadX 13044 2112 512 512
ReadX 13044 2624 512 512
ReadX 13044 3136 512 512
ReadX 13044 3648 512 512
ReadX 13044 4160 512 512
ReadX 13044 4672 408 408
ReadX 13044 1526 104 104
ReadX 13044 1630 512 512
ReadX 13044 2142 512 512
ReadX 13044 2654 512 512
ReadX 13044 3166 512 512
ReadX 13044 3678 512 512
ReadX 13044 4190 408 408
ReadX 13044 1540 104 104
ReadX 13044 1644 512 512
ReadX 13044 2156 512 512
ReadX 13044 2668 512 512
ReadX 13044 3180 512 512
ReadX 13044 3692 512 512
ReadX 13044 4204 512 512
ReadX 13044 4716 512 512
ReadX 13044 5228 512 512
ReadX 13044 5740 512 512
ReadX 13044 6252 512 512
ReadX 13044 6764 512 512
ReadX 13044 7276 512 512
ReadX 13044 7788 512 512
ReadX 13044 8300 512 512
ReadX 13044 8812 512 512
ReadX 13044 9324 512 512
ReadX 13044 9836 512 512
ReadX 13044 10348 512 512
ReadX 13044 10860 512 512
ReadX 13044 11372 512 512
ReadX 13044 1615 512 512
ReadX 13044 2127 512 512
ReadX 13044 1617 512 512
ReadX 13044 1621 512 512
ReadX 13044 2133 512 512
ReadX 13044 2645 512 512
ReadX 13044 3157 512 512
ReadX 13044 3669 512 512
ReadX 13044 4181 512 512
ReadX 13044 4693 512 512
ReadX 13044 5205 512 512
ReadX 13044 5717 512 512
ReadX 13044 6229 512 512
ReadX 13044 1641 512 512
ReadX 13044 2153 512 512
ReadX 13044 2665 512 512
ReadX 13044 3177 512 512
ReadX 13044 3689 512 512
ReadX 13044 4201 512 512
ReadX 13044 4713 512 512
ReadX 13044 5225 512 512
ReadX 13044 5737 512 512
ReadX 13044 6249 512 512
ReadX 13044 6761 512 512
ReadX 13044 7273 512 512
ReadX 13044 7785 512 512
ReadX 13044 8297 512 512
ReadX 13044 8809 512 512
ReadX 13044 9321 512 512
ReadX 13044 9833 512 512
ReadX 13044 10345 512 512
ReadX 13044 10857 512 512
ReadX 13044 11369 512 512
ReadX 13044 11881 2 2
ReadX 13044 1796 510 510
ReadX 13044 2306 512 512
ReadX 13044 2818 512 512
ReadX 13044 3330 512 512
ReadX 13044 3842 512 512
ReadX 13044 4354 512 512
ReadX 13044 4866 512 512
ReadX 13044 5378 512 512
ReadX 13044 5890 512 512
ReadX 13044 6402 512 512
ReadX 13044 6914 512 512
ReadX 13044 7426 512 512
ReadX 13044 7938 512 512
ReadX 13044 8450 512 512
ReadX 13044 8962 512 512
ReadX 13044 9474 512 512
ReadX 13044 9986 512 512
ReadX 13044 10498 326 326
ReadX 13044 1617 512 512
ReadX 13044 2129 512 512
ReadX 13044 1450 512 512
ReadX 13044 1621 512 512
ReadX 13044 1446 512 512
ReadX 13044 1450 512 512
ReadX 13044 1962 512 512
ReadX 13044 2474 512 512
ReadX 13044 2986 512 512
ReadX 13044 3498 512 512
ReadX 13044 4010 512 512
ReadX 13044 4522 512 512
ReadX 13044 5034 424 424
ReadX 13044 1436 88 88
ReadX 13044 1524 512 512
ReadX 13044 2036 512 512
ReadX 13044 2548 512 512
ReadX 13044 3060 512 512
ReadX 13044 1442 512 512
ReadX 13044 1443 512 512
ReadX 13044 1444 512 512
ReadX 13044 1446 512 512
ReadX 13044 1958 386 386
ReadX 13044 1466 126 126
ReadX 13044 1592 512 512
ReadX 13044 2104 512 512
ReadX 13044 2616 512 512
ReadX 13044 3128 512 512
ReadX 13044 3640 512 512
ReadX 13044 4152 512 512
ReadX 13044 4664 512 512
ReadX 13044 5176 512 512
ReadX 13044 5688 512 512
ReadX 13044 6200 512 512
ReadX 13044 6712 512 512
ReadX 13044 7224 512 512
ReadX 13044 7736 512 512
ReadX 13044 8248 512 512
ReadX 13044 8760 294 294
ReadX 13044 1443 512 512
ReadX 13044 964 512 512
ReadX 13044 970 512 512
ReadX 13044 1482 512 512
ReadX 13044 1994 512 512
ReadX 13044 2506 512 512
ReadX 13044 3018 512 512
ReadX 13044 3530 512 512
ReadX 13044 4042 512 512
ReadX 13044 4554 424 424
ReadX 13044 956 88 88
ReadX 13044 1044 512 512
ReadX 13044 1556 512 512
ReadX 13044 2068 512 512
ReadX 13044 2580 512 512
ReadX 13044 962 512 512
ReadX 13044 963 512 512
ReadX 13044 964 512 512
ReadX 13044 965 512 512
ReadX 13044 1477 512 512
ReadX 13044 1989 228 228
ReadX 13044 986 284 284
ReadX 13044 1270 512 512
ReadX 13044 1782 512 512
ReadX 13044 2294 512 512
ReadX 13044 2806 512 512
ReadX 13044 3318 512 512
ReadX 13044 3830 512 512
ReadX 13044 4342 512 512
ReadX 13044 4854 512 512
ReadX 13044 5366 512 512
ReadX 13044 5878 512 512
ReadX 13044 6390 512 512
ReadX 13044 6902 512 512
ReadX 13044 7414 42 42
ReadX 13044 963 512 512
ReadX 13044 2610 512 512
ReadX 13044 3812 512 512
ReadX 13044 3828 512 512
ReadX 13044 3969 512 512
ReadX 13044 3918 512 512
ReadX 13044 4430 512 512
ReadX 13044 4942 512 512
ReadX 13044 5454 512 512
ReadX 13044 5966 512 512
ReadX 13044 6478 512 512
ReadX 13044 6990 512 512
ReadX 13044 7502 424 424
ReadX 13044 3904 88 88
ReadX 13044 3992 512 512
ReadX 13044 4504 512 512
ReadX 13044 5016 512 512
ReadX 13044 5528 512 512
ReadX 13044 6040 512 512
ReadX 13044 6552 512 512
ReadX 13044 7064 424 424
ReadX 13044 3934 88 88
ReadX 13044 4022 512 512
ReadX 13044 4534 512 512
ReadX 13044 5046 512 512
ReadX 13044 5558 512 512
ReadX 13044 6070 512 512
ReadX 13044 6582 512 512
ReadX 13044 7094 512 512
ReadX 13044 7606 512 512
ReadX 13044 8118 512 512
ReadX 13044 8630 512 512
ReadX 13044 3953 512 512
ReadX 13044 4465 512 512
ReadX 13044 3956 512 512
ReadX 13044 3964 512 512
ReadX 13044 4476 512 512
ReadX 13044 4988 512 512
ReadX 13044 3970 512 512
ReadX 13044 4482 512 512
ReadX 13044 4994 512 512
ReadX 13044 5506 512 512
ReadX 13044 6018 512 512
ReadX 13044 6530 512 512
ReadX 13044 7042 512 512
ReadX 13044 7554 512 512
ReadX 13044 8066 512 512
ReadX 13044 8578 512 512
ReadX 13044 9090 512 512
ReadX 13044 9602 512 512
ReadX 13044 10114 512 512
ReadX 13044 10626 512 512
ReadX 13044 11138 512 512
ReadX 13044 11650 512 512
ReadX 13044 12162 512 512
ReadX 13044 12674 512 512
ReadX 13044 13186 512 512
ReadX 13044 13698 512 512
ReadX 13044 14210 134 134
ReadX 13044 3956 512 512
ReadX 13044 4468 512 512
ReadX 13044 4980 512 512
ReadX 13044 5492 512 512
ReadX 13044 3074 512 512
ReadX 13044 3246 512 512
ReadX 13044 3964 512 512
ReadX 13044 3330 512 512
ReadX 13044 3465 512 512
ReadX 13044 3246 512 512
ReadX 13044 3758 512 512
ReadX 13044 4270 512 512
ReadX 13044 4782 512 512
ReadX 13044 5294 512 512
ReadX 13044 5806 512 512
ReadX 13044 6318 512 512
ReadX 13044 6830 368 368
ReadX 13044 3232 144 144
ReadX 13044 3376 512 512
ReadX 13044 3888 512 512
ReadX 13044 4400 512 512
ReadX 13044 4912 512 512
ReadX 13044 5424 512 512
ReadX 13044 5936 512 512
ReadX 13044 6448 368 368
ReadX 13044 3262 144 144
ReadX 13044 3406 512 512
ReadX 13044 3918 512 512
ReadX 13044 4430 512 512
ReadX 13044 4942 512 512
ReadX 13044 5454 512 512
ReadX 13044 5966 512 512
ReadX 13044 6478 512 512
ReadX 13044 6990 512 512
ReadX 13044 7502 512 512
ReadX 13044 8014 512 512
ReadX 13044 8526 512 512
ReadX 13044 9038 512 512
ReadX 13044 9550 512 512
ReadX 13044 10062 512 512
ReadX 13044 10574 512 512
ReadX 13044 11086 512 512
ReadX 13044 11598 512 512
ReadX 13044 12110 512 512
ReadX 13044 12622 512 512
ReadX 13044 13134 512 512
ReadX 13044 13646 368 368
ReadX 13044 3332 144 144
ReadX 13044 3476 512 512
ReadX 13044 3988 512 512
ReadX 13044 4500 512 512
ReadX 13044 5012 512 512
ReadX 13044 5524 512 512
ReadX 13044 6036 512 512
ReadX 13044 6548 512 512
ReadX 13044 7060 512 512
ReadX 13044 7572 512 512
ReadX 13044 8084 512 512
ReadX 13044 8596 512 512
ReadX 13044 9108 512 512
ReadX 13044 9620 512 512
ReadX 13044 10132 512 512
ReadX 13044 10644 512 512
ReadX 13044 11156 512 512
ReadX 13044 11668 512 512
ReadX 13044 12180 512 512
ReadX 13044 12692 512 512
ReadX 13044 13204 512 512
ReadX 13044 3430 512 512
ReadX 13044 3942 512 512
ReadX 13044 3434 512 512
ReadX 13044 3435 512 512
ReadX 13044 3947 512 512
ReadX 13044 4459 512 512
ReadX 13044 4971 512 512
ReadX 13044 5483 512 512
ReadX 13044 5995 512 512
ReadX 13044 6507 512 512
ReadX 13044 7019 512 512
ReadX 13044 7531 512 512
ReadX 13044 8043 512 512
ReadX 13044 8555 512 512
ReadX 13044 9067 512 512
ReadX 13044 9579 512 512
ReadX 13044 10091 512 512
ReadX 13044 10603 512 512
ReadX 13044 11115 512 512
ReadX 13044 3467 512 512
ReadX 13044 3979 512 512
ReadX 13044 4491 512 512
ReadX 13044 5003 512 512
ReadX 13044 5515 512 512
ReadX 13044 6027 512 512
ReadX 13044 6539 512 512
ReadX 13044 7051 512 512
ReadX 13044 7563 512 512
ReadX 13044 8075 512 512
ReadX 13044 8587 512 512
ReadX 13044 9099 512 512
ReadX 13044 9611 512 512
ReadX 13044 10123 512 512
ReadX 13044 10635 512 512
ReadX 13044 11147 512 512
ReadX 13044 11659 512 512
ReadX 13044 12171 512 512
ReadX 13044 12683 512 512
ReadX 13044 13195 512 512
ReadX 13044 13707 56 56
ReadX 13044 13763 512 512
ReadX 13044 14275 456 456
ReadX 13044 14731 512 512
ReadX 13044 15243 512 512
ReadX 13044 15755 512 512
ReadX 13044 16267 512 512
ReadX 13044 16779 512 512
ReadX 13044 17291 512 512
ReadX 13044 17803 512 512
ReadX 13044 18315 512 512
ReadX 13044 18827 512 512
ReadX 13044 19339 512 512
ReadX 13044 19851 512 512
ReadX 13044 20363 512 512
ReadX 13044 20875 512 512
ReadX 13044 21387 512 512
ReadX 13044 21899 512 512
ReadX 13044 22411 512 512
ReadX 13044 22923 512 512
ReadX 13044 23435 512 512
ReadX 13044 23947 512 512
ReadX 13044 24459 512 512
ReadX 13044 24971 282 282
ReadX 13044 3434 512 512
ReadX 13044 2818 512 512
ReadX 13044 2870 512 512
ReadX 13044 3026 512 512
ReadX 13044 3538 512 512
ReadX 13044 2870 512 512
ReadX 13044 3382 512 512
ReadX 13044 3894 512 512
ReadX 13044 4406 512 512
ReadX 13044 4918 512 512
ReadX 13044 5430 512 512
ReadX 13044 5942 512 512
ReadX 13044 6454 374 374
ReadX 13044 2856 138 138
ReadX 13044 2994 512 512
ReadX 13044 3506 512 512
ReadX 13044 4018 512 512
ReadX 13044 4530 512 512
ReadX 13044 5042 512 512
ReadX 13044 5554 512 512
ReadX 13044 6066 374 374
ReadX 13044 2886 138 138
ReadX 13044 3024 512 512
ReadX 13044 3536 512 512
ReadX 13044 4048 512 512
ReadX 13044 4560 512 512
ReadX 13044 5072 512 512
ReadX 13044 5584 512 512
ReadX 13044 6096 512 512
ReadX 13044 6608 512 512
ReadX 13044 7120 512 512
ReadX 13044 7632 512 512
ReadX 13044 8144 512 512
ReadX 13044 8656 512 512
ReadX 13044 9168 512 512
ReadX 13044 9680 512 512
ReadX 13044 10192 512 512
ReadX 13044 10704 512 512
ReadX 13044 11216 512 512
ReadX 13044 11728 512 512
ReadX 13044 12240 512 512
ReadX 13044 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 13044 13264 512 512
ReadX 13044 13776 512 512
ReadX 13044 14288 512 512
ReadX 13044 14800 512 512
ReadX 13044 15312 512 512
ReadX 13044 15824 512 512
ReadX 13044 16336 512 512
ReadX 13044 16848 512 512
ReadX 13044 17360 512 512
ReadX 13044 17872 512 512
ReadX 13044 18384 512 512
ReadX 13044 18896 512 512
ReadX 13044 19408 512 512
ReadX 13044 19920 512 512
ReadX 13044 20432 512 512
ReadX 13044 20944 512 512
ReadX 13044 21456 512 512
ReadX 13044 21968 512 512
ReadX 13044 22480 512 512
ReadX 13044 22992 512 512
ReadX 13044 2998 512 512
ReadX 13044 3510 512 512
ReadX 13044 3001 512 512
ReadX 13044 3003 512 512
ReadX 13044 3515 512 512
ReadX 13044 4027 512 512
ReadX 13044 4539 512 512
ReadX 13044 5051 512 512
ReadX 13044 5563 512 512
ReadX 13044 6075 512 512
ReadX 13044 6587 512 512
ReadX 13044 7099 512 512
ReadX 13044 7611 512 512
ReadX 13044 8123 512 512
ReadX 13044 8635 512 512
ReadX 13044 3029 512 512
ReadX 13044 3541 512 512
ReadX 13044 4053 512 512
ReadX 13044 4565 512 512
ReadX 13044 5077 512 512
ReadX 13044 5589 512 512
ReadX 13044 6101 512 512
ReadX 13044 6613 512 512
ReadX 13044 7125 512 512
ReadX 13044 7637 512 512
ReadX 13044 8149 512 512
ReadX 13044 8661 512 512
ReadX 13044 9173 512 512
ReadX 13044 9685 512 512
ReadX 13044 10197 512 512
ReadX 13044 10709 512 512
ReadX 13044 11221 512 512
ReadX 13044 11733 512 512
ReadX 13044 12245 512 512
ReadX 13044 12757 512 512
ReadX 13044 13269 40 40
ReadX 13044 3076 472 472
ReadX 13044 3548 512 512
ReadX 13044 4060 512 512
ReadX 13044 4572 512 512
ReadX 13044 5084 512 512
ReadX 13044 5596 512 512
ReadX 13044 6108 512 512
ReadX 13044 6620 512 512
ReadX 13044 7132 512 512
ReadX 13044 7644 512 512
ReadX 13044 8156 512 512
ReadX 13044 8668 512 512
ReadX 13044 9180 512 512
ReadX 13044 9692 512 512
ReadX 13044 10204 512 512
ReadX 13044 10716 512 512
ReadX 13044 11228 512 512
ReadX 13044 11740 512 512
ReadX 13044 12252 512 512
ReadX 13044 12764 512 512
ReadX 13044 13276 310 310
ReadX 13044 3001 512 512
ReadX 13044 2562 512 512
ReadX 13044 2626 512 512
ReadX 13044 3003 512 512
ReadX 13044 2721 512 512
ReadX 13044 2626 512 512
ReadX 13044 3138 512 512
ReadX 13044 3650 512 512
ReadX 13044 4162 512 512
ReadX 13044 4674 512 512
ReadX 13044 5186 512 512
ReadX 13044 5698 512 512
ReadX 13044 6210 424 424
ReadX 13044 2612 88 88
ReadX 13044 2700 512 512
ReadX 13044 3212 512 512
ReadX 13044 3724 512 512
ReadX 13044 4236 512 512
ReadX 13044 4748 512 512
ReadX 13044 5260 512 512
ReadX 13044 5772 424 424
ReadX 13044 2642 88 88
ReadX 13044 2730 512 512
ReadX 13044 3242 512 512
ReadX 13044 3754 512 512
ReadX 13044 4266 512 512
ReadX 13044 4778 512 512
ReadX 13044 5290 512 512
ReadX 13044 5802 512 512
ReadX 13044 6314 512 512
ReadX 13044 6826 512 512
ReadX 13044 7338 512 512
ReadX 13044 7850 512 512
ReadX 13044 8362 512 512
ReadX 13044 8874 512 512
ReadX 13044 9386 512 512
ReadX 13044 9898 512 512
ReadX 13044 10410 512 512
ReadX 13044 10922 512 512
ReadX 13044 11434 512 512
ReadX 13044 11946 512 512
ReadX 13044 12458 512 512
ReadX 13044 2716 512 512
ReadX 13044 2717 512 512
ReadX 13044 2718 512 512
ReadX 13044 3230 512 512
ReadX 13044 2721 512 512
ReadX 13044 3233 512 512
ReadX 13044 3745 512 512
ReadX 13044 4257 512 512
ReadX 13044 4769 512 512
ReadX 13044 5281 512 512
ReadX 13044 5793 512 512
ReadX 13044 6305 512 512
ReadX 13044 6817 512 512
ReadX 13044 7329 512 512
ReadX 13044 7841 512 512
ReadX 13044 8353 512 512
ReadX 13044 8865 512 512
ReadX 13044 9377 512 512
ReadX 13044 9889 512 512
ReadX 13044 10401 512 512
ReadX 13044 10913 512 512
ReadX 13044 11425 512 512
ReadX 13044 11937 512 512
ReadX 13044 12449 512 512
ReadX 13044 12961 512 512
ReadX 13044 13473 512 512
ReadX 13044 13985 106 106
ReadX 13044 2820 406 406
ReadX 13044 3226 512 512
ReadX 13044 3738 512 512
ReadX 13044 4250 512 512
ReadX 13044 4762 512 512
ReadX 13044 5274 512 512
ReadX 13044 5786 512 512
ReadX 13044 6298 512 512
ReadX 13044 6810 512 512
ReadX 13044 7322 512 512
ReadX 13044 7834 512 512
ReadX 13044 8346 512 512
ReadX 13044 8858 512 512
ReadX 13044 9370 512 512
ReadX 13044 9882 512 512
ReadX 13044 10394 512 512
ReadX 13044 10906 512 512
ReadX 13044 11418 182 182
ReadX 13044 2717 512 512
ReadX 13044 258 512 512
ReadX 13044 470 512 512
ReadX 13044 376 512 512
ReadX 13044 888 512 512
ReadX 13044 1400 512 512
ReadX 13044 1912 512 512
ReadX 13044 2424 512 512
ReadX 13044 2936 512 512
ReadX 13044 3448 512 512
ReadX 13044 3960 424 424
ReadX 13044 362 88 88
ReadX 13044 450 512 512
ReadX 13044 962 512 512
ReadX 13044 1474 512 512
ReadX 13044 1986 512 512
ReadX 13044 2498 512 512
ReadX 13044 3010 512 512
ReadX 13044 3522 424 424
ReadX 13044 392 88 88
ReadX 13044 480 512 512
ReadX 13044 992 512 512
ReadX 13044 1504 512 512
ReadX 13044 2016 512 512
ReadX 13044 2528 512 512
ReadX 13044 3040 512 512
ReadX 13044 3552 512 512
ReadX 13044 4064 512 512
ReadX 13044 4576 512 512
ReadX 13044 5088 512 512
ReadX 13044 5600 512 512
ReadX 13044 6112 512 512
ReadX 13044 6624 512 512
ReadX 13044 7136 512 512
ReadX 13044 7648 512 512
ReadX 13044 8160 512 512
ReadX 13044 8672 512 512
ReadX 13044 9184 512 512
ReadX 13044 9696 512 512
ReadX 13044 10208 512 512
ReadX 13044 464 512 512
ReadX 13044 465 512 512
ReadX 13044 466 512 512
ReadX 13044 978 512 512
ReadX 13044 470 512 512
ReadX 13044 982 512 512
ReadX 13044 1494 512 512
ReadX 13044 2006 512 512
ReadX 13044 2518 512 512
ReadX 13044 3030 512 512
ReadX 13044 3542 512 512
ReadX 13044 4054 512 512
ReadX 13044 4566 512 512
ReadX 13044 5078 512 512
ReadX 13044 5590 512 512
ReadX 13044 6102 512 512
ReadX 13044 6614 512 512
ReadX 13044 7126 512 512
ReadX 13044 7638 512 512
ReadX 13044 8150 512 512
ReadX 13044 8662 512 512
ReadX 13044 9174 512 512
ReadX 13044 9686 512 512
ReadX 13044 10198 512 512
ReadX 13044 10710 333 333
ReadX 13044 11043 512 512
ReadX 13044 11555 179 179
ReadX 13044 11734 512 512
ReadX 13044 12246 512 512
ReadX 13044 12758 512 512
ReadX 13044 13270 512 512
ReadX 13044 13782 512 512
ReadX 13044 14294 512 512
ReadX 13044 14806 512 512
ReadX 13044 15318 512 512
ReadX 13044 15830 512 512
ReadX 13044 16342 512 512
ReadX 13044 16854 512 512
ReadX 13044 17366 512 512
ReadX 13044 17878 512 512
ReadX 13044 18390 512 512
ReadX 13044 18902 512 512
ReadX 13044 19414 512 512
ReadX 13044 19926 512 512
ReadX 13044 20438 512 512
ReadX 13044 20950 512 512
ReadX 13044 21462 512 512
ReadX 13044 21974 350 350
ReadX 13044 465 512 512
ReadX 13044 3812 512 512
ReadX 13044 4046 512 512
ReadX 13044 3828 512 512
ReadX 13044 256 512 512
ReadX 13044 260 512 512
ReadX 13044 4066 512 512
ReadX 13044 4578 512 512
ReadX 13044 5090 512 512
ReadX 13044 5602 512 512
ReadX 13044 6114 512 512
ReadX 13044 6626 512 512
ReadX 13044 7138 512 512
ReadX 13044 7650 394 394
ReadX 13044 4052 118 118
ReadX 13044 4170 512 512
ReadX 13044 4682 512 512
ReadX 13044 5194 512 512
ReadX 13044 5706 512 512
ReadX 13044 6218 512 512
ReadX 13044 6730 512 512
ReadX 13044 7242 394 394
ReadX 13044 4082 118 118
ReadX 13044 4200 512 512
ReadX 13044 4712 512 512
ReadX 13044 5224 512 512
ReadX 13044 5736 512 512
ReadX 13044 6248 512 512
ReadX 13044 6760 512 512
ReadX 13044 7272 512 512
ReadX 13044 7784 394 394
ReadX 13044 256 118 118
ReadX 13044 374 512 512
ReadX 13044 886 512 512
ReadX 13044 1398 512 512
ReadX 13044 1910 512 512
ReadX 13044 2422 512 512
ReadX 13044 2934 512 512
ReadX 13044 3446 512 512
ReadX 13044 3958 512 512
ReadX 13044 4470 512 512
ReadX 13044 4982 512 512
ReadX 13044 5494 512 512
ReadX 13044 6006 512 512
ReadX 13044 6518 512 512
ReadX 13044 7030 512 512
ReadX 13044 7542 512 512
ReadX 13044 8054 512 512
ReadX 13044 8566 512 512
ReadX 13044 9078 512 512
ReadX 13044 9590 512 512
ReadX 13044 10102 512 512
ReadX 13044 259 512 512
ReadX 13044 771 512 512
ReadX 13044 259 512 512
ReadX 13044 259 512 512
ReadX 13044 771 512 512
ReadX 13044 1283 512 512
ReadX 13044 1795 512 512
ReadX 13044 2307 512 512
ReadX 13044 2819 512 512
ReadX 13044 3331 512 512
ReadX 13044 3843 512 512
ReadX 13044 4355 512 512
ReadX 13044 4867 512 512
ReadX 13044 260 512 512
ReadX 13044 772 512 512
ReadX 13044 1284 512 512
ReadX 13044 1796 512 512
ReadX 13044 2308 512 512
ReadX 13044 2820 512 512
ReadX 13044 3332 512 512
ReadX 13044 3844 512 512
ReadX 13044 4356 512 512
ReadX 13044 4868 512 512
ReadX 13044 5380 512 512
ReadX 13044 5892 512 512
ReadX 13044 6404 512 512
ReadX 13044 6916 512 512
ReadX 13044 7428 512 512
ReadX 13044 7940 512 512
ReadX 13044 8452 512 512
ReadX 13044 8964 512 512
ReadX 13044 9476 512 512
ReadX 13044 9988 512 512
ReadX 13044 10500 378 378
ReadX 13044 10878 512 512
ReadX 13044 11390 134 134
ReadX 13044 11524 512 512
ReadX 13044 12036 512 512
ReadX 13044 12548 512 512
ReadX 13044 13060 512 512
ReadX 13044 13572 138 138
ReadX 13044 259 512 512
ReadX 13044 273 512 512
ReadX 13044 276 512 512
ReadX 13044 295 512 512
ReadX 13044 288 512 512
ReadX 13044 296 512 512
ReadX 13044 259 512 512
ReadX 13044 273 512 512
ReadX 13044 273 512 512
ReadX 13044 785 512 512
ReadX 13044 1297 512 512
ReadX 13044 1809 512 512
ReadX 13044 2321 512 512
ReadX 13044 274 512 512
ReadX 13044 274 512 512
ReadX 13044 274 497 497
ReadX 13044 272 15 15
ReadX 13044 287 512 512
ReadX 13044 799 512 512
ReadX 13044 273 512 512
ReadX 13044 785 512 512
ReadX 13044 1297 512 512
ReadX 13044 1809 512 512
ReadX 13044 2321 512 512
ReadX 13044 2833 317 317
ReadX 13044 274 195 195
ReadX 13044 469 512 512
ReadX 13044 981 512 512
ReadX 13044 1493 512 512
ReadX 13044 2005 512 512
ReadX 13044 2517 512 512
ReadX 13044 3029 512 512
ReadX 13044 3541 512 512
ReadX 13044 4053 512 512
ReadX 13044 4565 250 250
ReadX 13044 274 512 512
ReadX 13044 283 512 512
ReadX 13044 795 512 512
ReadX 13044 276 512 512
ReadX 13044 788 512 512
ReadX 13044 1300 512 512
ReadX 13044 1812 512 512
ReadX 13044 2324 512 512
ReadX 13044 2836 512 512
ReadX 13044 3348 512 512
ReadX 13044 3860 420 420
ReadX 13044 275 92 92
ReadX 13044 367 512 512
ReadX 13044 879 512 512
ReadX 13044 1391 512 512
ReadX 13044 1903 512 512
ReadX 13044 2415 512 512
ReadX 13044 2927 512 512
ReadX 13044 3439 420 420
ReadX 13044 277 92 92
ReadX 13044 369 512 512
ReadX 13044 881 512 512
ReadX 13044 1393 512 512
ReadX 13044 1905 512 512
ReadX 13044 2417 512 512
ReadX 13044 2929 512 512
ReadX 13044 3441 512 512
ReadX 13044 3953 512 512
ReadX 13044 4465 512 512
ReadX 13044 4977 512 512
ReadX 13044 5489 512 512
ReadX 13044 6001 512 512
ReadX 13044 6513 512 512
ReadX 13044 7025 512 512
ReadX 13044 7537 512 512
ReadX 13044 8049 512 512
ReadX 13044 8561 512 512
ReadX 13044 9073 512 512
ReadX 13044 9585 512 512
ReadX 13044 10097 512 512
ReadX 13044 282 512 512
ReadX 13044 794 512 512
ReadX 13044 1306 512 512
ReadX 13044 1818 512 512
ReadX 13044 2330 512 512
ReadX 13044 2842 512 512
ReadX 13044 3354 512 512
ReadX 13044 3866 512 512
ReadX 13044 4378 512 512
ReadX 13044 284 512 512
ReadX 13044 796 512 512
ReadX 13044 1308 512 512
ReadX 13044 1820 512 512
ReadX 13044 2332 512 512
ReadX 13044 2844 512 512
ReadX 13044 3356 512 512
ReadX 13044 3868 512 512
ReadX 13044 4380 512 512
ReadX 13044 4892 512 512
ReadX 13044 5404 512 512
ReadX 13044 5916 512 512
ReadX 13044 6428 512 512
ReadX 13044 6940 512 512
ReadX 13044 7452 512 512
ReadX 13044 7964 512 512
ReadX 13044 8476 512 512
ReadX 13044 8988 512 512
ReadX 13044 9500 512 512
ReadX 13044 10012 512 512
ReadX 13044 10524 472 472
ReadX 13044 288 40 40
ReadX 13044 328 512 512
ReadX 13044 840 512 512
ReadX 13044 1352 512 512
ReadX 13044 1864 512 512
ReadX 13044 2376 512 512
ReadX 13044 2888 512 512
ReadX 13044 3400 512 512
ReadX 13044 3912 512 512
ReadX 13044 4424 512 512
ReadX 13044 4936 512 512
ReadX 13044 5448 512 512
ReadX 13044 5960 512 512
ReadX 13044 6472 512 512
ReadX 13044 6984 512 512
ReadX 13044 7496 512 512
ReadX 13044 8008 512 512
ReadX 13044 8520 512 512
ReadX 13044 9032 512 512
ReadX 13044 9544 512 512
ReadX 13044 10056 512 512
ReadX 13044 10568 506 506
ReadX 13044 282 512 512
ReadX 13044 794 512 512
ReadX 13044 301 512 512
ReadX 13044 296 512 512
ReadX 13044 808 512 512
ReadX 13044 1320 512 512
ReadX 13044 1832 512 512
ReadX 13044 2344 512 512
ReadX 13044 2856 512 512
ReadX 13044 3368 512 512
ReadX 13044 3880 424 424
ReadX 13044 295 88 88
ReadX 13044 383 512 512
ReadX 13044 895 512 512
ReadX 13044 1407 512 512
ReadX 13044 1919 512 512
ReadX 13044 2431 512 512
ReadX 13044 2943 512 512
ReadX 13044 3455 424 424
ReadX 13044 297 88 88
ReadX 13044 385 512 512
ReadX 13044 897 512 512
ReadX 13044 1409 512 512
ReadX 13044 1921 512 512
ReadX 13044 2433 512 512
ReadX 13044 2945 512 512
ReadX 13044 3457 512 512
ReadX 13044 3969 512 512
ReadX 13044 4481 512 512
ReadX 13044 4993 512 512
ReadX 13044 5505 512 512
ReadX 13044 6017 512 512
ReadX 13044 6529 512 512
ReadX 13044 7041 512 512
ReadX 13044 7553 512 512
ReadX 13044 8065 512 512
ReadX 13044 8577 512 512
ReadX 13044 9089 512 512
ReadX 13044 9601 512 512
ReadX 13044 10113 512 512
ReadX 13044 301 512 512
ReadX 13044 301 512 512
ReadX 13044 301 512 512
ReadX 13044 813 512 512
ReadX 13044 301 512 512
ReadX 13044 813 512 512
ReadX 13044 1325 512 512
ReadX 13044 1837 512 512
ReadX 13044 2349 512 512
ReadX 13044 2861 512 512
ReadX 13044 3373 512 512
ReadX 13044 3885 512 512
ReadX 13044 4397 512 512
ReadX 13044 4909 512 512
ReadX 13044 5421 512 512
ReadX 13044 5933 512 512
ReadX 13044 6445 512 512
ReadX 13044 6957 512 512
ReadX 13044 7469 512 512
ReadX 13044 7981 512 512
ReadX 13044 8493 512 512
ReadX 13044 9005 512 512
ReadX 13044 9517 463 463
ReadX 13044 9980 512 512
ReadX 13044 10492 49 49
ReadX 13044 10541 512 512
ReadX 13044 11053 512 512
ReadX 13044 11565 512 512
ReadX 13044 12077 512 512
ReadX 13044 12589 512 512
ReadX 13044 13101 512 512
ReadX 13044 13613 512 512
ReadX 13044 14125 512 512
ReadX 13044 14637 512 512
ReadX 13044 15149 512 512
ReadX 13044 15661 512 512
ReadX 13044 16173 512 512
ReadX 13044 16685 512 512
ReadX 13044 17197 512 512
ReadX 13044 17709 512 512
ReadX 13044 18221 512 512
ReadX 13044 18733 512 512
ReadX 13044 19245 512 512
ReadX 13044 19757 512 512
ReadX 13044 20269 512 512
ReadX 13044 20781 326 326
ReadX 13044 301 512 512
QUERY_FS_INFORMATION 259
Close 13042
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13045
Close 13045
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13046
ReadX 13046 0 24 24
Close 13046
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13047
QUERY_FILE_INFORMATION 13047
ReadX 13047 0 512 512
ReadX 13047 476 512 512
ReadX 13047 510 512 512
ReadX 13047 484 512 512
ReadX 13047 474 512 512
ReadX 13047 478 512 512
ReadX 13047 990 512 512
ReadX 13047 509 57 57
Close 13047
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13048
QUERY_FILE_INFORMATION 13048
ReadX 13048 0 512 512
ReadX 13048 476 512 512
ReadX 13048 510 512 512
ReadX 13048 484 512 512
ReadX 13048 480 512 512
ReadX 13048 474 512 512
ReadX 13048 478 512 512
QUERY_FILE_INFORMATION 13048
WriteX 13048 494 60 60
WriteX 13048 494 4 4
QUERY_FILE_INFORMATION 13048
WriteX 13048 494 11 11
WriteX 13048 510 512 512
WriteX 13048 484 512 512
WriteX 13048 474 512 512
WriteX 13048 478 512 512
WriteX 13048 990 512 512
Close 13048
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13049
Close 13049
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13050
Close 13050
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13052
WriteX 13052 4607 1 1
QUERY_FILE_INFORMATION 13052
WriteX 13052 0 65471 65471
WriteX 13052 65471 65 65
WriteX 13052 65536 19490 19490
Close 13052
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13053
QUERY_FILE_INFORMATION 13053
ReadX 13053 0 512 512
ReadX 13053 482 512 512
ReadX 13053 994 512 512
ReadX 13053 1506 512 512
ReadX 13053 480 512 512
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 490 448 448
QUERY_FILE_INFORMATION 13053
WriteX 13053 490 60 60
WriteX 13053 490 4 4
QUERY_FILE_INFORMATION 13053
WriteX 13053 490 11 11
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 484 512 512
WriteX 13053 996 512 512
WriteX 13053 1508 512 512
WriteX 13053 482 512 512
WriteX 13053 0 512 512
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
ReadX 13053 490 512 512
WriteX 13053 502 512 512
WriteX 13053 502 292 292
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 503 20 20
WriteX 13053 503 108 108
QUERY_FILE_INFORMATION 13053
WriteX 13053 504 448 448
QUERY_FILE_INFORMATION 13053
WriteX 13053 504 44 44
WriteX 13053 504 20 20
WriteX 13053 500 512 512
WriteX 13053 492 512 512
WriteX 13053 496 512 512
WriteX 13053 1008 512 512
WriteX 13053 494 512 512
Flush 13053
WriteX 13053 0 512 512
Flush 13053
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 500 512 512
WriteX 13053 492 512 512
WriteX 13053 496 512 512
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 518 320 320
QUERY_FILE_INFORMATION 13053
WriteX 13053 518 60 60
ReadX 13053 504 512 512
WriteX 13053 522 512 512
WriteX 13053 506 3204 3204
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 519 25 25
WriteX 13053 518 103 103
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 519 44 44
WriteX 13053 519 20 20
WriteX 13053 520 512 512
WriteX 13053 482 512 512
WriteX 13053 486 512 512
WriteX 13053 998 512 512
WriteX 13053 484 512 512
WriteX 13053 490 512 512
Flush 13053
WriteX 13053 0 512 512
Flush 13053
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
QUERY_FILE_INFORMATION 13053
WriteX 13053 519 7 7
WriteX 13053 519 57 57
WriteX 13053 520 512 512
WriteX 13053 492 512 512
WriteX 13053 482 512 512
WriteX 13053 486 512 512
WriteX 13053 998 512 512
Flush 13053
WriteX 13053 520 512 512
Flush 13053
Close 13053
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13054
Close 13054
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13055
QUERY_FILE_INFORMATION 13055
ReadX 13055 0 512 512
ReadX 13055 490 512 512
ReadX 13055 484 512 512
ReadX 13055 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13056
Close 13056
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13055
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13057
Close 13057
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13058
ReadX 13058 0 24 24
Close 13058
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13059
QUERY_FILE_INFORMATION 13059
ReadX 13059 0 512 512
ReadX 13059 366 512 512
ReadX 13059 878 512 512
ReadX 13059 1390 512 512
ReadX 13059 1902 512 512
ReadX 13059 374 57 57
Close 13059
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13060
QUERY_FILE_INFORMATION 13060
ReadX 13060 0 512 512
ReadX 13060 366 512 512
ReadX 13060 878 512 512
ReadX 13060 1390 512 512
ReadX 13060 1902 512 512
QUERY_FILE_INFORMATION 13060
WriteX 13060 374 60 60
WriteX 13060 374 4 4
QUERY_FILE_INFORMATION 13060
WriteX 13060 374 11 11
ReadX 13060 374 57 57
ReadX 13060 374 57 57
ReadX 13060 292 4096 4096
ReadX 13060 364 512 512
ReadX 13060 512 4096 4096
ReadX 13060 4608 4096 4096
ReadX 13060 8704 4096 4096
ReadX 13060 12800 4096 4096
ReadX 13060 16896 4096 4096
ReadX 13060 20992 4096 4096
ReadX 13060 25088 4096 4096
ReadX 13060 29184 4096 4096
ReadX 13060 33280 4096 4096
ReadX 13060 37376 4096 4096
ReadX 13060 41472 4096 4096
ReadX 13060 45568 4096 4096
ReadX 13060 49664 4096 4096
ReadX 13060 53760 4096 4096
ReadX 13060 57856 4096 4096
ReadX 13060 61952 4096 4096
ReadX 13060 66048 4096 4096
ReadX 13060 70144 4096 4096
ReadX 13060 74240 162 162
ReadX 13060 308 4096 4096
ReadX 13060 4404 4096 4096
WriteX 13060 368 512 512
WriteX 13060 880 512 512
WriteX 13060 1392 512 512
Close 13060
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13061
Close 13061
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13062
QUERY_FILE_INFORMATION 13062
ReadX 13062 0 512 512
ReadX 13062 366 512 512
ReadX 13062 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13063
Close 13063
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13062
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13065
WriteX 13065 4607 1 1
QUERY_FILE_INFORMATION 13065
WriteX 13065 0 65471 65471
WriteX 13065 65471 65 65
WriteX 13065 65536 8866 8866
Close 13065
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13066
QUERY_FILE_INFORMATION 13066
ReadX 13066 0 512 512
ReadX 13066 366 512 512
ReadX 13066 878 512 512
ReadX 13066 1390 512 512
ReadX 13066 364 512 512
QUERY_FILE_INFORMATION 13066
QUERY_FILE_INFORMATION 13066
QUERY_FILE_INFORMATION 13066
WriteX 13066 374 448 448
QUERY_FILE_INFORMATION 13066
WriteX 13066 374 60 60
WriteX 13066 374 4 4
QUERY_FILE_INFORMATION 13066
WriteX 13066 374 11 11
QUERY_FILE_INFORMATION 13066
QUERY_FILE_INFORMATION 13066
WriteX 13066 374 7 7
WriteX 13066 374 57 57
WriteX 13066 368 512 512
WriteX 13066 880 512 512
WriteX 13066 1392 512 512
WriteX 13066 366 512 512
WriteX 13066 0 512 512
Flush 13066
WriteX 13066 368 512 512
Flush 13066
Close 13066
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13067
QUERY_FILE_INFORMATION 13067
ReadX 13067 0 512 512
ReadX 13067 366 512 512
ReadX 13067 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13067
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13068
Close 13068
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13069
ReadX 13069 0 24 24
Close 13069
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13070
QUERY_FILE_INFORMATION 13070
ReadX 13070 0 512 512
ReadX 13070 366 512 512
ReadX 13070 878 512 512
ReadX 13070 1390 512 512
ReadX 13070 1902 512 512
ReadX 13070 374 57 57
Close 13070
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13071
QUERY_FILE_INFORMATION 13071
ReadX 13071 0 512 512
ReadX 13071 366 512 512
ReadX 13071 878 512 512
ReadX 13071 1390 512 512
ReadX 13071 1902 512 512
QUERY_FILE_INFORMATION 13071
WriteX 13071 374 60 60
WriteX 13071 374 4 4
QUERY_FILE_INFORMATION 13071
WriteX 13071 374 11 11
WriteX 13071 368 512 512
WriteX 13071 880 512 512
WriteX 13071 1392 512 512
Close 13071
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13072
Close 13072
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13073
Close 13073
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13075
WriteX 13075 4607 1 1
QUERY_FILE_INFORMATION 13075
WriteX 13075 0 65471 65471
WriteX 13075 65471 65 65
WriteX 13075 65536 9298 9298
Close 13075
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13076
QUERY_FILE_INFORMATION 13076
ReadX 13076 0 512 512
ReadX 13076 368 512 512
ReadX 13076 880 512 512
ReadX 13076 1392 512 512
ReadX 13076 366 512 512
QUERY_FILE_INFORMATION 13076
QUERY_FILE_INFORMATION 13076
QUERY_FILE_INFORMATION 13076
WriteX 13076 376 448 448
QUERY_FILE_INFORMATION 13076
WriteX 13076 376 60 60
WriteX 13076 376 4 4
QUERY_FILE_INFORMATION 13076
WriteX 13076 376 11 11
QUERY_FILE_INFORMATION 13076
QUERY_FILE_INFORMATION 13076
WriteX 13076 376 7 7
WriteX 13076 376 57 57
WriteX 13076 370 512 512
WriteX 13076 882 512 512
WriteX 13076 1394 512 512
WriteX 13076 368 512 512
WriteX 13076 0 512 512
Flush 13076
WriteX 13076 370 512 512
Flush 13076
Close 13076
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13077
Close 13077
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13078
QUERY_FILE_INFORMATION 13078
ReadX 13078 0 512 512
ReadX 13078 368 512 512
ReadX 13078 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13079
Close 13079
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13081
Close 13081
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13082
ReadX 13082 0 24 24
Close 13082
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13083
QUERY_FILE_INFORMATION 13083
ReadX 13083 0 512 512
ReadX 13083 512 512 512
ReadX 13083 1024 512 512
ReadX 13083 2016 512 512
ReadX 13083 1056 512 512
ReadX 13083 1096 57 57
Close 13083
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13084
QUERY_FILE_INFORMATION 13084
ReadX 13084 0 512 512
ReadX 13084 512 512 512
ReadX 13084 1024 512 512
ReadX 13084 2016 512 512
ReadX 13084 1056 512 512
ReadX 13084 1096 57 57
ReadX 13084 1096 57 57
ReadX 13084 1088 62 62
ReadX 13084 1536 4096 4096
ReadX 13084 5632 4096 4096
ReadX 13084 9728 4096 4096
ReadX 13084 13824 2859 2859
ReadX 13084 1120 28 28
ReadX 13084 1148 20 20
ReadX 13084 1168 8 8
ReadX 13084 1176 88 88
ReadX 13084 1264 8 8
ReadX 13084 1272 4 4
ReadX 13084 1276 4 4
ReadX 13084 1280 1 1
ReadX 13084 1130 4 4
ReadX 13084 1134 4 4
ReadX 13084 1138 1 1
ReadX 13084 1131 4 4
ReadX 13084 1135 4 4
ReadX 13084 1139 1 1
ReadX 13084 1131 4 4
ReadX 13084 1135 4 4
ReadX 13084 1139 2 2
ReadX 13084 1132 4 4
ReadX 13084 1136 4 4
ReadX 13084 1140 25 25
ReadX 13084 1134 4 4
ReadX 13084 1138 8 8
ReadX 13084 1146 4 4
ReadX 13084 1150 8 8
ReadX 13084 1158 4 4
ReadX 13084 1162 8 8
ReadX 13084 1170 4 4
ReadX 13084 1174 4 4
ReadX 13084 1178 4 4
ReadX 13084 1182 4 4
ReadX 13084 1186 4 4
ReadX 13084 1190 4 4
ReadX 13084 1194 13900 13900
ReadX 13084 2048 4096 4096
Close 13084
QUERY_FS_INFORMATION 259
Close 13078
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13085
Close 13085
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13086
ReadX 13086 0 24 24
Close 13086
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13087
QUERY_FILE_INFORMATION 13087
ReadX 13087 0 512 512
ReadX 13087 368 512 512
ReadX 13087 880 512 512
ReadX 13087 1392 512 512
ReadX 13087 1904 512 512
ReadX 13087 376 57 57
Close 13087
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13088
QUERY_FILE_INFORMATION 13088
ReadX 13088 0 512 512
ReadX 13088 368 512 512
ReadX 13088 880 512 512
ReadX 13088 1392 512 512
ReadX 13088 1904 512 512
QUERY_FILE_INFORMATION 13088
WriteX 13088 376 60 60
WriteX 13088 376 4 4
QUERY_FILE_INFORMATION 13088
WriteX 13088 376 11 11
WriteX 13088 370 512 512
WriteX 13088 882 512 512
WriteX 13088 1394 512 512
Close 13088
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13089
Close 13089
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13090
Close 13090
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13092
WriteX 13092 4607 1 1
QUERY_FILE_INFORMATION 13092
WriteX 13092 0 65471 65471
WriteX 13092 65471 65 65
WriteX 13092 65536 11540 11540
Close 13092
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13093
QUERY_FILE_INFORMATION 13093
ReadX 13093 0 512 512
ReadX 13093 398 512 512
ReadX 13093 910 512 512
ReadX 13093 1422 512 512
ReadX 13093 396 512 512
QUERY_FILE_INFORMATION 13093
QUERY_FILE_INFORMATION 13093
QUERY_FILE_INFORMATION 13093
WriteX 13093 406 448 448
QUERY_FILE_INFORMATION 13093
WriteX 13093 406 60 60
WriteX 13093 406 4 4
QUERY_FILE_INFORMATION 13093
WriteX 13093 406 11 11
QUERY_FILE_INFORMATION 13093
QUERY_FILE_INFORMATION 13093
WriteX 13093 406 7 7
WriteX 13093 406 57 57
WriteX 13093 400 512 512
WriteX 13093 912 512 512
WriteX 13093 1424 512 512
WriteX 13093 398 512 512
WriteX 13093 0 512 512
Flush 13093
WriteX 13093 400 512 512
Flush 13093
Close 13093
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13094
Close 13094
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13095
QUERY_FILE_INFORMATION 13095
ReadX 13095 0 512 512
ReadX 13095 398 512 512
ReadX 13095 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13096
Close 13096
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13095
ReadX 13044 1434 512 512
Close 13044
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13097
WriteX 13097 0 65471 65471
WriteX 13097 65471 63 63
WriteX 13097 65534 65471 65471
WriteX 13097 131005 63 63
Close 13097
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13098
WriteX 13098 0 65471 65471
WriteX 13098 65471 63 63
WriteX 13098 65534 65471 65471
WriteX 13098 131005 63 63
WriteX 13098 131068 65471 65471
WriteX 13098 196539 63 63
WriteX 13098 196602 65471 65471
WriteX 13098 262073 63 63
Close 13098
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13099
WriteX 13099 0 65471 65471
WriteX 13099 65471 63 63
WriteX 13099 65534 65471 65471
WriteX 13099 131005 63 63
WriteX 13099 131068 65471 65471
WriteX 13099 196539 63 63
WriteX 13099 196602 65471 65471
WriteX 13099 262073 63 63
WriteX 13099 262136 65471 65471
WriteX 13099 327607 63 63
WriteX 13099 327670 65471 65471
WriteX 13099 393141 63 63
WriteX 13099 393204 65471 65471
WriteX 13099 458675 63 63
WriteX 13099 458738 65471 65471
WriteX 13099 524209 63 63
Close 13099
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13100
Close 13100
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13101
ReadX 13101 0 512 512
ReadX 13101 512 511 511
ReadX 13101 1023 512 512
ReadX 13101 1535 512 512
Close 13101
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13102
ReadX 13102 0 512 512
ReadX 13102 512 510 510
ReadX 13102 1022 512 512
ReadX 13102 1534 510 510
ReadX 13102 2044 510 510
Close 13102
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13103
ReadX 13103 0 512 512
ReadX 13103 512 512 512
ReadX 13103 1024 512 512
ReadX 13103 1536 512 512
ReadX 13103 2048 512 512
ReadX 13103 2560 512 512
ReadX 13103 3072 512 512
ReadX 13103 3584 512 512
ReadX 13103 4096 512 512
ReadX 13103 4608 512 512
ReadX 13103 5120 512 512
ReadX 13103 5632 512 512
ReadX 13103 6144 512 512
ReadX 13103 6656 512 512
ReadX 13103 7168 512 512
ReadX 13103 7680 512 512
ReadX 13103 8192 512 512
ReadX 13103 8704 512 512
Close 13103
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13104
Close 13104
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13105
QUERY_FILE_INFORMATION 13105
Close 13105
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13106
ReadX 13106 0 8192 8192
Close 13106
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13107
Close 13107
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13108
QUERY_FILE_INFORMATION 13108
Close 13108
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13109
ReadX 13109 0 8192 8192
Close 13109
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13110
Close 13110
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13111
QUERY_FILE_INFORMATION 13111
Close 13111
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13112
ReadX 13112 0 8192 8192
Close 13112
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13113
ReadX 13113 0 8192 8192
ReadX 13113 8192 8192 8192
ReadX 13113 16384 8192 8192
ReadX 13113 24576 8192 8192
Close 13113
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13115
Close 13115
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13117
WriteX 13117 8191 1 1
QUERY_FILE_INFORMATION 13117
WriteX 13117 0 10438 10438
Close 13117
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13118
Close 13118
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13119
QUERY_FILE_INFORMATION 13119
QUERY_FILE_INFORMATION 13119
Close 13119
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13120
QUERY_FILE_INFORMATION 13120
QUERY_FILE_INFORMATION 13120
Close 13120
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13121
Close 13121
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13122
QUERY_FILE_INFORMATION 13122
QUERY_FILE_INFORMATION 13122
Close 13122
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13123
QUERY_FILE_INFORMATION 13123
QUERY_FILE_INFORMATION 13123
Close 13123
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13124
Close 13124
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13125
QUERY_FILE_INFORMATION 13125
QUERY_FILE_INFORMATION 13125
Close 13125
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13126
QUERY_FILE_INFORMATION 13126
QUERY_FILE_INFORMATION 13126
Close 13126
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13127
Close 13127
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13128
QUERY_FILE_INFORMATION 13128
QUERY_FILE_INFORMATION 13128
Close 13128
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13129
ReadX 13129 0 8 8
ReadX 13129 8 4 4
ReadX 13129 12 8 8
ReadX 13129 22 8 8
ReadX 13129 520 8 8
ReadX 13129 525 8 8
ReadX 13129 533 4 4
ReadX 13129 543 8 8
ReadX 13129 551 4 4
ReadX 13129 1058 8 8
ReadX 13129 1066 4 4
ReadX 13129 1081 8 8
ReadX 13129 1089 4 4
ReadX 13129 660 8 8
Close 13129
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13130
ReadX 13130 0 8192 8192
Close 13130
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13131
ReadX 13131 0 8192 8192
ReadX 13131 520 8192 8192
ReadX 13131 8712 8192 8192
ReadX 13131 16904 8192 8192
ReadX 13131 25096 8192 8192
ReadX 13131 33288 8192 8192
ReadX 13131 41480 8192 8192
ReadX 13131 49672 8192 8192
ReadX 13131 57864 8192 8192
ReadX 13131 66056 8192 8192
ReadX 13131 74248 8192 8192
ReadX 13131 82440 8192 8192
ReadX 13131 90632 8192 8192
ReadX 13131 98824 8192 8192
ReadX 13131 107016 8192 8192
ReadX 13131 115208 8192 8192
ReadX 13131 123400 8192 8192
ReadX 13131 131592 8192 8192
ReadX 13131 139784 8192 8192
ReadX 13131 147976 8192 8192
ReadX 13131 156168 8192 8192
Close 13131
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13132
QUERY_FILE_INFORMATION 13132
Close 13132
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13133
Close 13133
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13135
WriteX 13135 8191 1 1
QUERY_FILE_INFORMATION 13135
WriteX 13135 0 28489 28489
Close 13135
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13136
Close 13136
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13137
Close 13137
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13138
QUERY_FILE_INFORMATION 13138
Close 13138
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13139
ReadX 13139 0 8192 8192
Close 13139
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13140
Close 13140
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13141
QUERY_FILE_INFORMATION 13141
Close 13141
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13142
ReadX 13142 0 8192 8192
Close 13142
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13143
ReadX 13143 0 8192 8192
ReadX 13143 8192 8192 8192
ReadX 13143 16384 8192 8192
ReadX 13143 24576 8192 8192
ReadX 13143 32768 16384 16384
ReadX 13143 49152 8192 8192
ReadX 13143 57344 8192 8192
ReadX 13143 65536 8192 8192
Close 13143
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13145
Close 13145
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13147
WriteX 13147 8191 1 1
QUERY_FILE_INFORMATION 13147
WriteX 13147 0 29253 29253
Close 13147
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13148
Close 13148
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13149
QUERY_FILE_INFORMATION 13149
QUERY_FILE_INFORMATION 13149
Close 13149
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13150
QUERY_FILE_INFORMATION 13150
QUERY_FILE_INFORMATION 13150
Close 13150
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13151
QUERY_FILE_INFORMATION 13151
Close 13151
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13152
Close 13152
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13154
WriteX 13154 8191 1 1
QUERY_FILE_INFORMATION 13154
WriteX 13154 0 30183 30183
Close 13154
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13155
Close 13155
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13156
WriteX 13156 0 510 510
WriteX 13156 510 512 512
WriteX 13156 1022 510 510
WriteX 13156 1532 510 510
WriteX 13156 2042 168 168
Close 13156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13157
Close 13157
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13158
WriteX 13158 0 511 511
WriteX 13158 511 512 512
WriteX 13158 1023 512 512
WriteX 13158 1535 488 488
Close 13158
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13159
ReadX 13159 0 65471 65471
ReadX 13159 65471 63 63
ReadX 13159 65534 65471 65471
ReadX 13159 131005 63 63
ReadX 13159 131068 65471 65471
ReadX 13159 196539 63 63
ReadX 13159 196602 65471 65471
ReadX 13159 262073 63 63
ReadX 13159 262136 65471 65471
ReadX 13159 327607 63 63
ReadX 13159 327670 10 10
Close 13159
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13160
ReadX 13160 0 65471 65471
ReadX 13160 65471 63 63
ReadX 13160 65534 65471 65471
ReadX 13160 131005 63 63
ReadX 13160 131068 65471 65471
ReadX 13160 196539 63 63
ReadX 13160 196602 65471 65471
ReadX 13160 262073 63 63
ReadX 13160 262136 65471 65471
ReadX 13160 327607 63 63
ReadX 13160 327670 65471 65471
ReadX 13160 393141 63 63
ReadX 13160 393204 65471 65471
ReadX 13160 458675 63 63
ReadX 13160 458738 65471 65471
ReadX 13160 524209 63 63
ReadX 13160 524272 65471 65471
ReadX 13160 589743 63 63
ReadX 13160 589806 65471 65471
ReadX 13160 655277 63 63
ReadX 13160 655340 32 32
Close 13160
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13161
ReadX 13161 0 65471 65471
ReadX 13161 65471 63 63
ReadX 13161 65534 65471 65471
ReadX 13161 131005 63 63
ReadX 13161 131068 65471 65471
ReadX 13161 196539 63 63
ReadX 13161 196602 65471 65471
ReadX 13161 262073 63 63
ReadX 13161 262136 65471 65471
ReadX 13161 327607 63 63
ReadX 13161 327670 65471 65471
ReadX 13161 393141 63 63
ReadX 13161 393204 65471 65471
ReadX 13161 458675 63 63
ReadX 13161 458738 65471 65471
ReadX 13161 524209 63 63
ReadX 13161 524272 65471 65471
ReadX 13161 589743 63 63
ReadX 13161 589806 65471 65471
ReadX 13161 655277 63 63
ReadX 13161 655340 65471 65471
ReadX 13161 720811 63 63
ReadX 13161 720874 65471 65471
ReadX 13161 786345 63 63
ReadX 13161 786408 65471 65471
ReadX 13161 851879 63 63
ReadX 13161 851942 65471 65471
ReadX 13161 917413 63 63
ReadX 13161 917476 65471 65471
ReadX 13161 982947 63 63
ReadX 13161 983010 65471 65471
ReadX 13161 1048481 63 63
ReadX 13161 1048544 65471 65471
ReadX 13161 1114015 63 63
ReadX 13161 1114078 65471 65471
ReadX 13161 1179549 63 63
ReadX 13161 1179612 65471 65471
ReadX 13161 1245083 63 63
ReadX 13161 1245146 65471 65471
ReadX 13161 1310617 63 63
ReadX 13161 1310680 65471 65471
ReadX 13161 1376151 63 63
ReadX 13161 1376214 65471 65471
ReadX 13161 1441685 63 63
ReadX 13161 1441748 65471 65471
ReadX 13161 1507219 63 63
ReadX 13161 1507282 65471 65471
ReadX 13161 1572753 63 63
ReadX 13161 1572816 65471 65471
ReadX 13161 1638287 63 63
ReadX 13161 1638350 65471 65471
ReadX 13161 1703821 63 63
ReadX 13161 1703884 65471 65471
ReadX 13161 1769355 63 63
ReadX 13161 1769418 65471 65471
ReadX 13161 1834889 63 63
ReadX 13161 1834952 32824 32824
Close 13161
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13162
QUERY_FILE_INFORMATION 13162
ReadX 13162 0 512 512
ReadX 13162 512 512 512
ReadX 13162 1024 512 512
QUERY_FILE_INFORMATION 13162
QUERY_FILE_INFORMATION 13162
ReadX 13162 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13162
QUERY_FILE_INFORMATION 13162
ReadX 13162 512 4096 4096
QUERY_FILE_INFORMATION 13162
QUERY_FILE_INFORMATION 13162
QUERY_FILE_INFORMATION 13162
WriteX 13162 512 4096 4096
WriteX 13162 1024 512 512
ReadX 13162 502 512 512
QUERY_FILE_INFORMATION 13162
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13162 2560 512 512
ReadX 13162 1536 512 512
ReadX 13162 2176 384 384
ReadX 13162 3072 128 128
ReadX 13162 3107 512 512
ReadX 13162 3619 512 512
ReadX 13162 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13162 286 123 123
ReadX 13162 292 24 24
ReadX 13162 512 2048 2048
ReadX 13162 512 2048 2048
ReadX 13162 2560 2048 2048
ReadX 13162 416 1536 1536
ReadX 13162 768 512 512
ReadX 13162 1280 2048 2048
ReadX 13162 3328 2048 2048
ReadX 13162 5376 2048 2048
ReadX 13162 7424 2048 2048
ReadX 13162 9472 2048 2048
ReadX 13162 11520 2048 2048
ReadX 13162 13568 2048 2048
ReadX 13162 15616 2048 2048
ReadX 13162 17664 2048 2048
ReadX 13162 19712 2048 2048
ReadX 13162 21760 2048 2048
ReadX 13162 23808 2048 2048
ReadX 13162 25856 2048 2048
ReadX 13162 27904 2048 2048
ReadX 13162 29952 2048 2048
ReadX 13162 32000 2048 2048
ReadX 13162 34048 2048 2048
ReadX 13162 36096 2048 2048
ReadX 13162 38144 2048 2048
ReadX 13162 40192 2048 2048
ReadX 13162 42240 512 512
ReadX 13162 42752 2048 2048
ReadX 13162 44800 2048 2048
ReadX 13162 46848 2048 2048
ReadX 13162 48896 2048 2048
ReadX 13162 50944 2048 2048
ReadX 13162 52992 2048 2048
ReadX 13162 55040 2048 2048
ReadX 13162 57088 2048 2048
ReadX 13162 316 2048 2048
ReadX 13162 2364 2048 2048
ReadX 13162 4412 2048 2048
ReadX 13162 6460 2048 2048
ReadX 13162 8508 2048 2048
ReadX 13162 10556 2048 2048
ReadX 13162 12604 2048 2048
ReadX 13162 14652 2048 2048
ReadX 13162 16700 2048 2048
ReadX 13162 18748 2048 2048
ReadX 13162 20796 2048 2048
ReadX 13162 22844 2048 2048
ReadX 13162 24892 2048 2048
ReadX 13162 26940 2048 2048
ReadX 13162 28988 2048 2048
ReadX 13162 31036 2048 2048
ReadX 13162 436 2048 2048
ReadX 13162 2484 2048 2048
ReadX 13162 4532 2048 2048
ReadX 13162 6580 2048 2048
ReadX 13162 8628 2048 2048
ReadX 13162 10676 2048 2048
ReadX 13162 476 2048 2048
ReadX 13162 476 2048 2048
ReadX 13162 476 2048 2048
ReadX 13162 2524 2048 2048
ReadX 13162 484 2048 2048
ReadX 13162 484 2048 2048
ReadX 13162 484 2048 2048
ReadX 13162 2532 665 665
ReadX 13162 492 665 665
ReadX 13162 492 665 665
ReadX 13162 492 665 665
ReadX 13162 296 512 512
ReadX 13162 318 512 512
ReadX 13162 300 512 512
ReadX 13162 312 512 512
ReadX 13162 320 512 512
ReadX 13162 832 354 354
ReadX 13162 504 4096 4096
ReadX 13162 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13163
Close 13163
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13164
WriteX 13164 1535 1 1
QUERY_FILE_INFORMATION 13164
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13162 296 1251 1251
ReadX 13162 2176 384 384
ReadX 13162 3072 1634 1634
QUERY_FILE_INFORMATION 13164
WriteX 13164 0 57088 57088
WriteX 13164 0 4096 4096
Flush 13164
Close 13162
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13165
Close 13165
WriteX 13164 0 4096 4096
Close 13164
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13166
Close 13166
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13167
QUERY_FILE_INFORMATION 13167
ReadX 13167 0 512 512
ReadX 13167 512 512 512
ReadX 13167 1024 512 512
QUERY_FILE_INFORMATION 13167
QUERY_FILE_INFORMATION 13167
ReadX 13167 512 2048 2048
QUERY_FILE_INFORMATION 13167
QUERY_FILE_INFORMATION 13167
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13167 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13168
WriteX 13168 1535 1 1
QUERY_FILE_INFORMATION 13168
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13167 1536 512 512
ReadX 13167 288 1251 1251
ReadX 13167 2048 2018 2018
QUERY_FILE_INFORMATION 13168
WriteX 13168 0 51456 51456
WriteX 13168 0 4096 4096
Flush 13168
QUERY_FILE_INFORMATION 13167
QUERY_FILE_INFORMATION 13167
Close 13167
WriteX 13168 0 4096 4096
Close 13168
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13169
Close 13169
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13170
QUERY_FILE_INFORMATION 13170
ReadX 13170 0 512 512
ReadX 13170 512 512 512
ReadX 13170 1024 512 512
QUERY_FILE_INFORMATION 13170
QUERY_FILE_INFORMATION 13170
ReadX 13170 512 2048 2048
QUERY_FILE_INFORMATION 13170
QUERY_FILE_INFORMATION 13170
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13170 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13172
Close 13172
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13174
WriteX 13174 4045 1 1
QUERY_FILE_INFORMATION 13174
WriteX 13174 0 53077 53077
Close 13174
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13175
WriteX 13175 1535 1 1
QUERY_FILE_INFORMATION 13175
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13170 1536 512 512
ReadX 13170 288 1251 1251
ReadX 13170 2048 2018 2018
QUERY_FILE_INFORMATION 13175
WriteX 13175 0 65471 65471
WriteX 13175 65471 65 65
WriteX 13175 65536 1856 1856
WriteX 13175 0 4096 4096
Flush 13175
QUERY_FILE_INFORMATION 13170
QUERY_FILE_INFORMATION 13170
Close 13170
WriteX 13175 0 4096 4096
Close 13175
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13176
Close 13176
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13177
QUERY_FILE_INFORMATION 13177
ReadX 13177 0 512 512
ReadX 13177 512 512 512
ReadX 13177 1024 512 512
QUERY_FILE_INFORMATION 13177
QUERY_FILE_INFORMATION 13177
ReadX 13177 576 2048 2048
QUERY_FILE_INFORMATION 13177
QUERY_FILE_INFORMATION 13177
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13179
Close 13179
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13181
WriteX 13181 4076 1 1
QUERY_FILE_INFORMATION 13181
WriteX 13181 0 7983 7983
Close 13181
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13183
Close 13183
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13185
WriteX 13185 4095 1 1
QUERY_FILE_INFORMATION 13185
WriteX 13185 0 65471 65471
WriteX 13185 65471 65 65
WriteX 13185 65536 65471 65471
WriteX 13185 131007 65 65
WriteX 13185 131072 65471 65471
WriteX 13185 196543 65 65
WriteX 13185 196608 65471 65471
WriteX 13185 262079 65 65
WriteX 13185 262144 65471 65471
WriteX 13185 327615 65 65
WriteX 13185 327680 65471 65471
WriteX 13185 393151 65 65
WriteX 13185 393216 65471 65471
WriteX 13185 458687 65 65
WriteX 13185 458752 46731 46731
Close 13185
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13186
WriteX 13186 1535 1 1
QUERY_FILE_INFORMATION 13186
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13177 1536 512 512
ReadX 13177 2048 2018 2018
ReadX 13177 4096 512 512
ReadX 13177 4608 2197 2197
QUERY_FILE_INFORMATION 13186
WriteX 13186 0 65471 65471
WriteX 13186 65471 65 65
WriteX 13186 65536 22848 22848
WriteX 13186 0 4096 4096
Flush 13186
QUERY_FILE_INFORMATION 13177
QUERY_FILE_INFORMATION 13177
Close 13177
WriteX 13186 0 4096 4096
Close 13186
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13187
Close 13187
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13188
QUERY_FILE_INFORMATION 13188
ReadX 13188 0 512 512
ReadX 13188 512 512 512
ReadX 13188 1024 512 512
QUERY_FILE_INFORMATION 13188
QUERY_FILE_INFORMATION 13188
ReadX 13188 576 2048 2048
QUERY_FILE_INFORMATION 13188
QUERY_FILE_INFORMATION 13188
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13188 4096 512 512
Close 13188
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13189
QUERY_FILE_INFORMATION 13189
ReadX 13189 0 512 512
ReadX 13189 512 512 512
ReadX 13189 1024 512 512
QUERY_FILE_INFORMATION 13189
QUERY_FILE_INFORMATION 13189
ReadX 13189 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13189
QUERY_FILE_INFORMATION 13189
ReadX 13189 288 4096 4096
QUERY_FILE_INFORMATION 13189
QUERY_FILE_INFORMATION 13189
QUERY_FILE_INFORMATION 13189
WriteX 13189 288 4096 4096
WriteX 13189 1024 512 512
ReadX 13189 1536 512 512
QUERY_FILE_INFORMATION 13189
ReadX 13189 288 2048 2048
ReadX 13189 2336 2048 2048
ReadX 13189 3072 1536 1536
ReadX 13189 544 512 512
ReadX 13189 1056 2048 2048
ReadX 13189 3104 2048 2048
ReadX 13189 5152 2048 2048
ReadX 13189 7200 2048 2048
ReadX 13189 9248 2048 2048
ReadX 13189 11296 2048 2048
ReadX 13189 13344 2048 2048
ReadX 13189 15392 2048 2048
ReadX 13189 17440 2048 2048
ReadX 13189 19488 2048 2048
ReadX 13189 21536 2048 2048
ReadX 13189 23584 2048 2048
ReadX 13189 25632 2048 2048
ReadX 13189 27680 2048 2048
ReadX 13189 29728 2048 2048
ReadX 13189 31776 2048 2048
ReadX 13189 33824 2048 2048
ReadX 13189 35872 2048 2048
ReadX 13189 37920 2048 2048
ReadX 13189 39968 2048 2048
ReadX 13189 42016 512 512
ReadX 13189 42528 512 512
ReadX 13189 43040 1536 1536
ReadX 13189 44576 2048 2048
ReadX 13189 46624 2048 2048
ReadX 13189 48672 2048 2048
ReadX 13189 50720 2048 2048
ReadX 13189 52768 2048 2048
ReadX 13189 54816 2048 2048
ReadX 13189 56864 2048 2048
ReadX 13189 58912 2048 2048
ReadX 13189 60960 2048 2048
ReadX 13189 63008 2048 2048
ReadX 13189 65056 2048 2048
ReadX 13189 67104 2048 2048
ReadX 13189 69152 2048 2048
ReadX 13189 71200 2048 2048
ReadX 13189 73248 2048 2048
ReadX 13189 75296 2048 2048
ReadX 13189 77344 2048 2048
ReadX 13189 79392 2048 2048
ReadX 13189 81440 2048 2048
ReadX 13189 83488 2048 2048
ReadX 13189 85536 512 512
ReadX 13189 86048 512 512
ReadX 13189 86560 1536 1536
ReadX 13189 88096 2048 2048
ReadX 13189 90144 2048 2048
ReadX 13189 92192 2048 2048
ReadX 13189 94240 2048 2048
ReadX 13189 96288 2048 2048
ReadX 13189 552 2048 2048
ReadX 13189 2600 2048 2048
ReadX 13189 4648 2048 2048
ReadX 13189 6696 2048 2048
ReadX 13189 8744 2048 2048
ReadX 13189 10792 2048 2048
ReadX 13189 12840 2048 2048
ReadX 13189 14888 2048 2048
ReadX 13189 16936 2048 2048
ReadX 13189 18984 2048 2048
ReadX 13189 21032 2048 2048
ReadX 13189 23080 2048 2048
ReadX 13189 25128 2048 2048
ReadX 13189 27176 2048 2048
ReadX 13189 29224 2048 2048
ReadX 13189 31272 2048 2048
ReadX 13189 33320 2048 2048
ReadX 13189 35368 2048 2048
ReadX 13189 37416 2048 2048
ReadX 13189 39464 2048 2048
ReadX 13189 41512 512 512
ReadX 13189 42024 512 512
ReadX 13189 42536 1536 1536
ReadX 13189 44072 2048 2048
ReadX 13189 46120 2048 2048
ReadX 13189 48168 2048 2048
ReadX 13189 50216 2048 2048
ReadX 13189 52264 2048 2048
ReadX 13189 54312 2048 2048
ReadX 13189 56360 2048 2048
ReadX 13189 58408 2048 2048
ReadX 13189 60456 2048 2048
ReadX 13189 62504 2048 2048
ReadX 13189 64552 2048 2048
ReadX 13189 66600 2048 2048
ReadX 13189 68648 2048 2048
ReadX 13189 70696 2048 2048
ReadX 13189 72744 2048 2048
ReadX 13189 74792 2048 2048
ReadX 13189 76840 2048 2048
ReadX 13189 78888 2048 2048
ReadX 13189 80936 2048 2048
ReadX 13189 82984 2048 2048
ReadX 13189 85032 512 512
ReadX 13189 85544 2048 2048
ReadX 13189 87592 2048 2048
ReadX 13189 89640 2048 2048
ReadX 13189 91688 2048 2048
ReadX 13189 93736 2048 2048
ReadX 13189 95784 2048 2048
ReadX 13189 97832 2048 2048
ReadX 13189 99880 2048 2048
ReadX 13189 101928 2048 2048
ReadX 13189 103976 2048 2048
ReadX 13189 106024 2048 2048
ReadX 13189 108072 2048 2048
ReadX 13189 110120 2048 2048
ReadX 13189 112168 2048 2048
ReadX 13189 114216 2048 2048
ReadX 13189 116264 2048 2048
ReadX 13189 118312 2048 2048
ReadX 13189 120360 2048 2048
ReadX 13189 122408 2048 2048
ReadX 13189 124456 512 512
ReadX 13189 124968 512 512
ReadX 13189 125480 1536 1536
ReadX 13189 127016 2048 2048
ReadX 13189 129064 2048 2048
ReadX 13189 131112 2048 2048
ReadX 13189 133160 2048 2048
ReadX 13189 135208 2048 2048
ReadX 13189 137256 2048 2048
ReadX 13189 139304 2048 2048
ReadX 13189 141352 2048 2048
ReadX 13189 143400 2048 2048
ReadX 13189 145448 2048 2048
ReadX 13189 147496 2048 2048
ReadX 13189 149544 2048 2048
ReadX 13189 151592 2048 2048
ReadX 13189 153640 2048 2048
ReadX 13189 155688 2048 2048
ReadX 13189 157736 2048 2048
ReadX 13189 159784 2048 2048
ReadX 13189 161832 2048 2048
ReadX 13189 163880 2048 2048
ReadX 13189 165928 2048 2048
ReadX 13189 167976 2048 2048
ReadX 13189 170024 512 512
ReadX 13189 1538 1536 1536
ReadX 13189 3074 2048 2048
ReadX 13189 5122 2048 2048
ReadX 13189 7170 2048 2048
ReadX 13189 9218 2048 2048
ReadX 13189 11266 2048 2048
ReadX 13189 13314 2048 2048
ReadX 13189 15362 2048 2048
ReadX 13189 17410 2048 2048
ReadX 13189 19458 2048 2048
ReadX 13189 21506 2048 2048
ReadX 13189 23554 2048 2048
ReadX 13189 25602 2048 2048
ReadX 13189 27650 2048 2048
ReadX 13189 29698 2048 2048
ReadX 13189 31746 2048 2048
ReadX 13189 33794 2048 2048
ReadX 13189 35842 2048 2048
ReadX 13189 37890 2048 2048
ReadX 13189 39938 2048 2048
ReadX 13189 41986 2048 2048
ReadX 13189 44034 875 875
ReadX 13189 1730 4096 4096
ReadX 13189 1724 1536 1536
ReadX 13189 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13190
Close 13190
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13191
WriteX 13191 2047 1 1
QUERY_FILE_INFORMATION 13191
Close 13189
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13192
Close 13192
WriteX 13191 0 42388 42388
Close 13191
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13193
Close 13193
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13194
QUERY_FILE_INFORMATION 13194
ReadX 13194 0 512 512
ReadX 13194 1756 512 512
ReadX 13194 2268 512 512
QUERY_FILE_INFORMATION 13194
QUERY_FILE_INFORMATION 13194
ReadX 13194 1744 512 512
ReadX 13194 2256 512 512
ReadX 13194 2768 512 512
ReadX 13194 3280 512 512
ReadX 13194 3792 512 512
ReadX 13194 4304 512 512
ReadX 13194 512 2048 2048
QUERY_FILE_INFORMATION 13194
QUERY_FILE_INFORMATION 13194
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13195
WriteX 13195 2047 1 1
QUERY_FILE_INFORMATION 13195
QUERY_FILE_INFORMATION 13194
QUERY_FILE_INFORMATION 13194
Close 13194
WriteX 13195 0 42652 42652
Close 13195
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13196
Close 13196
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13197
QUERY_FILE_INFORMATION 13197
ReadX 13197 0 512 512
ReadX 13197 1762 512 512
ReadX 13197 2274 512 512
QUERY_FILE_INFORMATION 13197
QUERY_FILE_INFORMATION 13197
ReadX 13197 1750 512 512
ReadX 13197 2262 512 512
ReadX 13197 2774 512 512
ReadX 13197 3286 512 512
ReadX 13197 3798 512 512
ReadX 13197 4310 512 512
ReadX 13197 512 2048 2048
QUERY_FILE_INFORMATION 13197
QUERY_FILE_INFORMATION 13197
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13199
Close 13199
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13201
WriteX 13201 4080 1 1
QUERY_FILE_INFORMATION 13201
WriteX 13201 0 65471 65471
WriteX 13201 65471 65 65
WriteX 13201 65536 49 49
Close 13201
Close 13197
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13202
WriteX 13202 0 65471 65471
WriteX 13202 65471 63 63
WriteX 13202 65534 65471 65471
WriteX 13202 131005 63 63
Close 13202
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13203
WriteX 13203 0 65471 65471
WriteX 13203 65471 63 63
WriteX 13203 65534 65471 65471
WriteX 13203 131005 63 63
WriteX 13203 131068 65471 65471
WriteX 13203 196539 63 63
WriteX 13203 196602 65471 65471
WriteX 13203 262073 63 63
Close 13203
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13204
WriteX 13204 0 65471 65471
WriteX 13204 65471 63 63
WriteX 13204 65534 65471 65471
WriteX 13204 131005 63 63
WriteX 13204 131068 65471 65471
WriteX 13204 196539 63 63
WriteX 13204 196602 65471 65471
WriteX 13204 262073 63 63
WriteX 13204 262136 65471 65471
WriteX 13204 327607 63 63
WriteX 13204 327670 65471 65471
WriteX 13204 393141 63 63
WriteX 13204 393204 65471 65471
WriteX 13204 458675 63 63
WriteX 13204 458738 65471 65471
WriteX 13204 524209 63 63
Close 13204
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13205
Close 13205
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13206
Close 13206
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13209
Close 13209
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13211
Close 13211
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13212
Close 13212
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13215
Close 13215
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13217
Close 13217
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13218
Close 13218
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13221
Close 13221
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13225
Close 13225
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13229
Close 13229
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13233
Close 13233
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13237
Close 13237
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13241
Close 13241
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13245
Close 13245
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13249
Close 13249
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13251
Close 13251
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13253
Close 13253
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13255
WriteX 13255 4095 1 1
QUERY_FILE_INFORMATION 13255
QUERY_FS_INFORMATION 259
WriteX 13255 0 65471 65471
WriteX 13255 65471 65 65
WriteX 13255 65536 65471 65471
WriteX 13255 131007 65 65
WriteX 13255 131072 65471 65471
WriteX 13255 196543 65 65
WriteX 13255 196608 65471 65471
WriteX 13255 262079 65 65
WriteX 13255 262144 26634 26634
Close 13255
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13260
QUERY_FILE_INFORMATION 13260
QUERY_FILE_INFORMATION 13260
Close 13260
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13261
Close 13261
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13262
Close 13262
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13263
QUERY_FILE_INFORMATION 13263
ReadX 13263 0 512 512
ReadX 13263 288 512 512
ReadX 13263 800 512 512
Close 13263
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13264
ReadX 13264 0 24 24
Close 13264
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13265
ReadX 13265 0 24 24
Close 13265
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13266
QUERY_FILE_INFORMATION 13266
ReadX 13266 0 512 512
ReadX 13266 288 512 512
ReadX 13266 800 512 512
ReadX 13266 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13266 1759 2849 2849
Close 13266
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13267
Close 13267
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13270
Close 13270
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13272
Close 13272
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13273
Close 13273
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13276
Close 13276
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13278
Close 13278
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13279
Close 13279
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13282
Close 13282
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13286
Close 13286
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13290
Close 13290
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13294
Close 13294
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13298
Close 13298
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13302
Close 13302
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13305
Close 13305
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13309
Close 13309
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13313
Close 13313
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13315
Close 13315
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13316
Close 13316
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13325
QUERY_FILE_INFORMATION 13325
QUERY_FILE_INFORMATION 13325
Close 13325
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13326
Close 13326
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13327
Close 13327
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13328
QUERY_FILE_INFORMATION 13328
ReadX 13328 0 512 512
ReadX 13328 288 512 512
ReadX 13328 800 512 512
Close 13328
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13329
ReadX 13329 0 24 24
Close 13329
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13330
QUERY_FILE_INFORMATION 13330
ReadX 13330 0 512 512
ReadX 13330 288 512 512
ReadX 13330 800 512 512
ReadX 13330 512 36 36
Close 13330
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13331
QUERY_FILE_INFORMATION 13331
ReadX 13331 0 512 512
ReadX 13331 288 512 512
ReadX 13331 800 512 512
ReadX 13331 512 682 682
ReadX 13331 3584 106 106
ReadX 13331 3712 10 10
ReadX 13331 3722 10 10
ReadX 13331 512 2048 2048
ReadX 13331 3072 512 512
ReadX 13331 276 84 84
ReadX 13331 273 49 49
ReadX 13331 2560 512 512
Close 13331
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13341
QUERY_FILE_INFORMATION 13341
QUERY_FILE_INFORMATION 13341
Close 13341
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13342
Close 13342
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13343
Close 13343
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13344
QUERY_FILE_INFORMATION 13344
ReadX 13344 0 512 512
ReadX 13344 288 512 512
ReadX 13344 800 512 512
Close 13344
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13345
ReadX 13345 0 24 24
Close 13345
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13346
QUERY_FILE_INFORMATION 13346
ReadX 13346 0 512 512
ReadX 13346 288 512 512
ReadX 13346 800 512 512
ReadX 13346 512 36 36
Close 13346
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13347
QUERY_FILE_INFORMATION 13347
ReadX 13347 0 512 512
ReadX 13347 288 512 512
ReadX 13347 800 512 512
ReadX 13347 512 682 682
ReadX 13347 3072 106 106
ReadX 13347 3200 10 10
ReadX 13347 3210 10 10
ReadX 13347 512 2048 2048
ReadX 13347 2560 512 512
ReadX 13347 3887 84 84
ReadX 13347 3838 49 49
ReadX 13347 2048 512 512
Close 13347
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13348
Close 13348
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13349
QUERY_FILE_INFORMATION 13349
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 13349
QUERY_FILE_INFORMATION 13349
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13350
QUERY_FILE_INFORMATION 13350
QUERY_FILE_INFORMATION 13350
QUERY_FILE_INFORMATION 13350
ReadX 13350 2156 24 24
ReadX 13350 2139 276 276
ReadX 13350 2136 14 14
ReadX 13350 2136 7 7
ReadX 13350 2138 12 12
ReadX 13350 2137 8 8
ReadX 13350 2135 15 15
ReadX 13350 0 16 16
ReadX 13350 16 2048 2048
ReadX 13350 2064 2048 2048
ReadX 13350 257 2048 2048
ReadX 13350 385 2048 2048
ReadX 13350 513 2048 2048
ReadX 13350 641 2048 2048
ReadX 13350 769 2048 2048
ReadX 13350 897 2048 2048
ReadX 13350 1025 2048 2048
ReadX 13350 1153 2048 2048
ReadX 13350 1281 2048 2048
ReadX 13350 1409 2048 2048
ReadX 13350 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13352
Close 13352
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13354
WriteX 13354 15 1 1
QUERY_FILE_INFORMATION 13354
WriteX 13354 0 10575 10575
Flush 13354
Close 13354
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13355
Close 13355
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13356
QUERY_FILE_INFORMATION 13356
QUERY_FILE_INFORMATION 13356
QUERY_FILE_INFORMATION 13356
ReadX 13356 2157 24 24
ReadX 13356 2139 276 276
ReadX 13356 2137 14 14
ReadX 13356 2137 7 7
ReadX 13356 2139 12 12
ReadX 13356 2138 8 8
ReadX 13356 2136 15 15
Close 13350
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13357
Close 13357
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13358
QUERY_FILE_INFORMATION 13358
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13359
QUERY_FILE_INFORMATION 13359
ReadX 13359 0 512 512
ReadX 13359 512 512 512
ReadX 13359 1024 512 512
QUERY_FILE_INFORMATION 13359
QUERY_FILE_INFORMATION 13359
Close 13359
QUERY_FILE_INFORMATION 13358
ReadX 13358 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13360
QUERY_FILE_INFORMATION 13360
ReadX 13360 0 512 512
ReadX 13360 512 512 512
ReadX 13360 1024 512 512
ReadX 13360 288 20 20
ReadX 13360 308 2084 2084
ReadX 13360 388 2084 2084
ReadX 13360 388 2084 2084
ReadX 13349 2157 1386 1386
ReadX 13360 2472 399 399
ReadX 13360 3072 1536 1536
ReadX 13360 544 149 149
ReadX 13360 693 485 485
Close 13360
ReadX 13349 2157 4096 4096
ReadX 13349 6253 4096 4096
ReadX 13349 10349 4096 4096
ReadX 13349 14445 4096 4096
ReadX 13349 18541 4096 4096
ReadX 13349 22637 256 256
ReadX 13349 22893 4096 4096
ReadX 13349 26989 4096 4096
ReadX 13349 31085 4096 4096
ReadX 13349 35181 4096 4096
ReadX 13349 39277 4096 4096
ReadX 13349 43373 4096 4096
ReadX 13349 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13349 2157 1024 1024
ReadX 13349 1667 4688 4688
ReadX 13349 6355 3516 3516
ReadX 13349 9871 16384 16384
ReadX 13349 26255 3771 3771
ReadX 13349 30026 2048 2048
ReadX 13349 32074 1024 1024
ReadX 13349 33098 6652 6652
ReadX 13349 39750 16384 16384
ReadX 13349 56134 10496 10496
ReadX 13349 66630 1784 1784
ReadX 13349 68414 90 90
ReadX 13349 68504 273 273
ReadX 13349 68777 1600 1600
ReadX 13349 70377 640 640
ReadX 13349 71017 1280 1280
ReadX 13349 72297 8464 8464
ReadX 13349 80761 158 158
ReadX 13349 80919 912 912
ReadX 13349 81831 1980 1980
ReadX 13349 83811 2256 2256
ReadX 13349 86067 400 400
ReadX 13349 86467 252 252
ReadX 13349 86719 42 42
ReadX 13349 86761 725 725
ReadX 13349 2009 512 512
ReadX 13349 3895 9 9
ReadX 13349 3781 46 46
ReadX 13349 4059 92 92
ReadX 13349 3781 92 92
ReadX 13349 3986 184 184
ReadX 13349 3987 16384 16384
ReadX 13349 3902 16384 16384
ReadX 13349 3781 10240 10240
ReadX 13349 3821 16384 16384
ReadX 13349 3891 935 935
ReadX 13349 4060 10240 10240
ReadX 13349 4059 184 184
ReadX 13349 256 184 184
ReadX 13349 256 1026 1026
ReadX 13349 3901 326 326
ReadX 13349 3899 652 652
ReadX 13349 256 2 2
ReadX 13349 258 4948 4948
Close 13349
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13362
Close 13362
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13364
WriteX 13364 4055 1 1
QUERY_FILE_INFORMATION 13364
WriteX 13364 0 65471 65471
WriteX 13364 65471 65 65
WriteX 13364 65536 65471 65471
WriteX 13364 131007 65 65
WriteX 13364 131072 65471 65471
WriteX 13364 196543 65 65
WriteX 13364 196608 65471 65471
WriteX 13364 262079 65 65
WriteX 13364 262144 65471 65471
WriteX 13364 327615 65 65
WriteX 13364 327680 65471 65471
WriteX 13364 393151 65 65
WriteX 13364 393216 65471 65471
WriteX 13364 458687 65 65
WriteX 13364 458752 65471 65471
WriteX 13364 524223 65 65
WriteX 13364 524288 65471 65471
WriteX 13364 589759 65 65
WriteX 13364 589824 35257 35257
Close 13364
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13366
Close 13366
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13368
WriteX 13368 4055 1 1
QUERY_FILE_INFORMATION 13368
WriteX 13368 0 65471 65471
WriteX 13368 65471 65 65
WriteX 13368 65536 65471 65471
WriteX 13368 131007 65 65
WriteX 13368 131072 65471 65471
WriteX 13368 196543 65 65
WriteX 13368 196608 65471 65471
WriteX 13368 262079 65 65
WriteX 13368 262144 65471 65471
WriteX 13368 327615 65 65
WriteX 13368 327680 65471 65471
WriteX 13368 393151 65 65
WriteX 13368 393216 65471 65471
WriteX 13368 458687 65 65
WriteX 13368 458752 65471 65471
WriteX 13368 524223 65 65
WriteX 13368 524288 65471 65471
WriteX 13368 589759 65 65
WriteX 13368 589824 57598 57598
Close 13368
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13370
WriteX 13370 15 1 1
QUERY_FILE_INFORMATION 13370
WriteX 13370 0 12543 12543
Flush 13370
Close 13370
Close 13356
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13371
Close 13371
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13372
QUERY_FILE_INFORMATION 13372
QUERY_FILE_INFORMATION 13372
QUERY_FILE_INFORMATION 13372
ReadX 13372 288 24 24
ReadX 13372 287 276 276
ReadX 13372 286 14 14
ReadX 13372 286 7 7
ReadX 13372 287 12 12
ReadX 13372 287 8 8
ReadX 13372 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13373
Close 13373
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13374
QUERY_FILE_INFORMATION 13374
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 13374
QUERY_FILE_INFORMATION 13374
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13375
QUERY_FILE_INFORMATION 13375
QUERY_FILE_INFORMATION 13375
QUERY_FILE_INFORMATION 13375
ReadX 13375 1938 24 24
ReadX 13375 1920 276 276
ReadX 13375 1918 14 14
ReadX 13375 1918 7 7
ReadX 13375 1919 12 12
ReadX 13375 1919 8 8
ReadX 13375 1917 15 15
ReadX 13375 0 16 16
ReadX 13375 16 2048 2048
ReadX 13375 2064 2048 2048
ReadX 13375 257 2048 2048
ReadX 13375 385 2048 2048
ReadX 13375 513 2048 2048
ReadX 13375 641 2048 2048
ReadX 13375 769 2048 2048
ReadX 13375 897 2048 2048
ReadX 13375 1025 2048 2048
ReadX 13375 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13377
Close 13377
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13379
WriteX 13379 15 1 1
QUERY_FILE_INFORMATION 13379
WriteX 13379 0 11588 11588
Flush 13379
Close 13379
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13380
Close 13380
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13381
QUERY_FILE_INFORMATION 13381
QUERY_FILE_INFORMATION 13381
QUERY_FILE_INFORMATION 13381
ReadX 13381 1909 24 24
ReadX 13381 1892 276 276
ReadX 13381 1889 14 14
ReadX 13381 1889 7 7
ReadX 13381 1891 12 12
ReadX 13381 1890 8 8
ReadX 13381 1888 15 15
Close 13375
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13383
WriteX 13383 15 1 1
QUERY_FILE_INFORMATION 13383
WriteX 13383 0 11615 11615
Flush 13383
Close 13383
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13381
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13384
Close 13384
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13385
QUERY_FILE_INFORMATION 13385
QUERY_FILE_INFORMATION 13385
QUERY_FILE_INFORMATION 13385
ReadX 13385 1947 24 24
ReadX 13385 1929 276 276
ReadX 13385 1927 14 14
ReadX 13385 1927 7 7
ReadX 13385 1929 12 12
ReadX 13385 1928 8 8
ReadX 13385 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13387
Close 13387
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13389
WriteX 13389 4088 1 1
QUERY_FILE_INFORMATION 13389
WriteX 13389 0 65471 65471
WriteX 13389 65471 65 65
WriteX 13389 65536 16050 16050
Close 13389
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13374 1939 64 64
ReadX 13374 128 248 248
ReadX 13374 128 568 568
ReadX 13374 3872 1536 1536
ReadX 13374 3456 2560 2560
ReadX 13374 3136 512 512
ReadX 13374 2880 4096 4096
ReadX 13374 3264 3072 3072
ReadX 13374 320 4096 4096
ReadX 13374 1024 4096 4096
ReadX 13374 3616 4096 4096
ReadX 13374 1939 64 64
ReadX 13374 128 248 248
ReadX 13374 128 608 608
ReadX 13374 2858 1024 1024
ReadX 13374 2810 4096 4096
ReadX 13374 2826 4096 4096
ReadX 13374 2580 2048 2048
ReadX 13374 2800 2560 2560
ReadX 13374 2100 4096 4096
ReadX 13374 2084 4096 4096
ReadX 13374 868 4096 4096
ReadX 13374 2324 4096 4096
ReadX 13374 884 4096 4096
ReadX 13374 2604 1024 1024
ReadX 13374 580 4096 4096
ReadX 13374 596 4096 4096
ReadX 13374 2752 4096 4096
ReadX 13374 2842 1024 1024
ReadX 13374 660 4096 4096
ReadX 13374 2720 4096 4096
ReadX 13374 2736 4096 4096
ReadX 13374 628 4096 4096
ReadX 13374 2704 4096 4096
ReadX 13374 1556 4096 4096
ReadX 13374 576 4096 4096
ReadX 13374 3168 1536 1536
ReadX 13374 832 4096 4096
ReadX 13374 1088 4096 4096
ReadX 13374 1344 4096 4096
ReadX 13374 1600 4096 4096
ReadX 13374 1856 4096 4096
ReadX 13374 2112 4096 4096
ReadX 13374 1892 4096 4096
ReadX 13374 820 4096 4096
ReadX 13374 788 4096 4096
ReadX 13374 1604 4096 4096
ReadX 13374 3648 4096 4096
ReadX 13374 2608 4096 4096
ReadX 13374 548 4096 4096
ReadX 13374 740 4096 4096
ReadX 13374 1344 4096 4096
ReadX 13374 3392 4096 4096
ReadX 13374 3904 4096 4096
ReadX 13374 644 4096 4096
ReadX 13374 676 4096 4096
ReadX 13374 2688 4096 4096
ReadX 13374 320 4096 4096
ReadX 13374 900 4096 4096
ReadX 13374 1908 4096 4096
ReadX 13374 852 4096 4096
ReadX 13374 724 4096 4096
ReadX 13374 2292 4096 4096
ReadX 13374 612 4096 4096
ReadX 13374 388 4096 4096
ReadX 13374 2368 4096 4096
ReadX 13374 2624 4096 4096
ReadX 13374 500 4096 4096
ReadX 13374 356 4096 4096
ReadX 13374 1024 4096 4096
ReadX 13374 576 4096 4096
ReadX 13374 340 4096 4096
ReadX 13374 420 4096 4096
ReadX 13374 1600 4096 4096
ReadX 13374 404 4096 4096
ReadX 13374 1428 4096 4096
ReadX 13374 2656 4096 4096
ReadX 13374 2624 4096 4096
ReadX 13374 452 4096 4096
ReadX 13374 692 4096 4096
ReadX 13374 564 4096 4096
ReadX 13374 372 4096 4096
ReadX 13374 468 4096 4096
ReadX 13374 484 4096 4096
ReadX 13374 1088 4096 4096
ReadX 13374 1924 4096 4096
ReadX 13374 2768 4096 4096
ReadX 13374 832 4096 4096
ReadX 13374 836 4096 4096
ReadX 13374 1856 4096 4096
ReadX 13374 2640 4096 4096
ReadX 13374 436 4096 4096
ReadX 13374 1828 4096 4096
ReadX 13374 804 4096 4096
ReadX 13374 1860 4096 4096
ReadX 13374 1812 4096 4096
ReadX 13374 756 4096 4096
ReadX 13374 1636 4096 4096
ReadX 13374 772 4096 4096
ReadX 13374 2036 4096 4096
ReadX 13374 1220 4096 4096
ReadX 13374 1652 4096 4096
ReadX 13374 2588 4096 4096
ReadX 13374 916 4096 4096
ReadX 13374 260 4096 4096
ReadX 13374 932 4096 4096
ReadX 13374 2624 4096 4096
ReadX 13374 308 4096 4096
ReadX 13374 292 4096 4096
ReadX 13374 1140 4096 4096
ReadX 13374 276 4096 4096
ReadX 13374 2020 4096 4096
ReadX 13374 2880 4096 4096
ReadX 13374 516 4096 4096
ReadX 13374 1844 4096 4096
ReadX 13374 1124 4096 4096
ReadX 13374 3136 4096 4096
ReadX 13374 324 4096 4096
ReadX 13374 1156 4096 4096
ReadX 13374 1172 4096 4096
ReadX 13374 2112 4096 4096
ReadX 13374 2368 4096 4096
ReadX 13374 964 4096 4096
ReadX 13374 980 4096 4096
ReadX 13374 1012 4096 4096
ReadX 13374 532 4096 4096
ReadX 13374 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13374 1620 4096 4096
ReadX 13374 1604 4096 4096
ReadX 13374 2116 4096 4096
ReadX 13374 2132 4096 4096
ReadX 13374 2148 4096 4096
ReadX 13374 2276 4096 4096
ReadX 13374 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13391
Close 13391
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13393
QUERY_FILE_INFORMATION 13358
WriteX 13393 4088 1 1
QUERY_FILE_INFORMATION 13393
QUERY_FILE_INFORMATION 13358
Close 13358
WriteX 13393 0 65471 65471
WriteX 13393 65471 65 65
WriteX 13393 65536 64850 64850
Close 13393
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13395
WriteX 13395 15 1 1
QUERY_FILE_INFORMATION 13395
ReadX 13374 2068 4096 4096
ReadX 13374 1588 4096 4096
ReadX 13374 1572 4096 4096
WriteX 13395 0 18630 18630
Flush 13395
Close 13395
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13385
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13396
Close 13396
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13397
QUERY_FILE_INFORMATION 13397
QUERY_FILE_INFORMATION 13397
QUERY_FILE_INFORMATION 13397
ReadX 13397 661 24 24
ReadX 13397 659 356 356
ReadX 13397 659 14 14
ReadX 13397 659 7 7
ReadX 13397 659 12 12
ReadX 13397 659 8 8
ReadX 13397 659 15 15
ReadX 13397 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13374 612 4096 4096
ReadX 13374 564 4096 4096
ReadX 13374 1876 4096 4096
ReadX 13374 628 4096 4096
ReadX 13374 740 4096 4096
ReadX 13374 724 4096 4096
ReadX 13374 644 4096 4096
ReadX 13374 2324 4096 4096
ReadX 13374 660 4096 4096
ReadX 13374 852 4096 4096
ReadX 13374 868 4096 4096
Close 13397
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 13372
ReadX 13374 2368 4096 4096
ReadX 13374 1024 4096 4096
ReadX 13374 320 4096 4096
ReadX 13374 580 4096 4096
ReadX 13374 3136 512 512
ReadX 13374 2880 4096 4096
Close 13374
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13398
WriteX 13398 0 65471 65471
WriteX 13398 65471 63 63
WriteX 13398 65534 65471 65471
WriteX 13398 131005 63 63
Close 13398
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13399
WriteX 13399 0 65471 65471
WriteX 13399 65471 63 63
WriteX 13399 65534 65471 65471
WriteX 13399 131005 63 63
WriteX 13399 131068 65471 65471
WriteX 13399 196539 63 63
WriteX 13399 196602 65471 65471
WriteX 13399 262073 63 63
Close 13399
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13400
WriteX 13400 0 65471 65471
WriteX 13400 65471 63 63
WriteX 13400 65534 65471 65471
WriteX 13400 131005 63 63
WriteX 13400 131068 65471 65471
WriteX 13400 196539 63 63
WriteX 13400 196602 65471 65471
WriteX 13400 262073 63 63
WriteX 13400 262136 65471 65471
WriteX 13400 327607 63 63
WriteX 13400 327670 65471 65471
WriteX 13400 393141 63 63
WriteX 13400 393204 65471 65471
WriteX 13400 458675 63 63
WriteX 13400 458738 65471 65471
WriteX 13400 524209 63 63
Close 13400
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13401
Close 13401
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13402
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13402 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13403
ReadX 13403 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13404
ReadX 13404 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13405
ReadX 13405 0 511 511
ReadX 13402 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13402
Close 13403
Close 13404
Close 13405
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13406
ReadX 13406 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13407
ReadX 13407 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13408
ReadX 13408 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13409
ReadX 13409 0 511 511
ReadX 13406 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13410
FIND_FIRST \clients\client1\~dmtmp\*
Close 13410
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13411
QUERY_FILE_INFORMATION 13411
WriteX 13411 2047 1 1
QUERY_FILE_INFORMATION 13411
WriteX 13411 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13412
Close 13412
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13413
WriteX 13413 52 1 1
QUERY_FILE_INFORMATION 13413
WriteX 13413 0 53 53
WriteX 13413 53 28 28
WriteX 13413 81 4 4
WriteX 13413 85 28 28
WriteX 13413 113 38 38
WriteX 13413 151 28 28
WriteX 13413 179 2 2
WriteX 13413 181 28 28
WriteX 13413 209 3 3
WriteX 13413 212 279 279
WriteX 13413 9 4 4
Close 13413
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13414
ReadX 13414 0 53 53
ReadX 13414 53 28 28
ReadX 13414 81 4 4
ReadX 13414 85 28 28
ReadX 13414 113 38 38
ReadX 13414 151 28 28
ReadX 13414 179 2 2
ReadX 13414 181 28 28
ReadX 13414 209 3 3
Close 13414
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13406
Close 13407
Close 13408
Close 13409
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13415
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13415 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13416
ReadX 13416 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13417
ReadX 13417 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13418
ReadX 13418 0 511 511
ReadX 13415 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13420
Close 13420
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13421
WriteX 13421 52 1 1
QUERY_FILE_INFORMATION 13421
WriteX 13421 0 53 53
WriteX 13421 53 28 28
WriteX 13421 81 28 28
WriteX 13421 109 28 28
WriteX 13421 137 28 28
WriteX 13421 165 28 28
WriteX 13421 193 28 28
WriteX 13421 221 28 28
WriteX 13421 249 4 4
WriteX 13421 253 4 4
WriteX 13421 257 4 4
WriteX 13421 261 28 28
WriteX 13421 289 2 2
WriteX 13421 291 2 2
WriteX 13421 293 2 2
WriteX 13421 295 248 248
WriteX 13421 9 4 4
Close 13421
Close 13415
Close 13416
Close 13417
Close 13418
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13422
ReadX 13422 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13423
ReadX 13423 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13424
ReadX 13424 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13425
ReadX 13425 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13426
ReadX 13426 0 53 53
ReadX 13426 53 28 28
ReadX 13426 81 28 28
ReadX 13426 109 28 28
ReadX 13426 137 28 28
ReadX 13426 165 28 28
ReadX 13426 193 28 28
ReadX 13426 221 28 28
ReadX 13426 249 4 4
ReadX 13426 253 4 4
ReadX 13426 257 4 4
ReadX 13426 261 28 28
ReadX 13426 289 2 2
ReadX 13426 291 2 2
ReadX 13426 293 2 2
Close 13426
ReadX 13422 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13422
Close 13423
Close 13424
Close 13425
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13411
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13427
Close 13427
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13428
ReadX 13428 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13429
ReadX 13429 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13430
ReadX 13430 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13431
ReadX 13431 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13432
ReadX 13432 0 53 53
ReadX 13432 53 28 28
ReadX 13432 81 28 28
ReadX 13432 109 28 28
ReadX 13432 137 28 28
ReadX 13432 165 28 28
ReadX 13432 193 28 28
ReadX 13432 221 28 28
ReadX 13432 249 4 4
ReadX 13432 253 4 4
ReadX 13432 257 4 4
ReadX 13432 261 28 28
ReadX 13432 289 2 2
ReadX 13432 291 2 2
ReadX 13432 293 2 2
Close 13432
ReadX 13428 2048 2048 2048
Close 13428
Close 13429
Close 13430
Close 13431
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13433
ReadX 13433 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13434
ReadX 13434 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13435
ReadX 13435 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13436
ReadX 13436 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13437
ReadX 13437 0 53 53
ReadX 13437 53 28 28
ReadX 13437 81 28 28
ReadX 13437 109 28 28
ReadX 13437 137 28 28
ReadX 13437 165 28 28
ReadX 13437 193 28 28
ReadX 13437 221 28 28
ReadX 13437 249 4 4
ReadX 13437 253 4 4
ReadX 13437 257 4 4
ReadX 13437 261 28 28
ReadX 13437 289 2 2
ReadX 13437 291 2 2
ReadX 13437 293 2 2
Close 13437
ReadX 13433 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13441
FIND_FIRST \clients\client1\~dmtmp\*
Close 13441
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13442
QUERY_FILE_INFORMATION 13442
WriteX 13442 2047 1 1
QUERY_FILE_INFORMATION 13442
WriteX 13442 0 2048 2048
Close 13442
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13443
ReadX 13443 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13443
Close 13433
Close 13434
Close 13435
Close 13436
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13444
ReadX 13444 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13444 4095 1 1
QUERY_FILE_INFORMATION 13444
WriteX 13444 2048 2048 2048
QUERY_FILE_INFORMATION 13444
Flush 13444
WriteX 13444 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13445
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13445 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13446
ReadX 13446 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13447
ReadX 13447 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13448
ReadX 13448 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13449
ReadX 13449 0 53 53
ReadX 13449 53 28 28
ReadX 13449 81 28 28
ReadX 13449 109 28 28
ReadX 13449 137 28 28
ReadX 13449 165 28 28
ReadX 13449 193 28 28
ReadX 13449 221 28 28
ReadX 13449 249 4 4
ReadX 13449 253 4 4
ReadX 13449 257 4 4
ReadX 13449 261 28 28
ReadX 13449 289 2 2
ReadX 13449 291 2 2
ReadX 13449 293 2 2
Close 13449
ReadX 13445 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13453
FIND_FIRST \clients\client1\~dmtmp\*
Close 13453
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13454
QUERY_FILE_INFORMATION 13454
WriteX 13454 2047 1 1
QUERY_FILE_INFORMATION 13454
WriteX 13454 0 2048 2048
Close 13454
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13455
ReadX 13455 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13459
Close 13459
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13460
QUERY_FILE_INFORMATION 13460
WriteX 13460 2047 1 1
QUERY_FILE_INFORMATION 13460
WriteX 13460 0 2048 2048
Close 13460
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13461
ReadX 13461 0 511 511
ReadX 13445 384 2048 2048
ReadX 13445 768 16384 16384
ReadX 13445 1792 14336 14336
Close 13461
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13462
ReadX 13462 0 511 511
Close 13462
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13464
Close 13464
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13455 4095 1 1
QUERY_FILE_INFORMATION 13455
WriteX 13455 2048 2048 2048
WriteX 13455 0 88 88
Close 13455
WriteX 13445 1152 2048 2048
WriteX 13445 1408 6144 6144
WriteX 13445 1920 2048 2048
WriteX 13445 0 88 88
Close 13445
WriteX 13446 0 88 88
Close 13446
WriteX 13447 0 88 88
Close 13447
Close 13448
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13465
ReadX 13465 0 511 511
ReadX 13465 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13465
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13466
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13466 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13467
ReadX 13467 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13468
ReadX 13468 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13469
ReadX 13469 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13470
ReadX 13470 0 53 53
ReadX 13470 53 28 28
ReadX 13470 81 28 28
ReadX 13470 109 28 28
ReadX 13470 137 28 28
ReadX 13470 165 28 28
ReadX 13470 193 28 28
ReadX 13470 221 28 28
ReadX 13470 249 4 4
ReadX 13470 253 4 4
ReadX 13470 257 4 4
ReadX 13470 261 28 28
ReadX 13470 289 2 2
ReadX 13470 291 2 2
ReadX 13470 293 2 2
Close 13470
ReadX 13466 2048 2048 2048
Close 13466
Close 13467
Close 13468
Close 13469
Close 13444
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13471
QUERY_FILE_INFORMATION 13471
Close 13471
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13472
Close 13472
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13473
ReadX 13473 0 511 511
ReadX 13473 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13474
ReadX 13474 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13475
ReadX 13475 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13476
ReadX 13476 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13477
ReadX 13477 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13478
ReadX 13478 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13479
ReadX 13479 0 53 53
ReadX 13479 53 2 2
ReadX 13479 55 2 2
ReadX 13479 57 184 184
ReadX 13479 241 298 298
Close 13479
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13480
ReadX 13480 0 41 41
ReadX 13473 2048 2048 2048
Close 13480
Close 13473
Close 13474
Close 13477
Close 13478
Close 13475
Close 13476
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13481
ReadX 13481 0 511 511
ReadX 13481 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13482
ReadX 13482 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13483
ReadX 13483 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13484
ReadX 13484 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13485
ReadX 13485 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13486
ReadX 13486 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13487
ReadX 13487 0 53 53
ReadX 13487 53 2 2
ReadX 13487 55 2 2
ReadX 13487 57 184 184
ReadX 13487 241 298 298
Close 13487
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13488
ReadX 13488 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13489
ReadX 13489 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13490
ReadX 13490 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13491
ReadX 13491 0 511 511
ReadX 13490 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13492
ReadX 13492 0 53 53
ReadX 13492 53 2 2
ReadX 13492 55 480 480
ReadX 13492 535 2 2
Close 13492
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13493
ReadX 13493 0 41 41
ReadX 13481 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13497
FIND_FIRST \clients\client1\~dmtmp\*
Close 13497
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13498
QUERY_FILE_INFORMATION 13498
WriteX 13498 2047 1 1
QUERY_FILE_INFORMATION 13498
WriteX 13498 0 2048 2048
Close 13498
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13499
ReadX 13499 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13499
Close 13488
Close 13489
Close 13490
Close 13491
Close 13493
Close 13481
Close 13482
Close 13485
Close 13486
Close 13483
Close 13484
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13500
ReadX 13500 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13501
Close 13501
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13502
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13502 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13503
ReadX 13503 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13504
ReadX 13504 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13505
ReadX 13505 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13506
ReadX 13506 0 53 53
ReadX 13506 53 2 2
ReadX 13506 55 480 480
ReadX 13506 535 2 2
Close 13506
ReadX 13502 2048 2048 2048
Close 13502
Close 13503
Close 13504
Close 13505
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13507
ReadX 13507 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13508
ReadX 13508 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13509
ReadX 13509 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13510
ReadX 13510 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13511
ReadX 13511 0 53 53
ReadX 13511 53 2 2
ReadX 13511 55 480 480
ReadX 13511 535 2 2
Close 13511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13512
ReadX 13512 0 511 511
ReadX 13512 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13513
ReadX 13513 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13514
ReadX 13514 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13515
ReadX 13515 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13516
ReadX 13516 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13517
ReadX 13517 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13518
ReadX 13518 0 41 41
ReadX 13512 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13519
ReadX 13519 0 53 53
ReadX 13519 53 2 2
ReadX 13519 55 2 2
ReadX 13519 57 184 184
ReadX 13519 241 298 298
Close 13519
ReadX 13507 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13523
FIND_FIRST \clients\client1\~dmtmp\*
Close 13523
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13524
QUERY_FILE_INFORMATION 13524
WriteX 13524 2047 1 1
QUERY_FILE_INFORMATION 13524
WriteX 13524 0 2048 2048
Close 13524
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13525
ReadX 13525 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13525
Close 13518
Close 13512
Close 13513
Close 13516
Close 13517
Close 13514
Close 13515
Close 13507
Close 13508
Close 13509
Close 13510
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13526
ReadX 13526 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13500 4095 1 1
QUERY_FILE_INFORMATION 13500
WriteX 13500 2048 2048 2048
QUERY_FILE_INFORMATION 13500
Flush 13500
WriteX 13500 0 88 88
WriteX 13526 4095 1 1
QUERY_FILE_INFORMATION 13526
WriteX 13526 2048 2048 2048
QUERY_FILE_INFORMATION 13526
Flush 13526
WriteX 13526 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13527
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13527 0 511 511
ReadX 13527 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13528
ReadX 13528 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13529
ReadX 13529 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13530
ReadX 13530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13531
ReadX 13531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13532
ReadX 13532 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13533
ReadX 13533 0 53 53
ReadX 13533 53 2 2
ReadX 13533 55 2 2
ReadX 13533 57 184 184
ReadX 13533 241 298 298
Close 13533
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13534
ReadX 13534 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13535
ReadX 13535 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13536
ReadX 13536 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13537
ReadX 13537 0 511 511
ReadX 13536 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13538
ReadX 13538 0 53 53
ReadX 13538 53 2 2
ReadX 13538 55 480 480
ReadX 13538 535 2 2
Close 13538
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13539
ReadX 13539 0 41 41
ReadX 13527 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13540
ReadX 13540 0 53 53
ReadX 13540 53 2 2
ReadX 13540 55 480 480
ReadX 13540 535 2 2
Close 13540
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13541
ReadX 13541 0 53 53
ReadX 13541 53 2 2
ReadX 13541 55 2 2
ReadX 13541 57 184 184
ReadX 13541 241 298 298
Close 13541
ReadX 13534 2048 2048 2048
ReadX 13535 2048 2048 2048
ReadX 13534 320 16384 16384
ReadX 13534 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13542
FIND_FIRST \clients\client1\~dmtmp\*
Close 13542
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13543
QUERY_FILE_INFORMATION 13543
WriteX 13543 4095 1 1
QUERY_FILE_INFORMATION 13543
WriteX 13543 0 4096 4096
Close 13543
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13544
ReadX 13544 0 41 41
Close 13534
Close 13535
Close 13536
Close 13537
Close 13539
Close 13527
Close 13528
Close 13531
Close 13532
Close 13529
Close 13530
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13545
Close 13545
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13546
QUERY_FILE_INFORMATION 13546
WriteX 13546 4095 1 1
QUERY_FILE_INFORMATION 13546
WriteX 13546 0 4096 4096
Close 13546
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13547
ReadX 13547 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 13544
ReadX 13544 0 4096 4096
WriteX 13547 0 4096 4096
Close 13547
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13549
ReadX 13549 0 41 41
Close 13544
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13549
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13550
Close 13550
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13551
ReadX 13551 0 41 41
Close 13551
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13552
Close 13552
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13553
QUERY_FILE_INFORMATION 13553
WriteX 13553 2047 1 1
QUERY_FILE_INFORMATION 13553
WriteX 13553 0 2048 2048
Close 13553
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13554
ReadX 13554 0 511 511
ReadX 13554 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13555
ReadX 13555 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13555
Close 13554
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13556
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13556 0 511 511
ReadX 13556 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13557
ReadX 13557 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13558
ReadX 13558 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13559
ReadX 13559 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13560
ReadX 13560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13561
ReadX 13561 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13562
ReadX 13562 0 53 53
ReadX 13562 53 2 2
ReadX 13562 55 2 2
ReadX 13562 57 184 184
ReadX 13562 241 298 298
Close 13562
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13563
ReadX 13563 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13564
ReadX 13564 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13565
ReadX 13565 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13566
ReadX 13566 0 511 511
ReadX 13565 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13567
ReadX 13567 0 53 53
ReadX 13567 53 2 2
ReadX 13567 55 480 480
ReadX 13567 535 2 2
Close 13567
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13568
ReadX 13568 0 41 41
ReadX 13556 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13569
ReadX 13569 0 53 53
ReadX 13569 53 2 2
ReadX 13569 55 480 480
ReadX 13569 535 2 2
Close 13569
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13570
ReadX 13570 0 53 53
ReadX 13570 53 2 2
ReadX 13570 55 2 2
ReadX 13570 57 184 184
ReadX 13570 241 298 298
Close 13570
ReadX 13563 2048 2048 2048
Close 13563
Close 13564
Close 13565
Close 13566
Close 13568
Close 13556
Close 13557
Close 13560
Close 13561
Close 13558
Close 13559
Close 13500
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13571
QUERY_FILE_INFORMATION 13571
Close 13571
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13572
QUERY_FILE_INFORMATION 13572
Close 13572
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13573
Close 13573
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13574
ReadX 13574 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13575
ReadX 13575 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13576
ReadX 13576 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13577
ReadX 13577 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13578
ReadX 13578 0 53 53
ReadX 13578 53 2 2
ReadX 13578 55 480 480
ReadX 13578 535 2 2
Close 13578
ReadX 13574 2048 2048 2048
Close 13574
Close 13575
Close 13576
Close 13577
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13579
ReadX 13579 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13580
ReadX 13580 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13581
ReadX 13581 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13582
ReadX 13582 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13583
ReadX 13583 0 53 53
ReadX 13583 53 2 2
ReadX 13583 55 480 480
ReadX 13583 535 2 2
Close 13583
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13584
ReadX 13584 0 511 511
ReadX 13584 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13585
ReadX 13585 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13586
ReadX 13586 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13587
ReadX 13587 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13588
ReadX 13588 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13589
ReadX 13589 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13590
ReadX 13590 0 41 41
ReadX 13584 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13591
ReadX 13591 0 53 53
ReadX 13591 53 2 2
ReadX 13591 55 2 2
ReadX 13591 57 184 184
ReadX 13591 241 298 298
Close 13591
ReadX 13579 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13595
FIND_FIRST \clients\client1\~dmtmp\*
Close 13595
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13596
QUERY_FILE_INFORMATION 13596
WriteX 13596 2047 1 1
QUERY_FILE_INFORMATION 13596
WriteX 13596 0 2048 2048
Close 13596
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13597
ReadX 13597 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13597
Close 13590
Close 13584
Close 13585
Close 13588
Close 13589
Close 13586
Close 13587
Close 13579
Close 13580
Close 13581
Close 13582
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13598
ReadX 13598 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
Close 13599
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13600
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13601
ReadX 13601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13602
ReadX 13602 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13603
ReadX 13603 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13604
ReadX 13604 0 53 53
ReadX 13604 53 28 28
ReadX 13604 81 28 28
ReadX 13604 109 28 28
ReadX 13604 137 28 28
ReadX 13604 165 28 28
ReadX 13604 193 28 28
ReadX 13604 221 28 28
ReadX 13604 249 4 4
ReadX 13604 253 4 4
ReadX 13604 257 4 4
ReadX 13604 261 28 28
ReadX 13604 289 2 2
ReadX 13604 291 2 2
ReadX 13604 293 2 2
Close 13604
ReadX 13600 2048 2048 2048
Close 13600
Close 13601
Close 13602
Close 13603
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13605
ReadX 13605 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13606
ReadX 13606 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13607
ReadX 13607 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13608
ReadX 13608 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13609
ReadX 13609 0 53 53
ReadX 13609 53 28 28
ReadX 13609 81 28 28
ReadX 13609 109 28 28
ReadX 13609 137 28 28
ReadX 13609 165 28 28
ReadX 13609 193 28 28
ReadX 13609 221 28 28
ReadX 13609 249 4 4
ReadX 13609 253 4 4
ReadX 13609 257 4 4
ReadX 13609 261 28 28
ReadX 13609 289 2 2
ReadX 13609 291 2 2
ReadX 13609 293 2 2
Close 13609
ReadX 13605 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13613
FIND_FIRST \clients\client1\~dmtmp\*
Close 13613
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13614
QUERY_FILE_INFORMATION 13614
WriteX 13614 2047 1 1
QUERY_FILE_INFORMATION 13614
WriteX 13614 0 2048 2048
Close 13614
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13615
ReadX 13615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13615
Close 13605
Close 13606
Close 13607
Close 13608
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13616
ReadX 13616 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13617
Close 13617
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13618
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13618 0 511 511
ReadX 13618 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13619
ReadX 13619 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13620
ReadX 13620 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13621
ReadX 13621 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13622
ReadX 13622 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13623
ReadX 13623 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13624
ReadX 13624 0 53 53
ReadX 13624 53 2 2
ReadX 13624 55 2 2
ReadX 13624 57 184 184
ReadX 13624 241 298 298
Close 13624
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13625
ReadX 13625 0 41 41
ReadX 13618 2048 2048 2048
Close 13625
Close 13618
Close 13619
Close 13622
Close 13623
Close 13620
Close 13621
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13626
ReadX 13626 0 511 511
ReadX 13626 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13627
ReadX 13627 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13628
ReadX 13628 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13629
ReadX 13629 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13630
ReadX 13630 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13631
ReadX 13631 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13632
ReadX 13632 0 53 53
ReadX 13632 53 2 2
ReadX 13632 55 2 2
ReadX 13632 57 184 184
ReadX 13632 241 298 298
Close 13632
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13633
ReadX 13633 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13634
ReadX 13634 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13635
ReadX 13635 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13636
ReadX 13636 0 511 511
ReadX 13635 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13637
ReadX 13637 0 53 53
ReadX 13637 53 2 2
ReadX 13637 55 480 480
ReadX 13637 535 2 2
Close 13637
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13638
ReadX 13638 0 41 41
ReadX 13626 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13642
FIND_FIRST \clients\client1\~dmtmp\*
Close 13642
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13643
QUERY_FILE_INFORMATION 13643
WriteX 13643 2047 1 1
QUERY_FILE_INFORMATION 13643
WriteX 13643 0 2048 2048
Close 13643
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13644
ReadX 13644 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13644
Close 13633
Close 13634
Close 13635
Close 13636
Close 13638
Close 13626
Close 13627
Close 13630
Close 13631
Close 13628
Close 13629
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13645
ReadX 13645 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13598 4095 1 1
QUERY_FILE_INFORMATION 13598
WriteX 13598 2048 2048 2048
QUERY_FILE_INFORMATION 13598
Flush 13598
WriteX 13598 0 88 88
WriteX 13616 4095 1 1
QUERY_FILE_INFORMATION 13616
WriteX 13616 2048 2048 2048
QUERY_FILE_INFORMATION 13616
Flush 13616
WriteX 13616 0 88 88
WriteX 13645 4095 1 1
QUERY_FILE_INFORMATION 13645
WriteX 13645 2048 2048 2048
QUERY_FILE_INFORMATION 13645
Flush 13645
WriteX 13645 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13646
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13647
ReadX 13647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13648
ReadX 13648 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13649
ReadX 13649 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13650
ReadX 13650 0 53 53
ReadX 13650 53 2 2
ReadX 13650 55 480 480
ReadX 13650 535 2 2
Close 13650
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13651
ReadX 13651 0 511 511
ReadX 13651 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13652
ReadX 13652 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13653
ReadX 13653 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13654
ReadX 13654 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13655
ReadX 13655 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13656
ReadX 13656 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13657
ReadX 13657 0 41 41
ReadX 13651 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13658
ReadX 13658 0 53 53
ReadX 13658 53 2 2
ReadX 13658 55 2 2
ReadX 13658 57 184 184
ReadX 13658 241 298 298
Close 13658
ReadX 13646 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13659
ReadX 13659 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13660
ReadX 13660 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13661
ReadX 13661 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13662
ReadX 13662 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13663
ReadX 13663 0 53 53
ReadX 13663 53 28 28
ReadX 13663 81 28 28
ReadX 13663 109 28 28
ReadX 13663 137 28 28
ReadX 13663 165 28 28
ReadX 13663 193 28 28
ReadX 13663 221 28 28
ReadX 13663 249 4 4
ReadX 13663 253 4 4
ReadX 13663 257 4 4
ReadX 13663 261 28 28
ReadX 13663 289 2 2
ReadX 13663 291 2 2
ReadX 13663 293 2 2
Close 13663
ReadX 13659 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13664
ReadX 13664 0 53 53
ReadX 13664 53 2 2
ReadX 13664 55 2 2
ReadX 13664 57 184 184
ReadX 13664 241 298 298
Close 13664
ReadX 13648 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13665
ReadX 13665 0 53 53
ReadX 13665 53 2 2
ReadX 13665 55 480 480
ReadX 13665 535 2 2
Close 13665
ReadX 13659 4096 16384 16384
ReadX 13659 1280 16384 16384
ReadX 13659 2304 6144 6144
ReadX 13659 2688 2048 2048
ReadX 13646 4096 16384 16384
ReadX 13646 1280 16384 16384
ReadX 13646 2304 16384 16384
ReadX 13646 3328 16384 16384
ReadX 13646 272 16384 16384
ReadX 13646 336 16384 16384
ReadX 13646 400 16384 16384
ReadX 13646 464 16384 16384
ReadX 13646 528 16384 16384
ReadX 13646 592 16384 16384
ReadX 13646 656 16384 16384
ReadX 13646 720 16384 16384
ReadX 13646 784 16384 16384
ReadX 13646 848 16384 16384
ReadX 13646 912 16384 16384
ReadX 13652 2048 2048 2048
ReadX 13651 760 2048 2048
ReadX 13651 1144 2048 2048
ReadX 13651 408 2048 2048
ReadX 13651 912 2048 2048
ReadX 13651 1096 2048 2048
ReadX 13651 776 2048 2048
ReadX 13651 560 2048 2048
ReadX 13651 376 2048 2048
ReadX 13651 320 2048 2048
ReadX 13651 3072 2048 2048
ReadX 13651 784 2048 2048
ReadX 13651 2176 2048 2048
ReadX 13651 792 2048 2048
ReadX 13651 576 2048 2048
ReadX 13651 600 2048 2048
ReadX 13651 728 2048 2048
ReadX 13651 1112 2048 2048
ReadX 13651 664 2048 2048
ReadX 13651 976 2048 2048
ReadX 13651 3840 2048 2048
ReadX 13651 296 2048 2048
ReadX 13651 480 2048 2048
ReadX 13651 680 2048 2048
ReadX 13651 696 2048 2048
ReadX 13651 832 2048 2048
ReadX 13651 1016 2048 2048
ReadX 13651 1104 2048 2048
ReadX 13651 3200 2048 2048
ReadX 13651 264 2048 2048
ReadX 13651 448 2048 2048
ReadX 13651 648 2048 2048
ReadX 13651 1136 2048 2048
ReadX 13651 288 2048 2048
ReadX 13651 352 2048 2048
ReadX 13651 536 2048 2048
ReadX 13651 800 2048 2048
ReadX 13651 736 2048 2048
ReadX 13651 392 2048 2048
ReadX 13651 752 2048 2048
ReadX 13651 880 2048 2048
ReadX 13651 1064 2048 2048
ReadX 13651 1128 2048 2048
ReadX 13651 1536 2048 2048
ReadX 13651 2432 2048 2048
ReadX 13651 688 2048 2048
ReadX 13651 872 2048 2048
ReadX 13651 1072 2048 2048
ReadX 13651 984 2048 2048
ReadX 13651 704 2048 2048
ReadX 13651 3328 2048 2048
ReadX 13651 888 2048 2048
ReadX 13651 496 2048 2048
ReadX 13651 624 2048 2048
ReadX 13651 808 2048 2048
ReadX 13651 1008 2048 2048
ReadX 13651 1152 2048 2048
ReadX 13651 416 2048 2048
ReadX 13651 584 2048 2048
ReadX 13651 384 2048 2048
ReadX 13651 568 2048 2048
ReadX 13651 512 2048 2048
ReadX 13651 1408 2048 2048
ReadX 13651 472 2048 2048
ReadX 13651 672 2048 2048
ReadX 13651 2560 2048 2048
ReadX 13651 544 2048 2048
ReadX 13651 920 2048 2048
ReadX 13651 1120 2048 2048
ReadX 13651 2304 2048 2048
ReadX 13651 1080 2048 2048
ReadX 13651 1664 2048 2048
ReadX 13651 608 2048 2048
ReadX 13651 2688 2048 2048
ReadX 13651 3712 2048 2048
ReadX 13651 616 2048 2048
ReadX 13651 632 2048 2048
ReadX 13651 944 2048 2048
ReadX 13651 856 2048 2048
ReadX 13651 768 2048 2048
ReadX 13651 720 2048 2048
ReadX 13651 640 2048 2048
ReadX 13651 1048 2048 2048
ReadX 13651 1040 2048 2048
ReadX 13651 1032 2048 2048
ReadX 13651 1000 2048 2048
ReadX 13651 992 2048 2048
ReadX 13651 968 2048 2048
ReadX 13651 952 2048 2048
ReadX 13651 1056 2048 2048
ReadX 13651 816 2048 2048
ReadX 13651 864 2048 2048
ReadX 13651 2816 2048 2048
ReadX 13651 640 2048 2048
ReadX 13651 1024 2048 2048
ReadX 13651 504 2048 2048
ReadX 13651 424 2048 2048
ReadX 13651 840 2048 2048
ReadX 13651 896 2048 2048
ReadX 13651 520 2048 2048
ReadX 13651 960 2048 2048
ReadX 13651 552 2048 2048
ReadX 13651 488 2048 2048
ReadX 13651 824 2048 2048
ReadX 13651 304 2048 2048
ReadX 13651 768 2048 2048
ReadX 13651 712 2048 2048
ReadX 13651 512 2048 2048
ReadX 13651 432 2048 2048
ReadX 13651 384 2048 2048
ReadX 13651 2944 2048 2048
ReadX 13651 1088 2048 2048
ReadX 13651 928 2048 2048
ReadX 13651 280 2048 2048
ReadX 13651 744 2048 2048
ReadX 13651 3968 2048 2048
ReadX 13651 336 2048 2048
ReadX 13651 592 2048 2048
ReadX 13651 312 2048 2048
ReadX 13651 400 2048 2048
ReadX 13651 904 2048 2048
ReadX 13651 464 2048 2048
ReadX 13651 3456 2048 2048
ReadX 13651 848 2048 2048
ReadX 13651 936 2048 2048
ReadX 13651 656 2048 2048
ReadX 13651 344 2048 2048
ReadX 13651 440 2048 2048
ReadX 13651 4096 2048 2048
ReadX 13651 528 2048 2048
ReadX 13651 2048 2048 2048
ReadX 13651 1024 2048 2048
ReadX 13651 456 2048 2048
ReadX 13651 1792 2048 2048
ReadX 13651 1152 2048 2048
ReadX 13651 3584 2048 2048
ReadX 13651 1920 2048 2048
ReadX 13651 1280 2048 2048
ReadX 13651 896 2048 2048
ReadX 13651 328 2048 2048
Close 13659
Close 13660
Close 13661
Close 13662
Close 13657
Close 13651
Close 13652
Close 13655
Close 13656
Close 13653
Close 13654
Close 13646
Close 13647
Close 13648
Close 13649
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13666
FIND_FIRST \clients\client1\~dmtmp\*
Close 13666
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13667
QUERY_FILE_INFORMATION 13667
WriteX 13667 0 2048 2048
WriteX 13667 18431 1 1
QUERY_FILE_INFORMATION 13667
WriteX 13667 2048 16384 16384
WriteX 13667 1152 16384 16384
WriteX 13667 2176 16384 16384
WriteX 13667 3200 16384 16384
WriteX 13667 264 16384 16384
WriteX 13667 328 16384 16384
WriteX 13667 392 16384 16384
WriteX 13667 456 16384 16384
WriteX 13667 520 16384 16384
WriteX 13667 584 16384 16384
WriteX 13667 648 16384 16384
WriteX 13667 712 16384 16384
WriteX 13667 776 16384 16384
WriteX 13667 840 16384 16384
WriteX 13667 904 16384 16384
WriteX 13667 968 16384 16384
WriteX 13667 1032 16384 16384
WriteX 13667 1096 16384 16384
WriteX 13667 1160 16384 16384
WriteX 13667 1224 16384 16384
WriteX 13667 1288 16384 16384
WriteX 13667 1352 16384 16384
WriteX 13667 1416 16384 16384
WriteX 13667 1480 16384 16384
WriteX 13667 1544 16384 16384
WriteX 13667 1608 16384 16384
WriteX 13667 1672 16384 16384
WriteX 13667 1736 16384 16384
WriteX 13667 1800 16384 16384
WriteX 13667 1864 16384 16384
WriteX 13667 1928 16384 16384
WriteX 13667 1992 16384 16384
WriteX 13667 2056 16384 16384
WriteX 13667 2120 16384 16384
WriteX 13667 2184 16384 16384
WriteX 13667 2248 16384 16384
WriteX 13667 2312 16384 16384
WriteX 13667 2376 16384 16384
WriteX 13667 2440 16384 16384
WriteX 13667 0 88 88
Close 13667
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13668
ReadX 13668 0 511 511
ReadX 13668 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13668
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13669
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13669 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13670
ReadX 13670 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13671
ReadX 13671 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13672
ReadX 13672 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13673
ReadX 13673 0 53 53
ReadX 13673 53 2 2
ReadX 13673 55 480 480
ReadX 13673 535 2 2
Close 13673
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13674
ReadX 13674 0 511 511
ReadX 13674 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13675
ReadX 13675 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13676
ReadX 13676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13677
ReadX 13677 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13678
ReadX 13678 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13679
ReadX 13679 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13680
ReadX 13680 0 41 41
ReadX 13674 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13681
ReadX 13681 0 53 53
ReadX 13681 53 2 2
ReadX 13681 55 2 2
ReadX 13681 57 184 184
ReadX 13681 241 298 298
Close 13681
ReadX 13669 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13682
ReadX 13682 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13683
ReadX 13683 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13684
ReadX 13684 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13685
ReadX 13685 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13686
ReadX 13686 0 53 53
ReadX 13686 53 28 28
ReadX 13686 81 28 28
ReadX 13686 109 28 28
ReadX 13686 137 28 28
ReadX 13686 165 28 28
ReadX 13686 193 28 28
ReadX 13686 221 28 28
ReadX 13686 249 4 4
ReadX 13686 253 4 4
ReadX 13686 257 4 4
ReadX 13686 261 28 28
ReadX 13686 289 2 2
ReadX 13686 291 2 2
ReadX 13686 293 2 2
Close 13686
ReadX 13682 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13687
ReadX 13687 0 53 53
ReadX 13687 53 2 2
ReadX 13687 55 2 2
ReadX 13687 57 184 184
ReadX 13687 241 298 298
Close 13687
ReadX 13671 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13688
ReadX 13688 0 53 53
ReadX 13688 53 2 2
ReadX 13688 55 480 480
ReadX 13688 535 2 2
Close 13688
Close 13682
Close 13683
Close 13684
Close 13685
Close 13680
Close 13674
Close 13675
Close 13678
Close 13679
Close 13676
Close 13677
Close 13669
Close 13670
Close 13671
Close 13672
Close 13598
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13689
QUERY_FILE_INFORMATION 13689
Close 13689
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13616
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13690
QUERY_FILE_INFORMATION 13690
Close 13690
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13645
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13691
QUERY_FILE_INFORMATION 13691
Close 13691
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13692
Close 13692
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13693
ReadX 13693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13694
ReadX 13694 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13695
ReadX 13695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13696
ReadX 13696 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13697
ReadX 13697 0 53 53
ReadX 13697 53 28 28
ReadX 13697 81 28 28
ReadX 13697 109 28 28
ReadX 13697 137 28 28
ReadX 13697 165 28 28
ReadX 13697 193 28 28
ReadX 13697 221 28 28
ReadX 13697 249 4 4
ReadX 13697 253 4 4
ReadX 13697 257 4 4
ReadX 13697 261 28 28
ReadX 13697 289 2 2
ReadX 13697 291 2 2
ReadX 13697 293 2 2
Close 13697
ReadX 13693 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13693 384 2048 2048
ReadX 13693 768 16384 16384
ReadX 13693 1792 14336 14336
ReadX 13696 2048 2048 2048
ReadX 13695 2048 2048 2048
WriteX 13693 1152 2048 2048
WriteX 13696 2048 2048 2048
WriteX 13695 2048 2048 2048
WriteX 13693 0 88 88
WriteX 13694 0 88 88
WriteX 13695 0 88 88
WriteX 13696 0 88 88
Close 13693
Close 13694
Close 13695
Close 13696
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13698
Close 13698
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13699
ReadX 13699 0 511 511
ReadX 13699 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13700
ReadX 13700 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13701
ReadX 13701 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13702
ReadX 13702 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13703
ReadX 13703 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13704
ReadX 13704 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13705
ReadX 13705 0 53 53
ReadX 13705 53 2 2
ReadX 13705 55 2 2
ReadX 13705 57 184 184
ReadX 13705 241 298 298
Close 13705
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13706
ReadX 13706 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13707
ReadX 13707 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13708
ReadX 13708 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13709
ReadX 13709 0 511 511
ReadX 13708 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13710
ReadX 13710 0 53 53
ReadX 13710 53 2 2
ReadX 13710 55 480 480
ReadX 13710 535 2 2
Close 13710
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13711
ReadX 13711 0 41 41
ReadX 13699 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13712
QUERY_FILE_INFORMATION 13712
QUERY_FILE_INFORMATION 13712
ReadX 13712 0 8192 8192
Close 13712
ReadX 13699 1152 2048 2048
ReadX 13699 4096 16384 16384
Close 13706
Close 13707
Close 13708
Close 13709
Close 13711
Close 13699
Close 13700
Close 13703
Close 13704
Close 13701
Close 13702
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13713
Close 13713
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13714
QUERY_FILE_INFORMATION 13714
ReadX 13714 0 64 64
ReadX 13714 144 64 64
ReadX 13714 224 156 156
ReadX 13714 1193 128 128
ReadX 13714 1201 128 128
ReadX 13714 1072 4 4
ReadX 13714 1076 1925 1925
ReadX 13714 758 4 4
ReadX 13714 762 4557 4557
ReadX 13714 1052 4 4
ReadX 13714 1056 314 314
ReadX 13714 1056 11056 11056
Close 13714
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13715
ReadX 13715 0 511 511
ReadX 13715 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13716
ReadX 13716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13717
ReadX 13717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13718
ReadX 13718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13719
ReadX 13719 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13720
ReadX 13720 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13721
ReadX 13721 0 53 53
ReadX 13721 53 2 2
ReadX 13721 55 2 2
ReadX 13721 57 184 184
ReadX 13721 241 298 298
Close 13721
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13722
ReadX 13722 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13723
ReadX 13723 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13724
ReadX 13724 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13725
ReadX 13725 0 511 511
ReadX 13724 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13726
ReadX 13726 0 53 53
ReadX 13726 53 2 2
ReadX 13726 55 480 480
ReadX 13726 535 2 2
Close 13726
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13727
ReadX 13727 0 41 41
ReadX 13715 2048 2048 2048
ReadX 13716 2048 2048 2048
ReadX 13715 1144 2048 2048
ReadX 13715 1152 2048 2048
ReadX 13715 4096 16384 16384
WriteX 13715 2048 2048 2048
WriteX 13716 2048 2048 2048
WriteX 13715 0 88 88
WriteX 13716 0 88 88
Close 13722
Close 13723
Close 13724
Close 13725
Close 13727
Close 13715
Close 13716
Close 13719
Close 13720
Close 13717
Close 13718
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13728
Close 13728
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13729
QUERY_FILE_INFORMATION 13729
ReadX 13729 0 64 64
ReadX 13729 144 64 64
ReadX 13729 224 84 84
ReadX 13729 478 16 16
ReadX 13729 1056 6176 6176
Close 13729
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13730
ReadX 13730 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13731
ReadX 13731 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13732
ReadX 13732 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13733
ReadX 13733 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13734
ReadX 13734 0 53 53
ReadX 13734 53 28 28
ReadX 13734 81 28 28
ReadX 13734 109 28 28
ReadX 13734 137 28 28
ReadX 13734 165 28 28
ReadX 13734 193 28 28
ReadX 13734 221 28 28
ReadX 13734 249 4 4
ReadX 13734 253 4 4
ReadX 13734 257 4 4
ReadX 13734 261 28 28
ReadX 13734 289 2 2
ReadX 13734 291 2 2
ReadX 13734 293 2 2
Close 13734
ReadX 13730 2048 2048 2048
ReadX 13731 2048 2048 2048
ReadX 13730 1280 2048 2048
ReadX 13733 2048 2048 2048
ReadX 13732 2048 2048 2048
WriteX 13730 1280 2048 2048
WriteX 13733 2048 2048 2048
WriteX 13732 2048 2048 2048
WriteX 13731 2048 2048 2048
WriteX 13730 0 88 88
WriteX 13731 0 88 88
WriteX 13732 0 88 88
WriteX 13733 0 88 88
WriteX 13730 1280 2048 2048
WriteX 13733 2048 2048 2048
WriteX 13732 2048 2048 2048
WriteX 13731 2048 2048 2048
WriteX 13730 0 88 88
WriteX 13731 0 88 88
WriteX 13732 0 88 88
WriteX 13733 0 88 88
WriteX 13730 1280 2048 2048
WriteX 13733 2048 2048 2048
WriteX 13732 2048 2048 2048
WriteX 13731 2048 2048 2048
WriteX 13730 0 88 88
WriteX 13731 0 88 88
WriteX 13732 0 88 88
WriteX 13733 0 88 88
Close 13730
Close 13731
Close 13732
Close 13733
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13735
ReadX 13735 0 511 511
ReadX 13735 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13736
ReadX 13736 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13737
ReadX 13737 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13738
ReadX 13738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13739
ReadX 13739 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13740
ReadX 13740 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13741
ReadX 13741 0 53 53
ReadX 13741 53 2 2
ReadX 13741 55 2 2
ReadX 13741 57 184 184
ReadX 13741 241 298 298
Close 13741
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13742
ReadX 13742 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13743
ReadX 13743 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13744
ReadX 13744 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13745
ReadX 13745 0 511 511
ReadX 13744 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13746
ReadX 13746 0 53 53
ReadX 13746 53 2 2
ReadX 13746 55 480 480
ReadX 13746 535 2 2
Close 13746
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13747
ReadX 13747 0 41 41
ReadX 13735 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13751
FIND_FIRST \clients\client1\~dmtmp\*
Close 13751
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13752
QUERY_FILE_INFORMATION 13752
WriteX 13752 2047 1 1
QUERY_FILE_INFORMATION 13752
WriteX 13752 0 2048 2048
Close 13752
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13753
ReadX 13753 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13753 4095 1 1
QUERY_FILE_INFORMATION 13753
WriteX 13753 2048 2048 2048
WriteX 13753 0 88 88
Close 13753
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13754
ReadX 13754 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13754 2048 2048 2048
Close 13742
Close 13743
Close 13744
Close 13745
Close 13747
Close 13735
Close 13736
Close 13739
Close 13740
Close 13737
Close 13738
WriteX 13754 2048 2048 2048
WriteX 13754 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13755
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13755 0 511 511
ReadX 13755 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13756
ReadX 13756 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13757
ReadX 13757 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13758
ReadX 13758 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13759
ReadX 13759 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13760
ReadX 13760 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13761
ReadX 13761 0 53 53
ReadX 13761 53 2 2
ReadX 13761 55 2 2
ReadX 13761 57 184 184
ReadX 13761 241 298 298
Close 13761
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13762
ReadX 13762 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13763
ReadX 13763 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13764
ReadX 13764 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13765
ReadX 13765 0 511 511
ReadX 13764 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13766
ReadX 13766 0 53 53
ReadX 13766 53 2 2
ReadX 13766 55 480 480
ReadX 13766 535 2 2
Close 13766
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13767
ReadX 13767 0 41 41
ReadX 13755 2048 2048 2048
ReadX 13755 1152 2048 2048
ReadX 13755 4096 16384 16384
ReadX 13755 1280 16384 16384
ReadX 13755 2304 16384 16384
ReadX 13755 3328 16384 16384
ReadX 13755 272 16384 16384
ReadX 13755 336 16384 16384
ReadX 13755 400 16384 16384
ReadX 13755 464 16384 16384
ReadX 13755 528 16384 16384
ReadX 13755 592 16384 16384
ReadX 13755 656 16384 16384
ReadX 13755 720 16384 16384
ReadX 13755 784 16384 16384
ReadX 13755 848 16384 16384
ReadX 13755 912 16384 16384
ReadX 13755 976 16384 16384
ReadX 13755 1040 16384 16384
ReadX 13755 1104 12288 12288
Close 13762
Close 13763
Close 13764
Close 13765
Close 13767
Close 13755
Close 13756
Close 13759
Close 13760
Close 13757
Close 13758
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13768
FIND_FIRST \clients\client1\~dmtmp\*
Close 13768
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13769
QUERY_FILE_INFORMATION 13769
WriteX 13769 0 2048 2048
WriteX 13769 2048 4096 4096
WriteX 13769 0 88 88
Close 13769
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13770
ReadX 13770 0 511 511
ReadX 13770 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13770
WriteX 13754 2048 2048 2048
WriteX 13754 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13771
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13771 0 511 511
ReadX 13771 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13772
ReadX 13772 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13773
ReadX 13773 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13774
ReadX 13774 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13775
ReadX 13775 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13776
ReadX 13776 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13777
ReadX 13777 0 53 53
ReadX 13777 53 2 2
ReadX 13777 55 2 2
ReadX 13777 57 184 184
ReadX 13777 241 298 298
Close 13777
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13778
ReadX 13778 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13779
ReadX 13779 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13780
ReadX 13780 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13781
ReadX 13781 0 511 511
ReadX 13780 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13782
ReadX 13782 0 53 53
ReadX 13782 53 2 2
ReadX 13782 55 480 480
ReadX 13782 535 2 2
Close 13782
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13783
ReadX 13783 0 41 41
ReadX 13771 2048 2048 2048
ReadX 13771 1152 2048 2048
ReadX 13771 4096 16384 16384
ReadX 13771 1280 16384 16384
ReadX 13771 2304 16384 16384
ReadX 13771 3328 16384 16384
ReadX 13771 272 16384 16384
ReadX 13771 336 16384 16384
ReadX 13771 400 16384 16384
ReadX 13771 464 16384 16384
ReadX 13771 528 16384 16384
ReadX 13771 592 16384 16384
ReadX 13771 656 16384 16384
ReadX 13771 720 16384 16384
ReadX 13771 784 16384 16384
ReadX 13771 848 16384 16384
ReadX 13771 912 16384 16384
ReadX 13771 976 16384 16384
ReadX 13771 1040 16384 16384
ReadX 13771 1104 12288 12288
Close 13778
Close 13779
Close 13780
Close 13781
Close 13783
Close 13771
Close 13772
Close 13775
Close 13776
Close 13773
Close 13774
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13784
FIND_FIRST \clients\client1\~dmtmp\*
Close 13784
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13785
QUERY_FILE_INFORMATION 13785
WriteX 13785 0 2048 2048
WriteX 13785 2048 4096 4096
WriteX 13785 0 88 88
Close 13785
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13786
ReadX 13786 0 511 511
ReadX 13786 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13786
Close 13754
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13787
QUERY_FILE_INFORMATION 13787
Close 13787
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13788
Close 13788
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13789
QUERY_FILE_INFORMATION 13789
ReadX 13789 0 64 64
ReadX 13789 144 64 64
ReadX 13789 224 156 156
ReadX 13789 1193 128 128
ReadX 13789 1201 128 128
ReadX 13789 1072 4 4
ReadX 13789 1076 1925 1925
ReadX 13789 758 4 4
ReadX 13789 762 4557 4557
ReadX 13789 1052 4 4
ReadX 13789 1056 314 314
ReadX 13789 1056 11056 11056
Close 13789
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13790
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13790 0 511 511
ReadX 13790 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13791
ReadX 13791 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13792
ReadX 13792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13793
ReadX 13793 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13794
ReadX 13794 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13795
ReadX 13795 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13796
ReadX 13796 0 53 53
ReadX 13796 53 2 2
ReadX 13796 55 2 2
ReadX 13796 57 184 184
ReadX 13796 241 298 298
Close 13796
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13797
ReadX 13797 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13798
ReadX 13798 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13799
ReadX 13799 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13800
ReadX 13800 0 511 511
ReadX 13799 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13801
ReadX 13801 0 53 53
ReadX 13801 53 2 2
ReadX 13801 55 480 480
ReadX 13801 535 2 2
Close 13801
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13802
ReadX 13802 0 41 41
ReadX 13790 2048 2048 2048
ReadX 13790 1152 2048 2048
ReadX 13790 4096 16384 16384
Close 13797
Close 13798
Close 13799
Close 13800
Close 13802
Close 13790
Close 13791
Close 13794
Close 13795
Close 13792
Close 13793
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13803
ReadX 13803 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13804
ReadX 13804 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13805
ReadX 13805 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13806
ReadX 13806 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13807
ReadX 13807 0 53 53
ReadX 13807 53 2 2
ReadX 13807 55 480 480
ReadX 13807 535 2 2
Close 13807
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13808
ReadX 13808 0 511 511
ReadX 13808 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13809
ReadX 13809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13810
ReadX 13810 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13811
ReadX 13811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13812
ReadX 13812 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13813
ReadX 13813 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13814
ReadX 13814 0 41 41
ReadX 13808 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13815
ReadX 13815 0 53 53
ReadX 13815 53 2 2
ReadX 13815 55 2 2
ReadX 13815 57 184 184
ReadX 13815 241 298 298
Close 13815
ReadX 13803 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13819
FIND_FIRST \clients\client1\~dmtmp\*
Close 13819
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13820
QUERY_FILE_INFORMATION 13820
WriteX 13820 2047 1 1
QUERY_FILE_INFORMATION 13820
WriteX 13820 0 2048 2048
Close 13820
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13821
ReadX 13821 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13821 4095 1 1
QUERY_FILE_INFORMATION 13821
WriteX 13821 2048 2048 2048
WriteX 13821 0 88 88
Close 13821
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13822
ReadX 13822 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13822 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13826
Close 13826
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13827
QUERY_FILE_INFORMATION 13827
WriteX 13827 2047 1 1
QUERY_FILE_INFORMATION 13827
WriteX 13827 0 2048 2048
Close 13827
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13828
ReadX 13828 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13828 4095 1 1
QUERY_FILE_INFORMATION 13828
WriteX 13828 2048 2048 2048
WriteX 13828 0 88 88
Close 13828
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13829
ReadX 13829 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13829 2048 2048 2048
Close 13814
Close 13808
Close 13809
Close 13812
Close 13813
Close 13810
Close 13811
Close 13803
Close 13804
Close 13805
Close 13806
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13830
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13830 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13831
ReadX 13831 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13832
ReadX 13832 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13833
ReadX 13833 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13834
ReadX 13834 0 53 53
ReadX 13834 53 2 2
ReadX 13834 55 480 480
ReadX 13834 535 2 2
Close 13834
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13835
ReadX 13835 0 511 511
ReadX 13835 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13836
ReadX 13836 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13837
ReadX 13837 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13838
ReadX 13838 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13839
ReadX 13839 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13840
ReadX 13840 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13841
ReadX 13841 0 41 41
ReadX 13835 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13842
ReadX 13842 0 53 53
ReadX 13842 53 2 2
ReadX 13842 55 2 2
ReadX 13842 57 184 184
ReadX 13842 241 298 298
Close 13842
ReadX 13830 2048 2048 2048
ReadX 13830 384 16384 16384
ReadX 13830 1408 16384 16384
ReadX 13830 2560 16384 16384
ReadX 13830 3584 16384 16384
ReadX 13830 288 16384 16384
ReadX 13830 352 16384 16384
ReadX 13830 416 16384 16384
ReadX 13830 480 16384 16384
ReadX 13830 552 16384 16384
ReadX 13830 616 16384 16384
ReadX 13830 680 16384 16384
ReadX 13830 744 16384 16384
ReadX 13830 808 16384 16384
ReadX 13830 872 16384 16384
ReadX 13830 936 10240 10240
Close 13841
Close 13835
Close 13836
Close 13839
Close 13840
Close 13837
Close 13838
Close 13830
Close 13831
Close 13832
Close 13833
Close 13822
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13843
QUERY_FILE_INFORMATION 13843
Close 13843
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13829
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13844
QUERY_FILE_INFORMATION 13844
Close 13844
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13845
ReadX 13845 0 65471 65471
ReadX 13845 65471 63 63
ReadX 13845 65534 65471 65471
ReadX 13845 131005 63 63
ReadX 13845 131068 65471 65471
ReadX 13845 196539 63 63
ReadX 13845 196602 65471 65471
ReadX 13845 262073 63 63
ReadX 13845 262136 65471 65471
ReadX 13845 327607 63 63
ReadX 13845 327670 10 10
Close 13845
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13846
ReadX 13846 0 65471 65471
ReadX 13846 65471 63 63
ReadX 13846 65534 65471 65471
ReadX 13846 131005 63 63
ReadX 13846 131068 65471 65471
ReadX 13846 196539 63 63
ReadX 13846 196602 65471 65471
ReadX 13846 262073 63 63
ReadX 13846 262136 65471 65471
ReadX 13846 327607 63 63
ReadX 13846 327670 65471 65471
ReadX 13846 393141 63 63
ReadX 13846 393204 65471 65471
ReadX 13846 458675 63 63
ReadX 13846 458738 65471 65471
ReadX 13846 524209 63 63
ReadX 13846 524272 65471 65471
ReadX 13846 589743 63 63
ReadX 13846 589806 65471 65471
ReadX 13846 655277 63 63
ReadX 13846 655340 32 32
Close 13846
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13847
ReadX 13847 0 65471 65471
ReadX 13847 65471 63 63
ReadX 13847 65534 65471 65471
ReadX 13847 131005 63 63
ReadX 13847 131068 65471 65471
ReadX 13847 196539 63 63
ReadX 13847 196602 65471 65471
ReadX 13847 262073 63 63
ReadX 13847 262136 65471 65471
ReadX 13847 327607 63 63
ReadX 13847 327670 65471 65471
ReadX 13847 393141 63 63
ReadX 13847 393204 65471 65471
ReadX 13847 458675 63 63
ReadX 13847 458738 65471 65471
ReadX 13847 524209 63 63
ReadX 13847 524272 65471 65471
ReadX 13847 589743 63 63
ReadX 13847 589806 65471 65471
ReadX 13847 655277 63 63
ReadX 13847 655340 65471 65471
ReadX 13847 720811 63 63
ReadX 13847 720874 65471 65471
ReadX 13847 786345 63 63
ReadX 13847 786408 65471 65471
ReadX 13847 851879 63 63
ReadX 13847 851942 65471 65471
ReadX 13847 917413 63 63
ReadX 13847 917476 65471 65471
ReadX 13847 982947 63 63
ReadX 13847 983010 65471 65471
ReadX 13847 1048481 63 63
ReadX 13847 1048544 65471 65471
ReadX 13847 1114015 63 63
ReadX 13847 1114078 65471 65471
ReadX 13847 1179549 63 63
ReadX 13847 1179612 65471 65471
ReadX 13847 1245083 63 63
ReadX 13847 1245146 65471 65471
ReadX 13847 1310617 63 63
ReadX 13847 1310680 65471 65471
ReadX 13847 1376151 63 63
ReadX 13847 1376214 65471 65471
ReadX 13847 1441685 63 63
ReadX 13847 1441748 65471 65471
ReadX 13847 1507219 63 63
ReadX 13847 1507282 65471 65471
ReadX 13847 1572753 63 63
ReadX 13847 1572816 65471 65471
ReadX 13847 1638287 63 63
ReadX 13847 1638350 65471 65471
ReadX 13847 1703821 63 63
ReadX 13847 1703884 65471 65471
ReadX 13847 1769355 63 63
ReadX 13847 1769418 65471 65471
ReadX 13847 1834889 63 63
ReadX 13847 1834952 32824 32824
Close 13847
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13848
QUERY_FILE_INFORMATION 13848
ReadX 13848 0 512 512
ReadX 13848 512 512 512
ReadX 13848 1024 512 512
QUERY_FILE_INFORMATION 13848
QUERY_FILE_INFORMATION 13848
ReadX 13848 2560 2048 2048
ReadX 13848 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13849
WriteX 13849 52 1 1
QUERY_FILE_INFORMATION 13849
WriteX 13849 0 53 53
Close 13849
ReadX 13848 2208 650 650
ReadX 13848 1920 2048 2048
ReadX 13848 2112 2048 2048
ReadX 13848 1856 2048 2048
ReadX 13848 1824 2048 2048
ReadX 13848 1536 512 512
ReadX 13848 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13850
Close 13850
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13848 1568 512 512
ReadX 13848 1536 512 512
ReadX 13848 2176 384 384
ReadX 13848 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13851
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13848 288 2048 2048
ReadX 13848 2336 2048 2048
ReadX 13848 4384 2048 2048
ReadX 13848 6432 2048 2048
ReadX 13848 8480 2048 2048
ReadX 13848 10528 2048 2048
ReadX 13848 12576 2048 2048
WriteX 13851 15359 1 1
QUERY_FILE_INFORMATION 13851
ReadX 13848 14624 2048 2048
ReadX 13848 16672 2048 2048
ReadX 13848 18720 2048 2048
ReadX 13848 1728 2048 2048
WriteX 13851 0 15360 15360
Close 13851
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13852
QUERY_FILE_INFORMATION 13852
ReadX 13852 0 512 512
ReadX 13852 2048 512 512
ReadX 13852 2560 512 512
QUERY_FILE_INFORMATION 13852
QUERY_FILE_INFORMATION 13852
QUERY_FILE_INFORMATION 13852
QUERY_FILE_INFORMATION 13852
QUERY_FILE_INFORMATION 13852
WriteX 13852 2152 384 384
QUERY_FILE_INFORMATION 13852
WriteX 13852 2150 22 22
WriteX 13852 2144 106 106
QUERY_FILE_INFORMATION 13852
WriteX 13852 2176 496 496
ReadX 13852 2176 496 496
QUERY_FILE_INFORMATION 13852
WriteX 13852 2440 384 384
QUERY_FILE_INFORMATION 13852
WriteX 13852 2152 384 384
WriteX 13852 2432 112 112
QUERY_FILE_INFORMATION 13852
WriteX 13852 2439 16 16
QUERY_FILE_INFORMATION 13852
WriteX 13852 2208 220 220
ReadX 13852 2208 220 220
QUERY_FILE_INFORMATION 13852
QUERY_FILE_INFORMATION 13852
WriteX 13852 2440 220 220
QUERY_FILE_INFORMATION 13852
WriteX 13852 2453 36 36
WriteX 13852 2080 512 512
WriteX 13852 2176 512 512
WriteX 13852 2112 512 512
WriteX 13852 2048 512 512
WriteX 13852 0 512 512
QUERY_FILE_INFORMATION 13848
QUERY_FILE_INFORMATION 13848
WriteX 13852 2080 512 512
Close 13852
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13853
Close 13853
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13854
QUERY_FILE_INFORMATION 13854
ReadX 13854 0 512 512
ReadX 13854 2048 512 512
ReadX 13854 2560 512 512
QUERY_FILE_INFORMATION 13854
QUERY_FILE_INFORMATION 13854
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13855
Close 13855
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13848
ReadX 13854 1408 512 512
ReadX 13854 2048 512 512
ReadX 13854 1536 512 512
ReadX 13854 2560 512 512
ReadX 13854 3072 512 512
ReadX 13854 3584 512 512
ReadX 13854 4096 512 512
ReadX 13854 4608 512 512
ReadX 13854 5120 512 512
ReadX 13854 5632 512 512
ReadX 13854 6144 512 512
ReadX 13854 6656 512 512
ReadX 13854 7168 512 512
ReadX 13854 7680 512 512
ReadX 13854 8192 512 512
ReadX 13854 8704 512 512
ReadX 13854 9216 512 512
ReadX 13854 9728 512 512
ReadX 13854 10240 512 512
ReadX 13854 10752 512 512
ReadX 13854 11264 512 512
ReadX 13854 11776 512 512
ReadX 13854 12288 512 512
ReadX 13854 12800 512 512
ReadX 13854 13312 512 512
ReadX 13854 13824 512 512
ReadX 13854 14336 512 512
ReadX 13854 14848 512 512
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 15360 512 0
ReadX 13854 2560 2048 2048
ReadX 13854 4608 2048 2048
ReadX 13854 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13856
QUERY_FILE_INFORMATION 13856
ReadX 13856 0 512 512
ReadX 13856 512 512 512
ReadX 13856 1024 512 512
QUERY_FILE_INFORMATION 13856
QUERY_FILE_INFORMATION 13856
ReadX 13856 352 2048 2048
ReadX 13856 608 1097 1097
ReadX 13856 576 1609 1609
ReadX 13856 4096 512 512
ReadX 13856 1536 512 512
ReadX 13856 3840 256 256
ReadX 13856 288 576 576
ReadX 13856 512 512 512
ReadX 13856 480 512 512
ReadX 13856 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13857
ReadX 13857 0 4096 4096
ReadX 13857 4096 4096 4096
ReadX 13857 8192 4096 4096
Close 13856
Close 13857
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13858
WriteX 13858 15359 1 1
QUERY_FILE_INFORMATION 13858
WriteX 13858 0 15360 15360
Close 13858
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13859
QUERY_FILE_INFORMATION 13859
ReadX 13859 0 512 512
ReadX 13859 2048 512 512
ReadX 13859 2560 512 512
QUERY_FILE_INFORMATION 13859
QUERY_FILE_INFORMATION 13859
QUERY_FILE_INFORMATION 13859
QUERY_FILE_INFORMATION 13859
QUERY_FILE_INFORMATION 13859
WriteX 13859 2152 384 384
QUERY_FILE_INFORMATION 13859
WriteX 13859 2150 22 22
WriteX 13859 2144 106 106
QUERY_FILE_INFORMATION 13859
WriteX 13859 2176 476 476
ReadX 13859 2176 476 476
QUERY_FILE_INFORMATION 13859
WriteX 13859 2440 384 384
QUERY_FILE_INFORMATION 13859
WriteX 13859 2152 384 384
WriteX 13859 2432 92 92
QUERY_FILE_INFORMATION 13859
WriteX 13859 2437 36 36
QUERY_FILE_INFORMATION 13859
WriteX 13859 2208 220 220
ReadX 13859 2208 220 220
QUERY_FILE_INFORMATION 13859
QUERY_FILE_INFORMATION 13859
WriteX 13859 2440 220 220
QUERY_FILE_INFORMATION 13859
WriteX 13859 2453 36 36
WriteX 13859 2080 512 512
WriteX 13859 2176 512 512
WriteX 13859 2112 512 512
WriteX 13859 2048 512 512
WriteX 13859 0 512 512
QUERY_FILE_INFORMATION 13854
QUERY_FILE_INFORMATION 13854
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13854
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13860
Close 13860
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13861
QUERY_FILE_INFORMATION 13861
ReadX 13861 0 512 512
ReadX 13861 2048 512 512
ReadX 13861 2560 512 512
QUERY_FILE_INFORMATION 13861
QUERY_FILE_INFORMATION 13861
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13862
Close 13862
WriteX 13859 2080 512 512
Close 13859
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13863
Close 13863
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13864
QUERY_FILE_INFORMATION 13864
ReadX 13864 0 512 512
ReadX 13864 2048 512 512
ReadX 13864 2560 512 512
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
ReadX 13864 1312 512 512
ReadX 13864 1536 512 512
ReadX 13864 2048 512 512
ReadX 13864 576 512 512
ReadX 13864 1088 512 512
ReadX 13864 1056 512 512
ReadX 13864 1120 512 512
ReadX 13864 1184 512 512
ReadX 13864 2560 2048 2048
ReadX 13864 4608 2048 2048
ReadX 13864 6656 2048 2048
ReadX 13864 8704 2048 2048
ReadX 13864 10752 2048 2048
ReadX 13864 12800 2048 2048
ReadX 13864 14848 2048 512
ReadX 13864 15360 1536 0
ReadX 13864 1088 2048 2048
ReadX 13864 3136 2048 2048
ReadX 13864 1665 5835 5835
ReadX 13864 1856 2048 2048
ReadX 13864 2112 512 512
ReadX 13864 2152 384 384
ReadX 13864 2432 92 92
ReadX 13864 2176 512 512
ReadX 13864 2440 220 220
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
ReadX 13864 2432 512 512
WriteX 13864 2272 512 512
ReadX 13864 2144 512 512
WriteX 13864 2304 512 512
WriteX 13864 2272 92 92
WriteX 13864 2208 512 512
WriteX 13864 2720 512 512
WriteX 13864 0 512 512
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
ReadX 13864 1312 4096 4096
ReadX 13864 5408 4096 4096
ReadX 13864 9504 3305 3305
ReadX 13864 512 4096 4096
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
WriteX 13864 3132 50 50
WriteX 13864 3182 4096 4096
WriteX 13864 7278 4096 4096
WriteX 13864 15469 1 1
QUERY_FILE_INFORMATION 13864
WriteX 13864 11374 4096 4096
WriteX 13864 15470 3584 3584
WriteX 13864 2144 512 512
WriteX 13864 2336 4096 4096
WriteX 13864 6432 4096 4096
WriteX 13864 10528 4096 4096
WriteX 13864 14624 462 462
WriteX 13864 2048 512 512
WriteX 13864 2560 512 512
WriteX 13864 0 512 512
QUERY_FILE_INFORMATION 13864
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13865
QUERY_FILE_INFORMATION 13865
ReadX 13865 0 512 512
ReadX 13865 1152 512 512
ReadX 13865 1664 512 512
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
ReadX 13865 512 2048 2048
ReadX 13865 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13866
WriteX 13866 52 1 1
QUERY_FILE_INFORMATION 13866
WriteX 13866 0 53 53
Close 13866
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
ReadX 13865 1120 504 504
ReadX 13865 896 2048 2048
ReadX 13865 1056 1528 1528
ReadX 13865 864 2048 2048
ReadX 13865 832 2048 2048
ReadX 13865 736 2048 2048
ReadX 13865 1216 512 512
ReadX 13865 1256 384 384
ReadX 13865 1536 140 140
ReadX 13865 1280 512 512
ReadX 13865 1548 252 252
ReadX 13864 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13867
Close 13867
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13865 2560 2048 2048
ReadX 13865 4608 2048 2048
ReadX 13865 6656 2048 2048
ReadX 13865 8704 2048 2048
ReadX 13865 10752 2048 2048
WriteX 13868 12005 1 1
QUERY_FILE_INFORMATION 13868
WriteX 13868 0 12006 12006
Close 13868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13869
QUERY_FILE_INFORMATION 13869
ReadX 13869 0 512 512
ReadX 13869 1152 512 512
ReadX 13869 1664 512 512
QUERY_FILE_INFORMATION 13869
QUERY_FILE_INFORMATION 13869
QUERY_FILE_INFORMATION 13869
QUERY_FILE_INFORMATION 13869
QUERY_FILE_INFORMATION 13869
QUERY_FILE_INFORMATION 13869
QUERY_FILE_INFORMATION 13869
WriteX 13869 1256 384 384
QUERY_FILE_INFORMATION 13869
WriteX 13869 1254 22 22
WriteX 13869 1248 106 106
QUERY_FILE_INFORMATION 13869
WriteX 13869 1280 508 508
ReadX 13869 1280 508 508
QUERY_FILE_INFORMATION 13869
WriteX 13869 1544 384 384
QUERY_FILE_INFORMATION 13869
WriteX 13869 1256 384 384
WriteX 13869 1536 124 124
QUERY_FILE_INFORMATION 13869
WriteX 13869 1543 4 4
QUERY_FILE_INFORMATION 13869
WriteX 13869 1312 252 252
ReadX 13869 1312 252 252
QUERY_FILE_INFORMATION 13869
QUERY_FILE_INFORMATION 13869
WriteX 13869 1544 252 252
QUERY_FILE_INFORMATION 13869
WriteX 13869 1559 4 4
WriteX 13869 1184 512 512
WriteX 13869 1280 512 512
WriteX 13869 1216 512 512
WriteX 13869 1152 512 512
WriteX 13869 0 512 512
QUERY_FILE_INFORMATION 13865
QUERY_FILE_INFORMATION 13865
WriteX 13869 1184 512 512
Close 13869
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13870
Close 13870
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13871
QUERY_FILE_INFORMATION 13871
ReadX 13871 0 512 512
ReadX 13871 1152 512 512
ReadX 13871 1664 512 512
QUERY_FILE_INFORMATION 13871
QUERY_FILE_INFORMATION 13871
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13872
Close 13872
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13865
ReadX 13871 736 512 512
ReadX 13871 1536 2048 2048
ReadX 13871 3584 2048 2048
ReadX 13871 5632 2048 2048
ReadX 13871 7680 2048 2048
ReadX 13871 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13873
WriteX 13873 11990 1 1
QUERY_FILE_INFORMATION 13873
WriteX 13873 0 11991 11991
Close 13873
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13874
QUERY_FILE_INFORMATION 13874
ReadX 13874 0 512 512
ReadX 13874 1184 512 512
ReadX 13874 1696 512 512
QUERY_FILE_INFORMATION 13874
QUERY_FILE_INFORMATION 13874
QUERY_FILE_INFORMATION 13874
QUERY_FILE_INFORMATION 13874
QUERY_FILE_INFORMATION 13874
QUERY_FILE_INFORMATION 13874
QUERY_FILE_INFORMATION 13874
WriteX 13874 1288 384 384
QUERY_FILE_INFORMATION 13874
WriteX 13874 1286 22 22
WriteX 13874 1280 106 106
QUERY_FILE_INFORMATION 13874
WriteX 13874 1312 508 508
ReadX 13874 1312 508 508
QUERY_FILE_INFORMATION 13874
WriteX 13874 1576 384 384
QUERY_FILE_INFORMATION 13874
WriteX 13874 1288 384 384
WriteX 13874 1568 124 124
QUERY_FILE_INFORMATION 13874
WriteX 13874 1575 4 4
QUERY_FILE_INFORMATION 13874
WriteX 13874 1344 252 252
ReadX 13874 1344 252 252
QUERY_FILE_INFORMATION 13874
QUERY_FILE_INFORMATION 13874
WriteX 13874 1576 252 252
QUERY_FILE_INFORMATION 13874
WriteX 13874 1591 4 4
WriteX 13874 1216 512 512
WriteX 13874 1312 512 512
WriteX 13874 1248 512 512
WriteX 13874 1184 512 512
WriteX 13874 0 512 512
QUERY_FILE_INFORMATION 13871
QUERY_FILE_INFORMATION 13871
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13871
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13875
Close 13875
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13876
QUERY_FILE_INFORMATION 13876
ReadX 13876 0 512 512
ReadX 13876 1152 512 512
ReadX 13876 1664 512 512
QUERY_FILE_INFORMATION 13876
QUERY_FILE_INFORMATION 13876
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13877
Close 13877
WriteX 13874 1216 512 512
Close 13874
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13878
Close 13878
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13879
QUERY_FILE_INFORMATION 13879
ReadX 13879 0 512 512
ReadX 13879 1184 512 512
ReadX 13879 1696 512 512
QUERY_FILE_INFORMATION 13879
QUERY_FILE_INFORMATION 13879
ReadX 13879 1536 512 512
ReadX 13879 736 512 512
ReadX 13879 2048 512 512
ReadX 13879 2560 512 512
ReadX 13879 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13880
Close 13880
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13879 914 3899 3899
ReadX 13879 1248 512 512
ReadX 13879 1288 384 384
ReadX 13879 1568 124 124
ReadX 13879 1312 512 512
ReadX 13879 1576 252 252
QUERY_FILE_INFORMATION 13879
QUERY_FILE_INFORMATION 13879
ReadX 13879 1568 512 512
WriteX 13879 1408 512 512
ReadX 13879 1280 512 512
WriteX 13879 1440 512 512
WriteX 13879 1408 124 124
WriteX 13879 1344 512 512
WriteX 13879 1856 512 512
WriteX 13879 0 512 512
QUERY_FILE_INFORMATION 13879
QUERY_FILE_INFORMATION 13879
ReadX 13879 544 4096 4096
ReadX 13879 4640 4096 4096
ReadX 13879 8736 1637 1637
ReadX 13879 512 4096 4096
QUERY_FILE_INFORMATION 13879
QUERY_FILE_INFORMATION 13879
WriteX 13879 1280 512 512
WriteX 13879 1472 3584 3584
WriteX 13879 5056 4096 4096
WriteX 13879 13247 1 1
QUERY_FILE_INFORMATION 13879
WriteX 13879 9152 4096 4096
WriteX 13879 13248 1736 1736
WriteX 13879 1184 512 512
WriteX 13879 1696 512 512
WriteX 13879 0 512 512
QUERY_FILE_INFORMATION 13879
ReadX 13879 1632 1024 1024
ReadX 13879 288 1024 1024
ReadX 13879 1312 2048 2048
ReadX 13879 3360 1024 1024
ReadX 13879 1696 1024 1024
ReadX 13879 2720 512 512
ReadX 13879 3232 512 512
ReadX 13879 3744 512 512
ReadX 13879 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13879 2066 3998 3998
ReadX 13879 1448 384 384
ReadX 13879 1408 124 124
ReadX 13879 1416 252 252
QUERY_FILE_INFORMATION 13879
QUERY_FILE_INFORMATION 13879
ReadX 13879 1408 512 512
WriteX 13879 1536 512 512
ReadX 13879 1440 512 512
WriteX 13879 2048 512 512
WriteX 13879 1536 124 124
WriteX 13879 512 512 512
WriteX 13879 1024 512 512
WriteX 13879 0 512 512
QUERY_FILE_INFORMATION 13879
ReadX 13879 1696 4096 4096
ReadX 13879 5792 4096 4096
ReadX 13879 9888 1736 1736
ReadX 13879 1280 512 512
ReadX 13879 1472 3584 3584
QUERY_FILE_INFORMATION 13879
QUERY_FILE_INFORMATION 13879
WriteX 13879 3940 156 156
WriteX 13879 4096 512 512
WriteX 13879 544 3584 3584
WriteX 13879 4128 4096 4096
WriteX 13879 8224 3584 3584
WriteX 13879 1344 512 512
WriteX 13879 1856 1536 1536
WriteX 13879 2336 512 512
WriteX 13879 3584 356 356
WriteX 13879 2560 512 512
WriteX 13879 3072 512 512
WriteX 13879 0 512 512
QUERY_FILE_INFORMATION 13879
Close 13861
Close 13864
Close 13879
Close 13876
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13881
Close 13881
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13882
Close 13882
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13883
WriteX 13883 0 65471 65471
WriteX 13883 65471 63 63
WriteX 13883 65534 65471 65471
WriteX 13883 131005 63 63
Close 13883
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13884
WriteX 13884 0 65471 65471
WriteX 13884 65471 63 63
WriteX 13884 65534 65471 65471
WriteX 13884 131005 63 63
WriteX 13884 131068 65471 65471
WriteX 13884 196539 63 63
WriteX 13884 196602 65471 65471
WriteX 13884 262073 63 63
Close 13884
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13885
WriteX 13885 0 65471 65471
WriteX 13885 65471 63 63
WriteX 13885 65534 65471 65471
WriteX 13885 131005 63 63
WriteX 13885 131068 65471 65471
WriteX 13885 196539 63 63
WriteX 13885 196602 65471 65471
WriteX 13885 262073 63 63
WriteX 13885 262136 65471 65471
WriteX 13885 327607 63 63
WriteX 13885 327670 65471 65471
WriteX 13885 393141 63 63
WriteX 13885 393204 65471 65471
WriteX 13885 458675 63 63
WriteX 13885 458738 65471 65471
WriteX 13885 524209 63 63
Close 13885
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13886
QUERY_FILE_INFORMATION 13886
QUERY_FILE_INFORMATION 13886
ReadX 13886 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13887
Close 13887
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13888
WriteX 13888 63 1 1
QUERY_FILE_INFORMATION 13888
WriteX 13888 0 64 64
ReadX 13886 992 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 344 2048 2048
ReadX 13886 1344 2048 2048
ReadX 13886 1352 2048 2048
ReadX 13886 1320 2048 2048
ReadX 13886 1360 2048 2048
ReadX 13886 1344 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2304 2048 2048
ReadX 13886 1472 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 1480 2048 2048
ReadX 13886 1488 2048 2048
ReadX 13886 1496 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 1504 2048 2048
ReadX 13886 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 1000 2048 2048
ReadX 13886 1416 2048 2048
ReadX 13886 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13886 360 2048 2048
ReadX 13886 368 2048 2048
ReadX 13886 360 2048 2048
ReadX 13886 376 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 1232 2048 2048
ReadX 13886 2432 6144 6144
ReadX 13886 2376 2048 2048
ReadX 13886 2360 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 2376 2048 2048
ReadX 13886 2384 2048 2048
ReadX 13886 2368 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 1296 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 13886 0 2048 2048
ReadX 13886 2688 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 2688 2048 2048
WriteX 13886 2688 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 2688 2048 2048
ReadX 13886 2688 2048 2048
ReadX 13886 2688 2048 2048
WriteX 13886 2688 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13886 2688 2048 2048
ReadX 13886 2688 2048 2048
WriteX 13886 2688 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 320 4096 4096
ReadX 13886 0 2048 2048
ReadX 13886 3584 2048 2048
ReadX 13886 3584 2048 2048
ReadX 13886 3584 2048 2048
ReadX 13886 0 2048 2048
WriteX 13886 3584 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2688 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 2688 2048 2048
ReadX 13886 2688 2048 2048
WriteX 13886 2688 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 3200 2048 2048
ReadX 13886 3200 2048 2048
ReadX 13886 3200 2048 2048
WriteX 13886 3200 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 3456 2048 2048
ReadX 13886 3456 2048 2048
ReadX 13886 3456 2048 2048
WriteX 13886 3456 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2496 2048 2048
ReadX 13886 2472 2048 2048
ReadX 13886 2456 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 2472 2048 2048
ReadX 13886 2480 2048 2048
ReadX 13886 2464 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 2488 2048 2048
ReadX 13886 2568 8192 8192
ReadX 13886 1000 2048 2048
ReadX 13886 328 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 2048 2048 2048
ReadX 13886 2560 2048 2048
ReadX 13886 920 2048 2048
WriteX 13886 2048 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 312 2048 2048
WriteX 13886 336 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 328 2048 2048
WriteX 13886 2560 2048 2048
WriteX 13886 3840 2048 2048
WriteX 13886 920 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2432 2048 2048
WriteX 13886 2432 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2456 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 328 2048 2048
ReadX 13886 2560 2048 2048
ReadX 13886 2048 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 336 2048 2048
ReadX 13886 920 2048 2048
WriteX 13886 1536 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 2048 2048 2048
WriteX 13886 2560 2048 2048
WriteX 13886 336 2048 2048
WriteX 13886 920 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2048 2048 2048
ReadX 13886 2432 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 2048 2048 2048
WriteX 13886 2432 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2456 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1536 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 336 2048 2048
ReadX 13886 920 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 1536 2048 2048
WriteX 13886 336 2048 2048
WriteX 13886 920 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2432 2048 2048
WriteX 13886 2432 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2456 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1536 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 336 2048 2048
ReadX 13886 920 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 1536 2048 2048
WriteX 13886 336 2048 2048
WriteX 13886 920 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2432 2048 2048
WriteX 13886 2432 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2456 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1536 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 336 2048 2048
ReadX 13886 920 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 1536 2048 2048
WriteX 13886 336 2048 2048
WriteX 13886 920 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2432 2048 2048
WriteX 13886 2432 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2456 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1536 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 336 2048 2048
ReadX 13886 920 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 1536 2048 2048
WriteX 13886 336 2048 2048
WriteX 13886 920 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2432 2048 2048
WriteX 13886 2432 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
Flush 13886
ReadX 13886 2456 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1536 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 336 2048 2048
ReadX 13886 920 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 1536 2048 2048
WriteX 13886 336 2048 2048
WriteX 13886 920 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2432 2048 2048
WriteX 13886 2432 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2624 6144 6144
ReadX 13886 2616 2048 2048
ReadX 13886 2688 2048 2048
ReadX 13886 2600 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 2616 2048 2048
ReadX 13886 2608 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 344 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 520 2048 2048
ReadX 13886 1392 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 400 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 536 2048 2048
ReadX 13886 824 2048 2048
ReadX 13886 832 2048 2048
ReadX 13886 384 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 408 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 552 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 824 2048 2048
ReadX 13886 840 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 768 2048 2048
ReadX 13886 2048 2048 2048
WriteX 13886 1415 1 1
WriteX 13886 352 2048 2048
WriteX 13886 1112 2048 2048
WriteX 13886 1400 2048 2048
WriteX 13886 1408 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 2048 2048 2048
WriteX 13886 768 2048 2048
WriteX 13886 344 2048 2048
WriteX 13886 1000 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 416 2048 2048
ReadX 13886 424 2048 2048
ReadX 13886 432 2048 2048
ReadX 13886 440 2048 2048
ReadX 13886 576 16384 16384
ReadX 13886 448 2048 2048
ReadX 13886 456 2048 2048
ReadX 13886 464 2048 2048
ReadX 13886 640 16384 16384
ReadX 13886 704 16384 16384
ReadX 13886 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 13886 848 2048 2048
ReadX 13886 560 2048 2048
ReadX 13886 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 2600 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 352 2048 2048
ReadX 13886 1928 8192 8192
ReadX 13886 528 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 824 2048 2048
ReadX 13886 0 2048 2048
Flush 13886
ReadX 13886 2600 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 352 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 824 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 856 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 392 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 472 2048 2048
ReadX 13886 480 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 488 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 928 2048 2048
ReadX 13886 936 2048 2048
ReadX 13886 976 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 392 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 952 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 528 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 528 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 816 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13886 1336 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 528 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 528 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1240 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2200 4096 4096
ReadX 13886 2152 2048 2048
ReadX 13886 2160 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1312 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 1928 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 824 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1416 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 352 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 824 2048 2048
ReadX 13886 384 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13886 352 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 768 2048 2048
ReadX 13886 2048 2048 2048
ReadX 13886 352 2048 2048
WriteX 13886 1551 1 1
WriteX 13886 1512 2048 2048
WriteX 13886 1520 2048 2048
WriteX 13886 1528 2048 2048
WriteX 13886 1544 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 2048 2048 2048
WriteX 13886 768 2048 2048
WriteX 13886 344 2048 2048
WriteX 13886 1000 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2048 2048 2048
WriteX 13886 2048 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 1000 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1240 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 344 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 384 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 768 2048 2048
WriteX 13886 1567 1 1
WriteX 13886 1552 2048 2048
WriteX 13886 1560 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 768 2048 2048
WriteX 13886 344 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 1328 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1240 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2200 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1240 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 344 2048 2048
ReadX 13886 384 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 2048 2048 2048
ReadX 13886 768 2048 2048
WriteX 13886 1583 1 1
WriteX 13886 1568 2048 2048
WriteX 13886 1576 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 2048 2048 2048
WriteX 13886 768 2048 2048
WriteX 13886 344 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 864 2048 2048
ReadX 13886 872 2048 2048
ReadX 13886 912 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 2688 2048 2048
ReadX 13886 1000 2048 2048
WriteX 13886 2688 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 2944 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 0 2048 2048
Flush 13886
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 2688 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 2688 2048 2048
WriteX 13886 2688 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 392 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 416 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 416 2048 2048
ReadX 13886 864 2048 2048
ReadX 13886 872 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 312 2048 2048
ReadX 13886 888 2048 2048
ReadX 13886 400 2048 2048
ReadX 13886 896 2048 2048
WriteX 13886 1584 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 400 2048 2048
WriteX 13886 416 2048 2048
WriteX 13886 864 2048 2048
WriteX 13886 872 2048 2048
WriteX 13886 888 2048 2048
WriteX 13886 896 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 584 2048 2048
ReadX 13886 392 2048 2048
WriteX 13886 392 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 1328 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 0 2048 2048
ReadX 13886 408 2048 2048
ReadX 13886 1328 2048 2048
ReadX 13886 864 2048 2048
ReadX 13886 912 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 3840 2048 2048
ReadX 13886 312 2048 2048
ReadX 13886 1584 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 408 2048 2048
WriteX 13886 912 2048 2048
WriteX 13886 1584 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 408 2048 2048
ReadX 13886 392 2048 2048
WriteX 13886 392 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 528 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 528 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 552 2048 2048
ReadX 13886 1336 2048 2048
WriteX 13886 552 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 0 2048 2048
ReadX 13886 552 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 2664 2048 2048
ReadX 13886 2648 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 2672 2048 2048
ReadX 13886 2656 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13886 528 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 1336 2048 2048
ReadX 13886 2680 2048 2048
ReadX 13886 2760 8192 8192
ReadX 13886 544 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 568 2048 2048
ReadX 13886 544 2048 2048
ReadX 13886 0 2048 2048
Flush 13886
ReadX 13886 2816 6144 6144
ReadX 13886 2760 2048 2048
ReadX 13886 2744 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 2752 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 528 2048 2048
ReadX 13886 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13890
Close 13890
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13892
WriteX 13892 4065 1 1
QUERY_FILE_INFORMATION 13892
WriteX 13892 0 62591 62591
Close 13892
ReadX 13886 0 2048 2048
ReadX 13886 2808 2048 2048
ReadX 13886 2792 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 2800 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 384 2048 2048
ReadX 13886 392 2048 2048
ReadX 13886 1384 2048 2048
ReadX 13886 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13894
Close 13894
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13896
WriteX 13896 4094 1 1
QUERY_FILE_INFORMATION 13896
WriteX 13896 0 10845 10845
Close 13896
ReadX 13886 1432 2048 2048
ReadX 13886 1304 2048 2048
ReadX 13886 1368 2048 2048
ReadX 13886 2304 2048 2048
ReadX 13886 1440 2048 2048
ReadX 13886 1424 2048 2048
ReadX 13886 1448 2048 2048
ReadX 13886 1456 2048 2048
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13898
Close 13898
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13900
ReadX 13886 0 2048 2048
WriteX 13900 4081 1 1
QUERY_FILE_INFORMATION 13900
WriteX 13900 0 30118 30118
Close 13900
ReadX 13886 1344 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1152 2048 2048
ReadX 13886 1152 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 1000 2048 2048
ReadX 13886 768 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 344 2048 2048
WriteX 13886 1000 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 1416 2048 2048
ReadX 13886 1416 2048 2048
ReadX 13886 344 2048 2048
ReadX 13886 896 2048 2048
WriteX 13886 1538 2 2
WriteX 13886 344 2048 2048
WriteX 13886 1416 2048 2048
WriteX 13886 1538 2 2
ReadX 13886 2048 2048 2048
WriteX 13886 2048 2048 2048
WriteX 13886 1538 2 2
Close 13886
Close 13888
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13901
ReadX 13901 0 65471 65471
ReadX 13901 65471 63 63
ReadX 13901 65534 65471 65471
ReadX 13901 131005 63 63
ReadX 13901 131068 65471 65471
ReadX 13901 196539 63 63
ReadX 13901 196602 65471 65471
ReadX 13901 262073 63 63
ReadX 13901 262136 65471 65471
ReadX 13901 327607 63 63
ReadX 13901 327670 10 10
Close 13901
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13902
ReadX 13902 0 65471 65471
ReadX 13902 65471 63 63
ReadX 13902 65534 65471 65471
ReadX 13902 131005 63 63
ReadX 13902 131068 65471 65471
ReadX 13902 196539 63 63
ReadX 13902 196602 65471 65471
ReadX 13902 262073 63 63
ReadX 13902 262136 65471 65471
ReadX 13902 327607 63 63
ReadX 13902 327670 65471 65471
ReadX 13902 393141 63 63
ReadX 13902 393204 65471 65471
ReadX 13902 458675 63 63
ReadX 13902 458738 65471 65471
ReadX 13902 524209 63 63
ReadX 13902 524272 65471 65471
ReadX 13902 589743 63 63
ReadX 13902 589806 65471 65471
ReadX 13902 655277 63 63
ReadX 13902 655340 32 32
Close 13902
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13903
ReadX 13903 0 65471 65471
ReadX 13903 65471 63 63
ReadX 13903 65534 65471 65471
ReadX 13903 131005 63 63
ReadX 13903 131068 65471 65471
ReadX 13903 196539 63 63
ReadX 13903 196602 65471 65471
ReadX 13903 262073 63 63
ReadX 13903 262136 65471 65471
ReadX 13903 327607 63 63
ReadX 13903 327670 65471 65471
ReadX 13903 393141 63 63
ReadX 13903 393204 65471 65471
ReadX 13903 458675 63 63
ReadX 13903 458738 65471 65471
ReadX 13903 524209 63 63
ReadX 13903 524272 65471 65471
ReadX 13903 589743 63 63
ReadX 13903 589806 65471 65471
ReadX 13903 655277 63 63
ReadX 13903 655340 65471 65471
ReadX 13903 720811 63 63
ReadX 13903 720874 65471 65471
ReadX 13903 786345 63 63
ReadX 13903 786408 65471 65471
ReadX 13903 851879 63 63
ReadX 13903 851942 65471 65471
ReadX 13903 917413 63 63
ReadX 13903 917476 65471 65471
ReadX 13903 982947 63 63
ReadX 13903 983010 65471 65471
ReadX 13903 1048481 63 63
ReadX 13903 1048544 65471 65471
ReadX 13903 1114015 63 63
ReadX 13903 1114078 65471 65471
ReadX 13903 1179549 63 63
ReadX 13903 1179612 65471 65471
ReadX 13903 1245083 63 63
ReadX 13903 1245146 65471 65471
ReadX 13903 1310617 63 63
ReadX 13903 1310680 65471 65471
ReadX 13903 1376151 63 63
ReadX 13903 1376214 65471 65471
ReadX 13903 1441685 63 63
ReadX 13903 1441748 65471 65471
ReadX 13903 1507219 63 63
ReadX 13903 1507282 65471 65471
ReadX 13903 1572753 63 63
ReadX 13903 1572816 65471 65471
ReadX 13903 1638287 63 63
ReadX 13903 1638350 65471 65471
ReadX 13903 1703821 63 63
ReadX 13903 1703884 65471 65471
ReadX 13903 1769355 63 63
ReadX 13903 1769418 65471 65471
ReadX 13903 1834889 63 63
ReadX 13903 1834952 32824 32824
Close 13903
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13904
Close 13904
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13905
ReadX 13905 0 24 24
Close 13905
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13906
QUERY_FILE_INFORMATION 13906
ReadX 13906 0 512 512
ReadX 13906 464 512 512
ReadX 13906 498 512 512
ReadX 13906 472 512 512
ReadX 13906 466 512 512
ReadX 13906 978 512 512
ReadX 13906 497 57 57
Close 13906
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13907
QUERY_FILE_INFORMATION 13907
ReadX 13907 0 512 512
ReadX 13907 464 512 512
ReadX 13907 498 512 512
ReadX 13907 472 512 512
ReadX 13907 462 512 512
ReadX 13907 468 512 512
ReadX 13907 466 512 512
QUERY_FILE_INFORMATION 13907
WriteX 13907 482 60 60
WriteX 13907 482 4 4
QUERY_FILE_INFORMATION 13907
WriteX 13907 482 11 11
ReadX 13907 497 57 57
ReadX 13907 497 57 57
ReadX 13907 368 4096 4096
ReadX 13907 460 512 512
ReadX 13907 512 4096 4096
ReadX 13907 4608 4096 4096
ReadX 13907 8704 4096 4096
ReadX 13907 12800 4096 4096
ReadX 13907 16896 4096 4096
ReadX 13907 20992 4096 4096
ReadX 13907 25088 4096 4096
ReadX 13907 29184 4096 4096
ReadX 13907 33280 4096 4096
ReadX 13907 37376 4096 4096
ReadX 13907 41472 4096 4096
ReadX 13907 45568 4096 4096
ReadX 13907 49664 4096 4096
ReadX 13907 53760 4096 4096
ReadX 13907 57856 4096 4096
ReadX 13907 61952 4096 4096
ReadX 13907 66048 4096 4096
ReadX 13907 70144 4096 4096
ReadX 13907 497 20 20
ReadX 13907 496 103 103
ReadX 13907 500 448 448
ReadX 13907 470 512 512
ReadX 13907 486 2692 2692
ReadX 13907 290 4096 4096
ReadX 13907 4386 4096 4096
ReadX 13907 8482 4096 4096
ReadX 13907 500 20 20
ReadX 13907 483 108 108
ReadX 13907 482 292 292
ReadX 13907 338 4096 4096
ReadX 13907 4434 3103 3103
ReadX 13907 384 28 28
ReadX 13907 412 20 20
ReadX 13907 432 8 8
ReadX 13907 440 136 136
ReadX 13907 576 8 8
ReadX 13907 584 4 4
ReadX 13907 588 4 4
ReadX 13907 592 39 39
ReadX 13907 384 4 4
ReadX 13907 388 4 4
ReadX 13907 392 23 23
ReadX 13907 385 4 4
ReadX 13907 389 4 4
ReadX 13907 393 12 12
ReadX 13907 405 4 4
ReadX 13907 409 4 4
ReadX 13907 413 1 1
ReadX 13907 385 4 4
ReadX 13907 389 4 4
ReadX 13907 393 1 1
ReadX 13907 385 4 4
ReadX 13907 389 4 4
ReadX 13907 393 12 12
ReadX 13907 405 4 4
ReadX 13907 409 4 4
ReadX 13907 413 2 2
ReadX 13907 385 4 4
ReadX 13907 389 4 4
ReadX 13907 393 25 25
ReadX 13907 385 4 4
ReadX 13907 389 8 8
ReadX 13907 397 4 4
ReadX 13907 401 8 8
ReadX 13907 409 4 4
ReadX 13907 413 8 8
ReadX 13907 421 4 4
ReadX 13907 425 8 8
ReadX 13907 433 4 4
ReadX 13907 437 4 4
ReadX 13907 441 4 4
ReadX 13907 445 4 4
ReadX 13907 449 4 4
ReadX 13907 453 4 4
ReadX 13907 457 4 4
ReadX 13907 461 4 4
ReadX 13907 465 10670 10670
ReadX 13907 428 4096 4096
WriteX 13907 498 512 512
WriteX 13907 472 512 512
WriteX 13907 462 512 512
WriteX 13907 468 512 512
Close 13907
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13908
Close 13908
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13909
QUERY_FILE_INFORMATION 13909
ReadX 13909 0 512 512
ReadX 13909 464 512 512
ReadX 13909 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13910
Close 13910
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13909
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13912
WriteX 13912 4607 1 1
QUERY_FILE_INFORMATION 13912
WriteX 13912 0 65471 65471
WriteX 13912 65471 65 65
WriteX 13912 65536 19979 19979
Close 13912
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13913
QUERY_FILE_INFORMATION 13913
ReadX 13913 0 512 512
ReadX 13913 462 512 512
ReadX 13913 974 512 512
ReadX 13913 1486 512 512
ReadX 13913 460 512 512
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
WriteX 13913 470 448 448
QUERY_FILE_INFORMATION 13913
WriteX 13913 470 60 60
WriteX 13913 470 4 4
QUERY_FILE_INFORMATION 13913
WriteX 13913 470 11 11
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
WriteX 13913 464 512 512
WriteX 13913 976 512 512
WriteX 13913 1488 512 512
WriteX 13913 462 512 512
WriteX 13913 0 512 512
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
ReadX 13913 470 512 512
WriteX 13913 482 512 512
WriteX 13913 482 292 292
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
WriteX 13913 483 20 20
WriteX 13913 483 108 108
QUERY_FILE_INFORMATION 13913
WriteX 13913 484 448 448
QUERY_FILE_INFORMATION 13913
WriteX 13913 484 44 44
WriteX 13913 484 20 20
WriteX 13913 480 512 512
WriteX 13913 472 512 512
WriteX 13913 476 512 512
WriteX 13913 988 512 512
WriteX 13913 474 512 512
Flush 13913
WriteX 13913 0 512 512
Flush 13913
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
WriteX 13913 480 512 512
WriteX 13913 472 512 512
WriteX 13913 476 512 512
QUERY_FILE_INFORMATION 13913
WriteX 13913 496 320 320
QUERY_FILE_INFORMATION 13913
WriteX 13913 496 60 60
ReadX 13913 484 512 512
WriteX 13913 500 512 512
WriteX 13913 470 512 512
WriteX 13913 486 2692 2692
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
WriteX 13913 497 25 25
WriteX 13913 496 103 103
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
WriteX 13913 497 44 44
WriteX 13913 497 20 20
WriteX 13913 498 512 512
WriteX 13913 462 512 512
WriteX 13913 466 512 512
WriteX 13913 978 512 512
WriteX 13913 464 512 512
Flush 13913
WriteX 13913 0 512 512
Flush 13913
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
QUERY_FILE_INFORMATION 13913
WriteX 13913 497 7 7
WriteX 13913 497 57 57
WriteX 13913 498 512 512
WriteX 13913 472 512 512
WriteX 13913 462 512 512
WriteX 13913 466 512 512
WriteX 13913 978 512 512
Flush 13913
WriteX 13913 498 512 512
Flush 13913
Close 13913
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13914
QUERY_FILE_INFORMATION 13914
ReadX 13914 0 512 512
ReadX 13914 464 512 512
ReadX 13914 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13915
ReadX 13915 0 20 20
ReadX 13915 14 40 40
ReadX 13915 54 64 64
ReadX 13915 118 1152 1152
Close 13915
Close 13914
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13916
Close 13916
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13917
ReadX 13917 0 24 24
Close 13917
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13918
QUERY_FILE_INFORMATION 13918
ReadX 13918 0 512 512
ReadX 13918 464 512 512
ReadX 13918 498 512 512
ReadX 13918 472 512 512
ReadX 13918 462 512 512
ReadX 13918 466 512 512
ReadX 13918 978 512 512
ReadX 13918 497 57 57
Close 13918
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13919
QUERY_FILE_INFORMATION 13919
ReadX 13919 0 512 512
ReadX 13919 464 512 512
ReadX 13919 498 512 512
ReadX 13919 472 512 512
ReadX 13919 468 512 512
ReadX 13919 462 512 512
ReadX 13919 466 512 512
QUERY_FILE_INFORMATION 13919
WriteX 13919 482 60 60
WriteX 13919 482 4 4
QUERY_FILE_INFORMATION 13919
WriteX 13919 482 11 11
WriteX 13919 498 512 512
WriteX 13919 472 512 512
WriteX 13919 462 512 512
WriteX 13919 466 512 512
WriteX 13919 978 512 512
Close 13919
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13920
Close 13920
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13921
Close 13921
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13923
WriteX 13923 4607 1 1
QUERY_FILE_INFORMATION 13923
WriteX 13923 0 65471 65471
WriteX 13923 65471 65 65
WriteX 13923 65536 17654 17654
Close 13923
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13924
QUERY_FILE_INFORMATION 13924
ReadX 13924 0 512 512
ReadX 13924 474 512 512
ReadX 13924 986 512 512
ReadX 13924 1498 512 512
ReadX 13924 472 512 512
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
WriteX 13924 482 448 448
QUERY_FILE_INFORMATION 13924
WriteX 13924 482 60 60
WriteX 13924 482 4 4
QUERY_FILE_INFORMATION 13924
WriteX 13924 482 11 11
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
WriteX 13924 476 512 512
WriteX 13924 988 512 512
WriteX 13924 1500 512 512
WriteX 13924 474 512 512
WriteX 13924 0 512 512
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
ReadX 13924 482 512 512
WriteX 13924 494 512 512
WriteX 13924 494 292 292
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
WriteX 13924 495 20 20
WriteX 13924 495 108 108
QUERY_FILE_INFORMATION 13924
WriteX 13924 496 448 448
QUERY_FILE_INFORMATION 13924
WriteX 13924 496 44 44
WriteX 13924 496 20 20
WriteX 13924 492 512 512
WriteX 13924 484 512 512
WriteX 13924 488 512 512
WriteX 13924 1000 512 512
WriteX 13924 486 512 512
Flush 13924
WriteX 13924 0 512 512
Flush 13924
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
WriteX 13924 492 512 512
WriteX 13924 484 512 512
WriteX 13924 488 512 512
QUERY_FILE_INFORMATION 13924
WriteX 13924 508 320 320
QUERY_FILE_INFORMATION 13924
WriteX 13924 508 60 60
ReadX 13924 496 512 512
WriteX 13924 512 512 512
WriteX 13924 482 512 512
WriteX 13924 498 2692 2692
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
WriteX 13924 509 25 25
WriteX 13924 508 103 103
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
WriteX 13924 509 44 44
WriteX 13924 509 20 20
WriteX 13924 510 512 512
WriteX 13924 474 512 512
WriteX 13924 478 512 512
WriteX 13924 990 512 512
WriteX 13924 476 512 512
Flush 13924
WriteX 13924 0 512 512
Flush 13924
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
QUERY_FILE_INFORMATION 13924
WriteX 13924 509 7 7
WriteX 13924 509 57 57
WriteX 13924 510 512 512
WriteX 13924 484 512 512
WriteX 13924 474 512 512
WriteX 13924 478 512 512
WriteX 13924 990 512 512
Flush 13924
WriteX 13924 510 512 512
Flush 13924
Close 13924
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13925
Close 13925
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13926
QUERY_FILE_INFORMATION 13926
ReadX 13926 0 512 512
ReadX 13926 476 512 512
ReadX 13926 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13927
Close 13927
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13928
QUERY_FILE_INFORMATION 13928
ReadX 13928 0 512 512
ReadX 13928 512 512 512
ReadX 13928 770 512 512
ReadX 13928 1282 512 512
ReadX 13928 1794 512 512
ReadX 13928 2562 512 512
ReadX 13928 3586 512 512
ReadX 13928 3828 512 512
ReadX 13928 288 512 512
ReadX 13928 1024 512 512
ReadX 13928 954 512 512
ReadX 13928 295 512 512
ReadX 13928 320 512 512
ReadX 13928 322 512 512
ReadX 13928 834 512 512
ReadX 13928 1346 512 512
ReadX 13928 1858 512 512
ReadX 13928 323 512 512
ReadX 13928 835 512 512
ReadX 13928 1347 512 512
ReadX 13928 1859 512 512
ReadX 13928 2371 345 345
ReadX 13928 322 167 167
ReadX 13928 489 512 512
ReadX 13928 1001 512 512
ReadX 13928 1513 512 512
ReadX 13928 2025 512 512
ReadX 13928 2537 512 512
ReadX 13928 3049 512 512
ReadX 13928 3561 345 345
ReadX 13928 323 167 167
ReadX 13928 490 512 512
ReadX 13928 1002 512 512
ReadX 13928 1514 512 512
ReadX 13928 2026 512 512
ReadX 13928 2538 512 512
ReadX 13928 3050 512 512
ReadX 13928 3562 512 512
ReadX 13928 4074 512 512
ReadX 13928 4586 512 512
ReadX 13928 5098 512 512
ReadX 13928 5610 512 512
ReadX 13928 6122 512 512
ReadX 13928 6634 512 512
ReadX 13928 7146 512 512
ReadX 13928 7658 512 512
ReadX 13928 8170 512 512
ReadX 13928 8682 512 512
ReadX 13928 9194 512 512
ReadX 13928 9706 512 512
ReadX 13928 10218 512 512
ReadX 13928 10730 345 345
ReadX 13928 11075 512 512
ReadX 13928 11587 167 167
ReadX 13928 11754 512 512
ReadX 13928 12266 512 512
ReadX 13928 12778 512 512
ReadX 13928 13290 512 512
ReadX 13928 13802 512 512
ReadX 13928 14314 512 512
ReadX 13928 14826 512 512
ReadX 13928 15338 512 512
ReadX 13928 337 512 512
ReadX 13928 337 512 512
ReadX 13928 849 34 34
ReadX 13928 352 512 512
ReadX 13928 864 512 512
ReadX 13928 1376 512 512
ReadX 13928 1888 512 512
ReadX 13928 2400 512 512
ReadX 13928 2912 512 512
ReadX 13928 3424 512 512
ReadX 13928 3936 512 512
ReadX 13928 1632 512 512
ReadX 13928 2144 512 512
ReadX 13928 1682 512 512
ReadX 13928 258 512 512
ReadX 13928 360 144 144
ReadX 13928 2517 512 512
ReadX 13928 3029 512 512
ReadX 13928 1751 512 512
ReadX 13928 2263 512 512
ReadX 13928 2775 512 512
ReadX 13928 3287 512 512
ReadX 13928 3799 512 512
ReadX 13928 4311 512 512
ReadX 13928 4823 512 512
ReadX 13928 5335 512 512
ReadX 13928 5847 512 512
ReadX 13928 6359 512 512
ReadX 13928 6871 512 512
ReadX 13928 7383 512 512
ReadX 13928 7895 512 512
ReadX 13928 8407 512 512
ReadX 13928 8919 512 512
ReadX 13928 9431 512 512
ReadX 13928 9943 512 512
ReadX 13928 10455 512 512
ReadX 13928 10967 512 512
ReadX 13928 11479 512 512
ReadX 13928 2556 512 512
ReadX 13928 3068 512 512
ReadX 13928 3580 512 512
ReadX 13928 4092 512 512
ReadX 13928 4604 512 512
ReadX 13928 5116 512 512
ReadX 13928 5628 512 512
ReadX 13928 6140 512 512
ReadX 13928 6652 512 512
ReadX 13928 7164 512 512
ReadX 13928 7676 512 512
ReadX 13928 8188 512 512
ReadX 13928 8700 512 512
ReadX 13928 9212 512 512
ReadX 13928 9724 512 512
ReadX 13928 10236 512 512
ReadX 13928 10748 512 512
ReadX 13928 11260 512 512
ReadX 13928 11772 512 512
ReadX 13928 12284 512 512
ReadX 13928 12796 49 49
ReadX 13928 260 463 463
ReadX 13928 723 512 512
ReadX 13928 1235 512 512
ReadX 13928 1747 512 512
ReadX 13928 2259 512 512
ReadX 13928 2771 512 512
ReadX 13928 3283 512 512
ReadX 13928 3795 512 512
ReadX 13928 4307 512 512
ReadX 13928 4819 512 512
ReadX 13928 5331 512 512
ReadX 13928 5843 512 512
ReadX 13928 6355 512 512
ReadX 13928 6867 512 512
ReadX 13928 7379 512 512
ReadX 13928 7891 512 512
ReadX 13928 8403 512 512
ReadX 13928 8915 512 512
ReadX 13928 9427 512 512
ReadX 13928 9939 512 512
ReadX 13928 10451 512 512
ReadX 13928 10963 402 402
ReadX 13928 593 240 240
ReadX 13928 2048 272 272
ReadX 13928 2320 512 512
ReadX 13928 2832 512 512
ReadX 13928 3344 512 512
ReadX 13928 3856 512 512
ReadX 13928 4368 512 512
ReadX 13928 4880 512 512
ReadX 13928 5392 240 240
ReadX 13928 608 272 272
ReadX 13928 880 512 512
ReadX 13928 1392 512 512
ReadX 13928 1904 512 512
ReadX 13928 2416 512 512
ReadX 13928 2928 512 512
ReadX 13928 3440 512 512
ReadX 13928 3952 512 512
ReadX 13928 4464 512 512
ReadX 13928 4976 512 512
ReadX 13928 5488 512 512
ReadX 13928 6000 512 512
ReadX 13928 6512 512 512
ReadX 13928 7024 512 512
ReadX 13928 7536 512 512
ReadX 13928 8048 512 512
ReadX 13928 8560 512 512
ReadX 13928 9072 512 512
ReadX 13928 9584 512 512
ReadX 13928 10096 512 512
ReadX 13928 1683 512 512
ReadX 13928 514 512 512
ReadX 13928 620 512 512
ReadX 13928 770 512 512
ReadX 13928 1282 512 512
ReadX 13928 1794 512 512
ReadX 13928 2000 512 512
ReadX 13928 1434 512 512
ReadX 13928 2050 512 512
ReadX 13928 2118 512 512
ReadX 13928 1715 512 512
ReadX 13928 1024 512 512
ReadX 13928 954 512 512
ReadX 13928 1880 512 512
ReadX 13928 1286 512 512
ReadX 13928 1510 512 512
ReadX 13928 2562 512 512
ReadX 13928 2610 512 512
ReadX 13928 3586 512 512
ReadX 13928 3812 512 512
ReadX 13928 3828 512 512
ReadX 13928 4046 512 512
ReadX 13928 4066 512 512
ReadX 13928 1747 512 512
ReadX 13928 1026 512 512
ReadX 13928 1538 512 512
ReadX 13928 514 512 512
ReadX 13928 751 512 512
ReadX 13928 1263 512 512
ReadX 13928 620 512 512
ReadX 13928 1132 512 512
ReadX 13928 1644 512 512
ReadX 13928 2156 512 512
ReadX 13928 2668 512 512
ReadX 13928 3180 512 512
ReadX 13928 3692 512 512
ReadX 13928 4204 394 394
ReadX 13928 606 118 118
ReadX 13928 724 512 512
ReadX 13928 1236 512 512
ReadX 13928 1748 512 512
ReadX 13928 2260 512 512
ReadX 13928 2772 512 512
ReadX 13928 3284 512 512
ReadX 13928 3796 394 394
ReadX 13928 636 118 118
ReadX 13928 754 512 512
ReadX 13928 1266 512 512
ReadX 13928 1778 512 512
ReadX 13928 2290 512 512
ReadX 13928 2802 512 512
ReadX 13928 3314 512 512
ReadX 13928 3826 512 512
ReadX 13928 4338 512 512
ReadX 13928 4850 512 512
ReadX 13928 5362 512 512
ReadX 13928 5874 512 512
ReadX 13928 6386 512 512
ReadX 13928 6898 512 512
ReadX 13928 7410 512 512
ReadX 13928 7922 512 512
ReadX 13928 8434 512 512
ReadX 13928 8946 512 512
ReadX 13928 9458 512 512
ReadX 13928 9970 512 512
ReadX 13928 10482 512 512
ReadX 13928 723 512 512
ReadX 13928 1235 512 512
ReadX 13928 725 512 512
ReadX 13928 729 512 512
ReadX 13928 1241 512 512
ReadX 13928 1753 512 512
ReadX 13928 2265 512 512
ReadX 13928 2777 512 512
ReadX 13928 3289 512 512
ReadX 13928 3801 512 512
ReadX 13928 4313 512 512
ReadX 13928 4825 512 512
ReadX 13928 5337 512 512
ReadX 13928 5849 512 512
ReadX 13928 6361 512 512
ReadX 13928 755 512 512
ReadX 13928 1267 512 512
ReadX 13928 1779 512 512
ReadX 13928 2291 512 512
ReadX 13928 2803 512 512
ReadX 13928 3315 512 512
ReadX 13928 3827 512 512
ReadX 13928 4339 244 244
ReadX 13928 4583 512 512
ReadX 13928 5095 268 268
ReadX 13928 5363 512 512
ReadX 13928 5875 512 512
ReadX 13928 6387 512 512
ReadX 13928 6899 512 512
ReadX 13928 7411 512 512
ReadX 13928 7923 512 512
ReadX 13928 8435 512 512
ReadX 13928 8947 512 512
ReadX 13928 9459 512 512
ReadX 13928 9971 512 512
ReadX 13928 10483 512 512
ReadX 13928 10995 512 512
ReadX 13928 11507 512 512
ReadX 13928 12019 512 512
ReadX 13928 12531 512 512
ReadX 13928 13043 512 512
ReadX 13928 13555 512 512
ReadX 13928 14067 512 512
ReadX 13928 14579 512 512
ReadX 13928 15091 512 512
ReadX 13928 15603 342 342
ReadX 13928 725 512 512
ReadX 13928 2000 512 512
ReadX 13928 3918 512 512
ReadX 13928 727 512 512
ReadX 13928 258 512 512
ReadX 13928 376 512 512
ReadX 13928 1109 512 512
ReadX 13928 1028 512 512
ReadX 13928 1540 512 512
ReadX 13928 2052 512 512
ReadX 13928 2564 512 512
ReadX 13928 3076 512 512
ReadX 13928 3588 512 512
ReadX 13928 4100 512 512
ReadX 13928 4612 412 412
ReadX 13928 1012 100 100
ReadX 13928 1112 512 512
ReadX 13928 1624 512 512
ReadX 13928 2136 512 512
ReadX 13928 2648 512 512
ReadX 13928 3160 512 512
ReadX 13928 3672 512 512
ReadX 13928 4184 412 412
ReadX 13928 1044 100 100
ReadX 13928 1144 512 512
ReadX 13928 1656 512 512
ReadX 13928 2168 512 512
ReadX 13928 2680 512 512
ReadX 13928 3192 512 512
ReadX 13928 3704 512 512
ReadX 13928 4216 512 512
ReadX 13928 4728 512 512
ReadX 13928 5240 512 512
ReadX 13928 5752 512 512
ReadX 13928 6264 512 512
ReadX 13928 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 13928 7288 512 512
ReadX 13928 7800 512 512
ReadX 13928 8312 512 512
ReadX 13928 8824 512 512
ReadX 13928 9336 512 512
ReadX 13928 9848 512 512
ReadX 13928 10360 512 512
ReadX 13928 10872 512 512
ReadX 13928 11384 512 512
ReadX 13928 11896 512 512
ReadX 13928 12408 512 512
ReadX 13928 1088 512 512
ReadX 13928 1600 512 512
ReadX 13928 1090 512 512
ReadX 13928 1094 512 512
ReadX 13928 1606 512 512
ReadX 13928 2118 512 512
ReadX 13928 2630 512 512
ReadX 13928 3142 512 512
ReadX 13928 3654 512 512
ReadX 13928 4166 512 512
ReadX 13928 4678 512 512
ReadX 13928 1111 512 512
ReadX 13928 1623 512 512
ReadX 13928 2135 512 512
ReadX 13928 2647 512 512
ReadX 13928 3159 512 512
ReadX 13928 3671 512 512
ReadX 13928 4183 512 512
ReadX 13928 4695 512 512
ReadX 13928 5207 512 512
ReadX 13928 5719 512 512
ReadX 13928 6231 512 512
ReadX 13928 6743 512 512
ReadX 13928 7255 512 512
ReadX 13928 7767 512 512
ReadX 13928 8279 512 512
ReadX 13928 8791 512 512
ReadX 13928 9303 512 512
ReadX 13928 9815 512 512
ReadX 13928 10327 512 512
ReadX 13928 10839 512 512
ReadX 13928 11351 294 294
ReadX 13928 1091 512 512
ReadX 13928 970 512 512
ReadX 13928 1093 512 512
ReadX 13928 1434 512 512
ReadX 13928 2050 512 512
ReadX 13928 2158 512 512
ReadX 13928 2118 512 512
ReadX 13928 2630 512 512
ReadX 13928 3142 512 512
ReadX 13928 3654 512 512
ReadX 13928 4166 512 512
ReadX 13928 4678 512 512
ReadX 13928 5190 512 512
ReadX 13928 5702 382 382
ReadX 13928 2104 130 130
ReadX 13928 2234 512 512
ReadX 13928 2746 512 512
ReadX 13928 3258 512 512
ReadX 13928 3770 512 512
ReadX 13928 4282 512 512
ReadX 13928 4794 512 512
ReadX 13928 5306 382 382
ReadX 13928 2134 130 130
ReadX 13928 2264 512 512
ReadX 13928 2776 512 512
ReadX 13928 3288 512 512
ReadX 13928 3800 512 512
ReadX 13928 4312 512 512
ReadX 13928 4824 512 512
ReadX 13928 5336 512 512
ReadX 13928 2147 512 512
ReadX 13928 2149 512 512
ReadX 13928 2152 512 512
ReadX 13928 2664 512 512
ReadX 13928 3176 512 512
ReadX 13928 3688 512 512
ReadX 13928 2159 512 512
ReadX 13928 2671 512 512
ReadX 13928 3183 512 512
ReadX 13928 3695 512 512
ReadX 13928 4207 512 512
ReadX 13928 4719 512 512
ReadX 13928 5231 512 512
ReadX 13928 5743 512 512
ReadX 13928 6255 512 512
ReadX 13928 6767 512 512
ReadX 13928 7279 512 512
ReadX 13928 7791 512 512
ReadX 13928 8303 512 512
ReadX 13928 8815 512 512
ReadX 13928 9327 512 512
ReadX 13928 9839 512 512
ReadX 13928 10351 512 512
ReadX 13928 10863 512 512
ReadX 13928 11375 512 512
ReadX 13928 11887 512 512
ReadX 13928 12399 38 38
ReadX 13928 2149 512 512
ReadX 13928 1794 512 512
ReadX 13928 2016 512 512
ReadX 13928 2151 512 512
ReadX 13928 1918 512 512
ReadX 13928 1880 512 512
ReadX 13928 2392 512 512
ReadX 13928 2904 512 512
ReadX 13928 3416 512 512
ReadX 13928 3928 512 512
ReadX 13928 4440 512 512
ReadX 13928 4952 512 512
ReadX 13928 5464 416 416
ReadX 13928 1866 96 96
ReadX 13928 1962 512 512
ReadX 13928 2474 512 512
ReadX 13928 2986 512 512
ReadX 13928 3498 512 512
ReadX 13928 4010 512 512
ReadX 13928 4522 512 512
ReadX 13928 5034 416 416
ReadX 13928 1896 96 96
ReadX 13928 1992 512 512
ReadX 13928 2504 512 512
ReadX 13928 3016 512 512
ReadX 13928 3528 512 512
ReadX 13928 1903 512 512
ReadX 13928 1905 512 512
ReadX 13928 1908 512 512
ReadX 13928 2420 512 512
ReadX 13928 2932 512 512
ReadX 13928 3444 512 512
ReadX 13928 3956 512 512
ReadX 13928 1919 512 512
ReadX 13928 2431 512 512
ReadX 13928 2943 512 512
ReadX 13928 3455 512 512
ReadX 13928 3967 512 512
ReadX 13928 4479 512 512
ReadX 13928 4991 512 512
ReadX 13928 5503 512 512
ReadX 13928 6015 512 512
ReadX 13928 6527 512 512
ReadX 13928 7039 512 512
ReadX 13928 7551 512 512
ReadX 13928 8063 512 512
ReadX 13928 8575 512 512
ReadX 13928 9087 512 512
ReadX 13928 9599 512 512
ReadX 13928 10111 512 512
ReadX 13928 10623 512 512
ReadX 13928 11135 512 512
ReadX 13928 11647 512 512
ReadX 13928 12159 322 322
ReadX 13928 1905 512 512
ReadX 13928 1846 512 512
ReadX 13928 1907 512 512
ReadX 13928 1860 268 268
ReadX 13928 1832 244 244
ReadX 13928 1846 512 512
ReadX 13928 2358 512 512
ReadX 13928 2870 512 512
ReadX 13928 3382 512 512
ReadX 13928 3894 512 512
ReadX 13928 4406 512 512
ReadX 13928 4918 512 512
ReadX 13928 1858 512 512
ReadX 13928 1859 512 512
ReadX 13928 1860 488 488
ReadX 13928 1832 24 24
ReadX 13928 1861 228 228
ReadX 13928 1832 284 284
ReadX 13928 2116 512 512
ReadX 13928 2628 512 512
ReadX 13928 3140 512 512
ReadX 13928 3652 512 512
ReadX 13928 4164 512 512
ReadX 13928 4676 512 512
ReadX 13928 5188 228 228
ReadX 13928 1862 284 284
ReadX 13928 2146 512 512
ReadX 13928 2658 38 38
ReadX 13928 1859 512 512
ReadX 13928 2047 512 512
ReadX 13928 2016 512 512
ReadX 13928 2528 512 512
ReadX 13928 3040 512 512
ReadX 13928 3552 512 512
ReadX 13928 4064 512 512
ReadX 13928 4576 512 512
ReadX 13928 5088 512 512
ReadX 13928 5600 424 424
ReadX 13928 2002 88 88
ReadX 13928 2090 512 512
ReadX 13928 2602 512 512
ReadX 13928 3114 512 512
ReadX 13928 3626 512 512
ReadX 13928 4138 512 512
ReadX 13928 4650 512 512
ReadX 13928 5162 424 424
ReadX 13928 2032 88 88
ReadX 13928 2120 512 512
ReadX 13928 2632 512 512
ReadX 13928 3144 512 512
ReadX 13928 3656 512 512
ReadX 13928 4168 512 512
ReadX 13928 4680 512 512
ReadX 13928 5192 512 512
ReadX 13928 2044 512 512
ReadX 13928 2045 512 512
ReadX 13928 2046 512 512
ReadX 13928 2047 512 512
ReadX 13928 2559 110 110
ReadX 13928 2052 402 402
ReadX 13928 2454 512 512
ReadX 13928 2966 512 512
ReadX 13928 3478 512 512
ReadX 13928 3990 512 512
ReadX 13928 4502 512 512
ReadX 13928 5014 512 512
ReadX 13928 5526 512 512
ReadX 13928 6038 512 512
ReadX 13928 6550 512 512
ReadX 13928 7062 512 512
ReadX 13928 7574 512 512
ReadX 13928 8086 512 512
ReadX 13928 8598 512 512
ReadX 13928 9110 512 512
ReadX 13928 9622 512 512
ReadX 13928 10134 512 512
ReadX 13928 10646 512 512
ReadX 13928 11158 512 512
ReadX 13928 11670 512 512
ReadX 13928 12182 512 512
ReadX 13928 12694 118 118
ReadX 13928 2045 512 512
ReadX 13928 1282 512 512
ReadX 13928 1343 512 512
ReadX 13928 1286 512 512
ReadX 13928 1798 512 512
ReadX 13928 2310 512 512
ReadX 13928 2822 512 512
ReadX 13928 3334 512 512
ReadX 13928 3846 512 512
ReadX 13928 4358 512 512
ReadX 13928 4870 416 416
ReadX 13928 1270 96 96
ReadX 13928 1366 512 512
ReadX 13928 1878 512 512
ReadX 13928 2390 512 512
ReadX 13928 2902 512 512
ReadX 13928 3414 512 512
ReadX 13928 3926 416 416
ReadX 13928 1284 96 96
ReadX 13928 1380 416 416
ReadX 13928 1302 96 96
ReadX 13928 1398 512 512
ReadX 13928 1910 512 512
ReadX 13928 2422 512 512
ReadX 13928 2934 512 512
ReadX 13928 3446 512 512
ReadX 13928 3958 512 512
ReadX 13928 4470 512 512
ReadX 13928 4982 512 512
ReadX 13928 5494 512 512
ReadX 13928 6006 512 512
ReadX 13928 6518 512 512
ReadX 13928 7030 512 512
ReadX 13928 7542 512 512
ReadX 13928 1328 512 512
ReadX 13928 1330 512 512
ReadX 13928 1333 512 512
ReadX 13928 1845 512 512
ReadX 13928 2357 512 512
ReadX 13928 2869 512 512
ReadX 13928 3381 512 512
ReadX 13928 1344 512 512
ReadX 13928 1856 512 512
ReadX 13928 2368 512 512
ReadX 13928 2880 512 512
ReadX 13928 3392 512 512
ReadX 13928 3904 512 512
ReadX 13928 4416 512 512
ReadX 13928 4928 512 512
ReadX 13928 5440 512 512
ReadX 13928 5952 512 512
ReadX 13928 6464 512 512
ReadX 13928 6976 512 512
ReadX 13928 7488 512 512
ReadX 13928 8000 512 512
ReadX 13928 8512 512 512
ReadX 13928 9024 512 512
ReadX 13928 9536 512 512
ReadX 13928 10048 512 512
ReadX 13928 10560 512 512
ReadX 13928 11072 512 512
ReadX 13928 11584 426 426
ReadX 13928 1330 512 512
ReadX 13928 1842 512 512
ReadX 13928 1250 512 512
ReadX 13928 1264 268 268
ReadX 13928 1236 244 244
ReadX 13928 1250 512 512
ReadX 13928 1762 512 512
ReadX 13928 2274 512 512
ReadX 13928 2786 512 512
ReadX 13928 3298 512 512
ReadX 13928 3810 512 512
ReadX 13928 4322 512 512
ReadX 13928 1262 512 512
ReadX 13928 1263 512 512
ReadX 13928 1264 488 488
ReadX 13928 1236 24 24
ReadX 13928 1265 228 228
ReadX 13928 1236 284 284
ReadX 13928 1520 512 512
ReadX 13928 2032 512 512
ReadX 13928 2544 512 512
ReadX 13928 3056 512 512
ReadX 13928 3568 512 512
ReadX 13928 4080 512 512
ReadX 13928 4592 228 228
ReadX 13928 1266 284 284
ReadX 13928 1550 512 512
ReadX 13928 2062 42 42
ReadX 13928 1263 512 512
ReadX 13928 1538 512 512
ReadX 13928 1640 512 512
ReadX 13928 1510 512 512
ReadX 13928 2022 512 512
ReadX 13928 2534 512 512
ReadX 13928 3046 512 512
ReadX 13928 3558 512 512
ReadX 13928 4070 512 512
ReadX 13928 4582 512 512
ReadX 13928 5094 408 408
ReadX 13928 1496 104 104
ReadX 13928 1600 512 512
ReadX 13928 2112 512 512
ReadX 13928 2624 512 512
ReadX 13928 3136 512 512
ReadX 13928 3648 512 512
ReadX 13928 4160 512 512
ReadX 13928 4672 408 408
ReadX 13928 1526 104 104
ReadX 13928 1630 512 512
ReadX 13928 2142 512 512
ReadX 13928 2654 512 512
ReadX 13928 3166 512 512
ReadX 13928 3678 512 512
ReadX 13928 4190 408 408
ReadX 13928 1540 104 104
ReadX 13928 1644 512 512
ReadX 13928 2156 512 512
ReadX 13928 2668 512 512
ReadX 13928 3180 512 512
ReadX 13928 3692 512 512
ReadX 13928 4204 512 512
ReadX 13928 4716 512 512
ReadX 13928 5228 512 512
ReadX 13928 5740 512 512
ReadX 13928 6252 512 512
ReadX 13928 6764 512 512
ReadX 13928 7276 512 512
ReadX 13928 7788 512 512
ReadX 13928 8300 512 512
ReadX 13928 8812 512 512
ReadX 13928 9324 512 512
ReadX 13928 9836 512 512
ReadX 13928 10348 512 512
ReadX 13928 10860 512 512
ReadX 13928 11372 512 512
ReadX 13928 1615 512 512
ReadX 13928 2127 512 512
ReadX 13928 1617 512 512
ReadX 13928 1621 512 512
ReadX 13928 2133 512 512
ReadX 13928 2645 512 512
ReadX 13928 3157 512 512
ReadX 13928 3669 512 512
ReadX 13928 4181 512 512
ReadX 13928 4693 512 512
ReadX 13928 5205 512 512
ReadX 13928 5717 512 512
ReadX 13928 6229 512 512
ReadX 13928 1641 512 512
ReadX 13928 2153 512 512
ReadX 13928 2665 512 512
ReadX 13928 3177 512 512
ReadX 13928 3689 512 512
ReadX 13928 4201 512 512
ReadX 13928 4713 512 512
ReadX 13928 5225 512 512
ReadX 13928 5737 512 512
ReadX 13928 6249 512 512
ReadX 13928 6761 512 512
ReadX 13928 7273 512 512
ReadX 13928 7785 512 512
ReadX 13928 8297 512 512
ReadX 13928 8809 512 512
ReadX 13928 9321 512 512
ReadX 13928 9833 512 512
ReadX 13928 10345 512 512
ReadX 13928 10857 512 512
ReadX 13928 11369 512 512
ReadX 13928 11881 2 2
ReadX 13928 1796 510 510
ReadX 13928 2306 512 512
ReadX 13928 2818 512 512
ReadX 13928 3330 512 512
ReadX 13928 3842 512 512
ReadX 13928 4354 512 512
ReadX 13928 4866 512 512
ReadX 13928 5378 512 512
ReadX 13928 5890 512 512
ReadX 13928 6402 512 512
ReadX 13928 6914 512 512
ReadX 13928 7426 512 512
ReadX 13928 7938 512 512
ReadX 13928 8450 512 512
ReadX 13928 8962 512 512
ReadX 13928 9474 512 512
ReadX 13928 9986 512 512
ReadX 13928 10498 326 326
ReadX 13928 1617 512 512
ReadX 13928 2129 512 512
ReadX 13928 1450 512 512
ReadX 13928 1621 512 512
ReadX 13928 1446 512 512
ReadX 13928 1450 512 512
ReadX 13928 1962 512 512
ReadX 13928 2474 512 512
ReadX 13928 2986 512 512
ReadX 13928 3498 512 512
ReadX 13928 4010 512 512
ReadX 13928 4522 512 512
ReadX 13928 5034 424 424
ReadX 13928 1436 88 88
ReadX 13928 1524 512 512
ReadX 13928 2036 512 512
ReadX 13928 2548 512 512
ReadX 13928 3060 512 512
ReadX 13928 1442 512 512
ReadX 13928 1443 512 512
ReadX 13928 1444 512 512
ReadX 13928 1446 512 512
ReadX 13928 1958 386 386
ReadX 13928 1466 126 126
ReadX 13928 1592 512 512
ReadX 13928 2104 512 512
ReadX 13928 2616 512 512
ReadX 13928 3128 512 512
ReadX 13928 3640 512 512
ReadX 13928 4152 512 512
ReadX 13928 4664 512 512
ReadX 13928 5176 512 512
ReadX 13928 5688 512 512
ReadX 13928 6200 512 512
ReadX 13928 6712 512 512
ReadX 13928 7224 512 512
ReadX 13928 7736 512 512
ReadX 13928 8248 512 512
ReadX 13928 8760 294 294
ReadX 13928 1443 512 512
ReadX 13928 964 512 512
ReadX 13928 970 512 512
ReadX 13928 1482 512 512
ReadX 13928 1994 512 512
ReadX 13928 2506 512 512
ReadX 13928 3018 512 512
ReadX 13928 3530 512 512
ReadX 13928 4042 512 512
ReadX 13928 4554 424 424
ReadX 13928 956 88 88
ReadX 13928 1044 512 512
ReadX 13928 1556 512 512
ReadX 13928 2068 512 512
ReadX 13928 2580 512 512
ReadX 13928 962 512 512
ReadX 13928 963 512 512
ReadX 13928 964 512 512
ReadX 13928 965 512 512
ReadX 13928 1477 512 512
ReadX 13928 1989 228 228
ReadX 13928 986 284 284
ReadX 13928 1270 512 512
ReadX 13928 1782 512 512
ReadX 13928 2294 512 512
ReadX 13928 2806 512 512
ReadX 13928 3318 512 512
ReadX 13928 3830 512 512
ReadX 13928 4342 512 512
ReadX 13928 4854 512 512
ReadX 13928 5366 512 512
ReadX 13928 5878 512 512
ReadX 13928 6390 512 512
ReadX 13928 6902 512 512
ReadX 13928 7414 42 42
ReadX 13928 963 512 512
ReadX 13928 2610 512 512
ReadX 13928 3812 512 512
ReadX 13928 3828 512 512
ReadX 13928 3969 512 512
ReadX 13928 3918 512 512
ReadX 13928 4430 512 512
ReadX 13928 4942 512 512
ReadX 13928 5454 512 512
ReadX 13928 5966 512 512
ReadX 13928 6478 512 512
ReadX 13928 6990 512 512
ReadX 13928 7502 424 424
ReadX 13928 3904 88 88
ReadX 13928 3992 512 512
ReadX 13928 4504 512 512
ReadX 13928 5016 512 512
ReadX 13928 5528 512 512
ReadX 13928 6040 512 512
ReadX 13928 6552 512 512
ReadX 13928 7064 424 424
ReadX 13928 3934 88 88
ReadX 13928 4022 512 512
ReadX 13928 4534 512 512
ReadX 13928 5046 512 512
ReadX 13928 5558 512 512
ReadX 13928 6070 512 512
ReadX 13928 6582 512 512
ReadX 13928 7094 512 512
ReadX 13928 7606 512 512
ReadX 13928 8118 512 512
ReadX 13928 8630 512 512
ReadX 13928 3953 512 512
ReadX 13928 4465 512 512
ReadX 13928 3956 512 512
ReadX 13928 3964 512 512
ReadX 13928 4476 512 512
ReadX 13928 4988 512 512
ReadX 13928 3970 512 512
ReadX 13928 4482 512 512
ReadX 13928 4994 512 512
ReadX 13928 5506 512 512
ReadX 13928 6018 512 512
ReadX 13928 6530 512 512
ReadX 13928 7042 512 512
ReadX 13928 7554 512 512
ReadX 13928 8066 512 512
ReadX 13928 8578 512 512
ReadX 13928 9090 512 512
ReadX 13928 9602 512 512
ReadX 13928 10114 512 512
ReadX 13928 10626 512 512
ReadX 13928 11138 512 512
ReadX 13928 11650 512 512
ReadX 13928 12162 512 512
ReadX 13928 12674 512 512
ReadX 13928 13186 512 512
ReadX 13928 13698 512 512
ReadX 13928 14210 134 134
ReadX 13928 3956 512 512
ReadX 13928 4468 512 512
ReadX 13928 4980 512 512
ReadX 13928 5492 512 512
ReadX 13928 3074 512 512
ReadX 13928 3246 512 512
ReadX 13928 3964 512 512
ReadX 13928 3330 512 512
ReadX 13928 3465 512 512
ReadX 13928 3246 512 512
ReadX 13928 3758 512 512
ReadX 13928 4270 512 512
ReadX 13928 4782 512 512
ReadX 13928 5294 512 512
ReadX 13928 5806 512 512
ReadX 13928 6318 512 512
ReadX 13928 6830 368 368
ReadX 13928 3232 144 144
ReadX 13928 3376 512 512
ReadX 13928 3888 512 512
ReadX 13928 4400 512 512
ReadX 13928 4912 512 512
ReadX 13928 5424 512 512
ReadX 13928 5936 512 512
ReadX 13928 6448 368 368
ReadX 13928 3262 144 144
ReadX 13928 3406 512 512
ReadX 13928 3918 512 512
ReadX 13928 4430 512 512
ReadX 13928 4942 512 512
ReadX 13928 5454 512 512
ReadX 13928 5966 512 512
ReadX 13928 6478 512 512
ReadX 13928 6990 512 512
ReadX 13928 7502 512 512
ReadX 13928 8014 512 512
ReadX 13928 8526 512 512
ReadX 13928 9038 512 512
ReadX 13928 9550 512 512
ReadX 13928 10062 512 512
ReadX 13928 10574 512 512
ReadX 13928 11086 512 512
ReadX 13928 11598 512 512
ReadX 13928 12110 512 512
ReadX 13928 12622 512 512
ReadX 13928 13134 512 512
ReadX 13928 13646 368 368
ReadX 13928 3332 144 144
ReadX 13928 3476 512 512
ReadX 13928 3988 512 512
ReadX 13928 4500 512 512
ReadX 13928 5012 512 512
ReadX 13928 5524 512 512
ReadX 13928 6036 512 512
ReadX 13928 6548 512 512
ReadX 13928 7060 512 512
ReadX 13928 7572 512 512
ReadX 13928 8084 512 512
ReadX 13928 8596 512 512
ReadX 13928 9108 512 512
ReadX 13928 9620 512 512
ReadX 13928 10132 512 512
ReadX 13928 10644 512 512
ReadX 13928 11156 512 512
ReadX 13928 11668 512 512
ReadX 13928 12180 512 512
ReadX 13928 12692 512 512
ReadX 13928 13204 512 512
ReadX 13928 3430 512 512
ReadX 13928 3942 512 512
ReadX 13928 3434 512 512
ReadX 13928 3435 512 512
ReadX 13928 3947 512 512
ReadX 13928 4459 512 512
ReadX 13928 4971 512 512
ReadX 13928 5483 512 512
ReadX 13928 5995 512 512
ReadX 13928 6507 512 512
ReadX 13928 7019 512 512
ReadX 13928 7531 512 512
ReadX 13928 8043 512 512
ReadX 13928 8555 512 512
ReadX 13928 9067 512 512
ReadX 13928 9579 512 512
ReadX 13928 10091 512 512
ReadX 13928 10603 512 512
ReadX 13928 11115 512 512
ReadX 13928 3467 512 512
ReadX 13928 3979 512 512
ReadX 13928 4491 512 512
ReadX 13928 5003 512 512
ReadX 13928 5515 512 512
ReadX 13928 6027 512 512
ReadX 13928 6539 512 512
ReadX 13928 7051 512 512
ReadX 13928 7563 512 512
ReadX 13928 8075 512 512
ReadX 13928 8587 512 512
ReadX 13928 9099 512 512
ReadX 13928 9611 512 512
ReadX 13928 10123 512 512
ReadX 13928 10635 512 512
ReadX 13928 11147 512 512
ReadX 13928 11659 512 512
ReadX 13928 12171 512 512
ReadX 13928 12683 512 512
ReadX 13928 13195 512 512
ReadX 13928 13707 56 56
ReadX 13928 13763 512 512
ReadX 13928 14275 456 456
ReadX 13928 14731 512 512
ReadX 13928 15243 512 512
ReadX 13928 15755 512 512
ReadX 13928 16267 512 512
ReadX 13928 16779 512 512
ReadX 13928 17291 512 512
ReadX 13928 17803 512 512
ReadX 13928 18315 512 512
ReadX 13928 18827 512 512
ReadX 13928 19339 512 512
ReadX 13928 19851 512 512
ReadX 13928 20363 512 512
ReadX 13928 20875 512 512
ReadX 13928 21387 512 512
ReadX 13928 21899 512 512
ReadX 13928 22411 512 512
ReadX 13928 22923 512 512
ReadX 13928 23435 512 512
ReadX 13928 23947 512 512
ReadX 13928 24459 512 512
ReadX 13928 24971 282 282
ReadX 13928 3434 512 512
ReadX 13928 2818 512 512
ReadX 13928 2870 512 512
ReadX 13928 3026 512 512
ReadX 13928 3538 512 512
ReadX 13928 2870 512 512
ReadX 13928 3382 512 512
ReadX 13928 3894 512 512
ReadX 13928 4406 512 512
ReadX 13928 4918 512 512
ReadX 13928 5430 512 512
ReadX 13928 5942 512 512
ReadX 13928 6454 374 374
ReadX 13928 2856 138 138
ReadX 13928 2994 512 512
ReadX 13928 3506 512 512
ReadX 13928 4018 512 512
ReadX 13928 4530 512 512
ReadX 13928 5042 512 512
ReadX 13928 5554 512 512
ReadX 13928 6066 374 374
ReadX 13928 2886 138 138
ReadX 13928 3024 512 512
ReadX 13928 3536 512 512
ReadX 13928 4048 512 512
ReadX 13928 4560 512 512
ReadX 13928 5072 512 512
ReadX 13928 5584 512 512
ReadX 13928 6096 512 512
ReadX 13928 6608 512 512
ReadX 13928 7120 512 512
ReadX 13928 7632 512 512
ReadX 13928 8144 512 512
ReadX 13928 8656 512 512
ReadX 13928 9168 512 512
ReadX 13928 9680 512 512
ReadX 13928 10192 512 512
ReadX 13928 10704 512 512
ReadX 13928 11216 512 512
ReadX 13928 11728 512 512
ReadX 13928 12240 512 512
ReadX 13928 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 13928 13264 512 512
ReadX 13928 13776 512 512
ReadX 13928 14288 512 512
ReadX 13928 14800 512 512
ReadX 13928 15312 512 512
ReadX 13928 15824 512 512
ReadX 13928 16336 512 512
ReadX 13928 16848 512 512
ReadX 13928 17360 512 512
ReadX 13928 17872 512 512
ReadX 13928 18384 512 512
ReadX 13928 18896 512 512
ReadX 13928 19408 512 512
ReadX 13928 19920 512 512
ReadX 13928 20432 512 512
ReadX 13928 20944 512 512
ReadX 13928 21456 512 512
ReadX 13928 21968 512 512
ReadX 13928 22480 512 512
ReadX 13928 22992 512 512
ReadX 13928 2998 512 512
ReadX 13928 3510 512 512
ReadX 13928 3001 512 512
ReadX 13928 3003 512 512
ReadX 13928 3515 512 512
ReadX 13928 4027 512 512
ReadX 13928 4539 512 512
ReadX 13928 5051 512 512
ReadX 13928 5563 512 512
ReadX 13928 6075 512 512
ReadX 13928 6587 512 512
ReadX 13928 7099 512 512
ReadX 13928 7611 512 512
ReadX 13928 8123 512 512
ReadX 13928 8635 512 512
ReadX 13928 3029 512 512
ReadX 13928 3541 512 512
ReadX 13928 4053 512 512
ReadX 13928 4565 512 512
ReadX 13928 5077 512 512
ReadX 13928 5589 512 512
ReadX 13928 6101 512 512
ReadX 13928 6613 512 512
ReadX 13928 7125 512 512
ReadX 13928 7637 512 512
ReadX 13928 8149 512 512
ReadX 13928 8661 512 512
ReadX 13928 9173 512 512
ReadX 13928 9685 512 512
ReadX 13928 10197 512 512
ReadX 13928 10709 512 512
ReadX 13928 11221 512 512
ReadX 13928 11733 512 512
ReadX 13928 12245 512 512
ReadX 13928 12757 512 512
ReadX 13928 13269 40 40
ReadX 13928 3076 472 472
ReadX 13928 3548 512 512
ReadX 13928 4060 512 512
ReadX 13928 4572 512 512
ReadX 13928 5084 512 512
ReadX 13928 5596 512 512
ReadX 13928 6108 512 512
ReadX 13928 6620 512 512
ReadX 13928 7132 512 512
ReadX 13928 7644 512 512
ReadX 13928 8156 512 512
ReadX 13928 8668 512 512
ReadX 13928 9180 512 512
ReadX 13928 9692 512 512
ReadX 13928 10204 512 512
ReadX 13928 10716 512 512
ReadX 13928 11228 512 512
ReadX 13928 11740 512 512
ReadX 13928 12252 512 512
ReadX 13928 12764 512 512
ReadX 13928 13276 310 310
ReadX 13928 3001 512 512
ReadX 13928 2562 512 512
ReadX 13928 2626 512 512
ReadX 13928 3003 512 512
ReadX 13928 2721 512 512
ReadX 13928 2626 512 512
ReadX 13928 3138 512 512
ReadX 13928 3650 512 512
ReadX 13928 4162 512 512
ReadX 13928 4674 512 512
ReadX 13928 5186 512 512
ReadX 13928 5698 512 512
ReadX 13928 6210 424 424
ReadX 13928 2612 88 88
ReadX 13928 2700 512 512
ReadX 13928 3212 512 512
ReadX 13928 3724 512 512
ReadX 13928 4236 512 512
ReadX 13928 4748 512 512
ReadX 13928 5260 512 512
ReadX 13928 5772 424 424
ReadX 13928 2642 88 88
ReadX 13928 2730 512 512
ReadX 13928 3242 512 512
ReadX 13928 3754 512 512
ReadX 13928 4266 512 512
ReadX 13928 4778 512 512
ReadX 13928 5290 512 512
ReadX 13928 5802 512 512
ReadX 13928 6314 512 512
ReadX 13928 6826 512 512
ReadX 13928 7338 512 512
ReadX 13928 7850 512 512
ReadX 13928 8362 512 512
ReadX 13928 8874 512 512
ReadX 13928 9386 512 512
ReadX 13928 9898 512 512
ReadX 13928 10410 512 512
ReadX 13928 10922 512 512
ReadX 13928 11434 512 512
ReadX 13928 11946 512 512
ReadX 13928 12458 512 512
ReadX 13928 2716 512 512
ReadX 13928 2717 512 512
ReadX 13928 2718 512 512
ReadX 13928 3230 512 512
ReadX 13928 2721 512 512
ReadX 13928 3233 512 512
ReadX 13928 3745 512 512
ReadX 13928 4257 512 512
ReadX 13928 4769 512 512
ReadX 13928 5281 512 512
ReadX 13928 5793 512 512
ReadX 13928 6305 512 512
ReadX 13928 6817 512 512
ReadX 13928 7329 512 512
ReadX 13928 7841 512 512
ReadX 13928 8353 512 512
ReadX 13928 8865 512 512
ReadX 13928 9377 512 512
ReadX 13928 9889 512 512
ReadX 13928 10401 512 512
ReadX 13928 10913 512 512
ReadX 13928 11425 512 512
ReadX 13928 11937 512 512
ReadX 13928 12449 512 512
ReadX 13928 12961 512 512
ReadX 13928 13473 512 512
ReadX 13928 13985 106 106
ReadX 13928 2820 406 406
ReadX 13928 3226 512 512
ReadX 13928 3738 512 512
ReadX 13928 4250 512 512
ReadX 13928 4762 512 512
ReadX 13928 5274 512 512
ReadX 13928 5786 512 512
ReadX 13928 6298 512 512
ReadX 13928 6810 512 512
ReadX 13928 7322 512 512
ReadX 13928 7834 512 512
ReadX 13928 8346 512 512
ReadX 13928 8858 512 512
ReadX 13928 9370 512 512
ReadX 13928 9882 512 512
ReadX 13928 10394 512 512
ReadX 13928 10906 512 512
ReadX 13928 11418 182 182
ReadX 13928 2717 512 512
ReadX 13928 258 512 512
ReadX 13928 470 512 512
ReadX 13928 376 512 512
ReadX 13928 888 512 512
ReadX 13928 1400 512 512
ReadX 13928 1912 512 512
ReadX 13928 2424 512 512
ReadX 13928 2936 512 512
ReadX 13928 3448 512 512
ReadX 13928 3960 424 424
ReadX 13928 362 88 88
ReadX 13928 450 512 512
ReadX 13928 962 512 512
ReadX 13928 1474 512 512
ReadX 13928 1986 512 512
ReadX 13928 2498 512 512
ReadX 13928 3010 512 512
ReadX 13928 3522 424 424
ReadX 13928 392 88 88
ReadX 13928 480 512 512
ReadX 13928 992 512 512
ReadX 13928 1504 512 512
ReadX 13928 2016 512 512
ReadX 13928 2528 512 512
ReadX 13928 3040 512 512
ReadX 13928 3552 512 512
ReadX 13928 4064 512 512
ReadX 13928 4576 512 512
ReadX 13928 5088 512 512
ReadX 13928 5600 512 512
ReadX 13928 6112 512 512
ReadX 13928 6624 512 512
ReadX 13928 7136 512 512
ReadX 13928 7648 512 512
ReadX 13928 8160 512 512
ReadX 13928 8672 512 512
ReadX 13928 9184 512 512
ReadX 13928 9696 512 512
ReadX 13928 10208 512 512
ReadX 13928 464 512 512
ReadX 13928 465 512 512
ReadX 13928 466 512 512
ReadX 13928 978 512 512
ReadX 13928 470 512 512
ReadX 13928 982 512 512
ReadX 13928 1494 512 512
ReadX 13928 2006 512 512
ReadX 13928 2518 512 512
ReadX 13928 3030 512 512
ReadX 13928 3542 512 512
ReadX 13928 4054 512 512
ReadX 13928 4566 512 512
ReadX 13928 5078 512 512
ReadX 13928 5590 512 512
ReadX 13928 6102 512 512
ReadX 13928 6614 512 512
ReadX 13928 7126 512 512
ReadX 13928 7638 512 512
ReadX 13928 8150 512 512
ReadX 13928 8662 512 512
ReadX 13928 9174 512 512
ReadX 13928 9686 512 512
ReadX 13928 10198 512 512
ReadX 13928 10710 333 333
ReadX 13928 11043 512 512
ReadX 13928 11555 179 179
ReadX 13928 11734 512 512
ReadX 13928 12246 512 512
ReadX 13928 12758 512 512
ReadX 13928 13270 512 512
ReadX 13928 13782 512 512
ReadX 13928 14294 512 512
ReadX 13928 14806 512 512
ReadX 13928 15318 512 512
ReadX 13928 15830 512 512
ReadX 13928 16342 512 512
ReadX 13928 16854 512 512
ReadX 13928 17366 512 512
ReadX 13928 17878 512 512
ReadX 13928 18390 512 512
ReadX 13928 18902 512 512
ReadX 13928 19414 512 512
ReadX 13928 19926 512 512
ReadX 13928 20438 512 512
ReadX 13928 20950 512 512
ReadX 13928 21462 512 512
ReadX 13928 21974 350 350
ReadX 13928 465 512 512
ReadX 13928 3812 512 512
ReadX 13928 4046 512 512
ReadX 13928 3828 512 512
ReadX 13928 256 512 512
ReadX 13928 260 512 512
ReadX 13928 4066 512 512
ReadX 13928 4578 512 512
ReadX 13928 5090 512 512
ReadX 13928 5602 512 512
ReadX 13928 6114 512 512
ReadX 13928 6626 512 512
ReadX 13928 7138 512 512
ReadX 13928 7650 394 394
ReadX 13928 4052 118 118
ReadX 13928 4170 512 512
ReadX 13928 4682 512 512
ReadX 13928 5194 512 512
ReadX 13928 5706 512 512
ReadX 13928 6218 512 512
ReadX 13928 6730 512 512
ReadX 13928 7242 394 394
ReadX 13928 4082 118 118
ReadX 13928 4200 512 512
ReadX 13928 4712 512 512
ReadX 13928 5224 512 512
ReadX 13928 5736 512 512
ReadX 13928 6248 512 512
ReadX 13928 6760 512 512
ReadX 13928 7272 512 512
ReadX 13928 7784 394 394
ReadX 13928 256 118 118
ReadX 13928 374 512 512
ReadX 13928 886 512 512
ReadX 13928 1398 512 512
ReadX 13928 1910 512 512
ReadX 13928 2422 512 512
ReadX 13928 2934 512 512
ReadX 13928 3446 512 512
ReadX 13928 3958 512 512
ReadX 13928 4470 512 512
ReadX 13928 4982 512 512
ReadX 13928 5494 512 512
ReadX 13928 6006 512 512
ReadX 13928 6518 512 512
ReadX 13928 7030 512 512
ReadX 13928 7542 512 512
ReadX 13928 8054 512 512
ReadX 13928 8566 512 512
ReadX 13928 9078 512 512
ReadX 13928 9590 512 512
ReadX 13928 10102 512 512
ReadX 13928 259 512 512
ReadX 13928 771 512 512
ReadX 13928 259 512 512
ReadX 13928 259 512 512
ReadX 13928 771 512 512
ReadX 13928 1283 512 512
ReadX 13928 1795 512 512
ReadX 13928 2307 512 512
ReadX 13928 2819 512 512
ReadX 13928 3331 512 512
ReadX 13928 3843 512 512
ReadX 13928 4355 512 512
ReadX 13928 4867 512 512
ReadX 13928 260 512 512
ReadX 13928 772 512 512
ReadX 13928 1284 512 512
ReadX 13928 1796 512 512
ReadX 13928 2308 512 512
ReadX 13928 2820 512 512
ReadX 13928 3332 512 512
ReadX 13928 3844 512 512
ReadX 13928 4356 512 512
ReadX 13928 4868 512 512
ReadX 13928 5380 512 512
ReadX 13928 5892 512 512
ReadX 13928 6404 512 512
ReadX 13928 6916 512 512
ReadX 13928 7428 512 512
ReadX 13928 7940 512 512
ReadX 13928 8452 512 512
ReadX 13928 8964 512 512
ReadX 13928 9476 512 512
ReadX 13928 9988 512 512
ReadX 13928 10500 378 378
ReadX 13928 10878 512 512
ReadX 13928 11390 134 134
ReadX 13928 11524 512 512
ReadX 13928 12036 512 512
ReadX 13928 12548 512 512
ReadX 13928 13060 512 512
ReadX 13928 13572 138 138
ReadX 13928 259 512 512
ReadX 13928 273 512 512
ReadX 13928 276 512 512
ReadX 13928 295 512 512
ReadX 13928 288 512 512
ReadX 13928 296 512 512
ReadX 13928 259 512 512
ReadX 13928 273 512 512
ReadX 13928 273 512 512
ReadX 13928 785 512 512
ReadX 13928 1297 512 512
ReadX 13928 1809 512 512
ReadX 13928 2321 512 512
ReadX 13928 274 512 512
ReadX 13928 274 512 512
ReadX 13928 274 497 497
ReadX 13928 272 15 15
ReadX 13928 287 512 512
ReadX 13928 799 512 512
ReadX 13928 273 512 512
ReadX 13928 785 512 512
ReadX 13928 1297 512 512
ReadX 13928 1809 512 512
ReadX 13928 2321 512 512
ReadX 13928 2833 317 317
ReadX 13928 274 195 195
ReadX 13928 469 512 512
ReadX 13928 981 512 512
ReadX 13928 1493 512 512
ReadX 13928 2005 512 512
ReadX 13928 2517 512 512
ReadX 13928 3029 512 512
ReadX 13928 3541 512 512
ReadX 13928 4053 512 512
ReadX 13928 4565 250 250
ReadX 13928 274 512 512
ReadX 13928 283 512 512
ReadX 13928 795 512 512
ReadX 13928 276 512 512
ReadX 13928 788 512 512
ReadX 13928 1300 512 512
ReadX 13928 1812 512 512
ReadX 13928 2324 512 512
ReadX 13928 2836 512 512
ReadX 13928 3348 512 512
ReadX 13928 3860 420 420
ReadX 13928 275 92 92
ReadX 13928 367 512 512
ReadX 13928 879 512 512
ReadX 13928 1391 512 512
ReadX 13928 1903 512 512
ReadX 13928 2415 512 512
ReadX 13928 2927 512 512
ReadX 13928 3439 420 420
ReadX 13928 277 92 92
ReadX 13928 369 512 512
ReadX 13928 881 512 512
ReadX 13928 1393 512 512
ReadX 13928 1905 512 512
ReadX 13928 2417 512 512
ReadX 13928 2929 512 512
ReadX 13928 3441 512 512
ReadX 13928 3953 512 512
ReadX 13928 4465 512 512
ReadX 13928 4977 512 512
ReadX 13928 5489 512 512
ReadX 13928 6001 512 512
ReadX 13928 6513 512 512
ReadX 13928 7025 512 512
ReadX 13928 7537 512 512
ReadX 13928 8049 512 512
ReadX 13928 8561 512 512
ReadX 13928 9073 512 512
ReadX 13928 9585 512 512
ReadX 13928 10097 512 512
ReadX 13928 282 512 512
ReadX 13928 794 512 512
ReadX 13928 1306 512 512
ReadX 13928 1818 512 512
ReadX 13928 2330 512 512
ReadX 13928 2842 512 512
ReadX 13928 3354 512 512
ReadX 13928 3866 512 512
ReadX 13928 4378 512 512
ReadX 13928 284 512 512
ReadX 13928 796 512 512
ReadX 13928 1308 512 512
ReadX 13928 1820 512 512
ReadX 13928 2332 512 512
ReadX 13928 2844 512 512
ReadX 13928 3356 512 512
ReadX 13928 3868 512 512
ReadX 13928 4380 512 512
ReadX 13928 4892 512 512
ReadX 13928 5404 512 512
ReadX 13928 5916 512 512
ReadX 13928 6428 512 512
ReadX 13928 6940 512 512
ReadX 13928 7452 512 512
ReadX 13928 7964 512 512
ReadX 13928 8476 512 512
ReadX 13928 8988 512 512
ReadX 13928 9500 512 512
ReadX 13928 10012 512 512
ReadX 13928 10524 472 472
ReadX 13928 288 40 40
ReadX 13928 328 512 512
ReadX 13928 840 512 512
ReadX 13928 1352 512 512
ReadX 13928 1864 512 512
ReadX 13928 2376 512 512
ReadX 13928 2888 512 512
ReadX 13928 3400 512 512
ReadX 13928 3912 512 512
ReadX 13928 4424 512 512
ReadX 13928 4936 512 512
ReadX 13928 5448 512 512
ReadX 13928 5960 512 512
ReadX 13928 6472 512 512
ReadX 13928 6984 512 512
ReadX 13928 7496 512 512
ReadX 13928 8008 512 512
ReadX 13928 8520 512 512
ReadX 13928 9032 512 512
ReadX 13928 9544 512 512
ReadX 13928 10056 512 512
ReadX 13928 10568 506 506
ReadX 13928 282 512 512
ReadX 13928 794 512 512
ReadX 13928 301 512 512
ReadX 13928 296 512 512
ReadX 13928 808 512 512
ReadX 13928 1320 512 512
ReadX 13928 1832 512 512
ReadX 13928 2344 512 512
ReadX 13928 2856 512 512
ReadX 13928 3368 512 512
ReadX 13928 3880 424 424
ReadX 13928 295 88 88
ReadX 13928 383 512 512
ReadX 13928 895 512 512
ReadX 13928 1407 512 512
ReadX 13928 1919 512 512
ReadX 13928 2431 512 512
ReadX 13928 2943 512 512
ReadX 13928 3455 424 424
ReadX 13928 297 88 88
ReadX 13928 385 512 512
ReadX 13928 897 512 512
ReadX 13928 1409 512 512
ReadX 13928 1921 512 512
ReadX 13928 2433 512 512
ReadX 13928 2945 512 512
ReadX 13928 3457 512 512
ReadX 13928 3969 512 512
ReadX 13928 4481 512 512
ReadX 13928 4993 512 512
ReadX 13928 5505 512 512
ReadX 13928 6017 512 512
ReadX 13928 6529 512 512
ReadX 13928 7041 512 512
ReadX 13928 7553 512 512
ReadX 13928 8065 512 512
ReadX 13928 8577 512 512
ReadX 13928 9089 512 512
ReadX 13928 9601 512 512
ReadX 13928 10113 512 512
ReadX 13928 301 512 512
ReadX 13928 301 512 512
ReadX 13928 301 512 512
ReadX 13928 813 512 512
ReadX 13928 301 512 512
ReadX 13928 813 512 512
ReadX 13928 1325 512 512
ReadX 13928 1837 512 512
ReadX 13928 2349 512 512
ReadX 13928 2861 512 512
ReadX 13928 3373 512 512
ReadX 13928 3885 512 512
ReadX 13928 4397 512 512
ReadX 13928 4909 512 512
ReadX 13928 5421 512 512
ReadX 13928 5933 512 512
ReadX 13928 6445 512 512
ReadX 13928 6957 512 512
ReadX 13928 7469 512 512
ReadX 13928 7981 512 512
ReadX 13928 8493 512 512
ReadX 13928 9005 512 512
ReadX 13928 9517 463 463
ReadX 13928 9980 512 512
ReadX 13928 10492 49 49
ReadX 13928 10541 512 512
ReadX 13928 11053 512 512
ReadX 13928 11565 512 512
ReadX 13928 12077 512 512
ReadX 13928 12589 512 512
ReadX 13928 13101 512 512
ReadX 13928 13613 512 512
ReadX 13928 14125 512 512
ReadX 13928 14637 512 512
ReadX 13928 15149 512 512
ReadX 13928 15661 512 512
ReadX 13928 16173 512 512
ReadX 13928 16685 512 512
ReadX 13928 17197 512 512
ReadX 13928 17709 512 512
ReadX 13928 18221 512 512
ReadX 13928 18733 512 512
ReadX 13928 19245 512 512
ReadX 13928 19757 512 512
ReadX 13928 20269 512 512
ReadX 13928 20781 326 326
ReadX 13928 301 512 512
QUERY_FS_INFORMATION 259
Close 13926
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13929
Close 13929
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13930
ReadX 13930 0 24 24
Close 13930
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13931
QUERY_FILE_INFORMATION 13931
ReadX 13931 0 512 512
ReadX 13931 476 512 512
ReadX 13931 510 512 512
ReadX 13931 484 512 512
ReadX 13931 474 512 512
ReadX 13931 478 512 512
ReadX 13931 990 512 512
ReadX 13931 509 57 57
Close 13931
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13932
QUERY_FILE_INFORMATION 13932
ReadX 13932 0 512 512
ReadX 13932 476 512 512
ReadX 13932 510 512 512
ReadX 13932 484 512 512
ReadX 13932 480 512 512
ReadX 13932 474 512 512
ReadX 13932 478 512 512
QUERY_FILE_INFORMATION 13932
WriteX 13932 494 60 60
WriteX 13932 494 4 4
QUERY_FILE_INFORMATION 13932
WriteX 13932 494 11 11
WriteX 13932 510 512 512
WriteX 13932 484 512 512
WriteX 13932 474 512 512
WriteX 13932 478 512 512
WriteX 13932 990 512 512
Close 13932
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13933
Close 13933
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13934
Close 13934
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13936
WriteX 13936 4607 1 1
QUERY_FILE_INFORMATION 13936
WriteX 13936 0 65471 65471
WriteX 13936 65471 65 65
WriteX 13936 65536 19490 19490
Close 13936
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13937
QUERY_FILE_INFORMATION 13937
ReadX 13937 0 512 512
ReadX 13937 482 512 512
ReadX 13937 994 512 512
ReadX 13937 1506 512 512
ReadX 13937 480 512 512
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 490 448 448
QUERY_FILE_INFORMATION 13937
WriteX 13937 490 60 60
WriteX 13937 490 4 4
QUERY_FILE_INFORMATION 13937
WriteX 13937 490 11 11
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 484 512 512
WriteX 13937 996 512 512
WriteX 13937 1508 512 512
WriteX 13937 482 512 512
WriteX 13937 0 512 512
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
ReadX 13937 490 512 512
WriteX 13937 502 512 512
WriteX 13937 502 292 292
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 503 20 20
WriteX 13937 503 108 108
QUERY_FILE_INFORMATION 13937
WriteX 13937 504 448 448
QUERY_FILE_INFORMATION 13937
WriteX 13937 504 44 44
WriteX 13937 504 20 20
WriteX 13937 500 512 512
WriteX 13937 492 512 512
WriteX 13937 496 512 512
WriteX 13937 1008 512 512
WriteX 13937 494 512 512
Flush 13937
WriteX 13937 0 512 512
Flush 13937
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 500 512 512
WriteX 13937 492 512 512
WriteX 13937 496 512 512
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 518 320 320
QUERY_FILE_INFORMATION 13937
WriteX 13937 518 60 60
ReadX 13937 504 512 512
WriteX 13937 522 512 512
WriteX 13937 506 3204 3204
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 519 25 25
WriteX 13937 518 103 103
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 519 44 44
WriteX 13937 519 20 20
WriteX 13937 520 512 512
WriteX 13937 482 512 512
WriteX 13937 486 512 512
WriteX 13937 998 512 512
WriteX 13937 484 512 512
WriteX 13937 490 512 512
Flush 13937
WriteX 13937 0 512 512
Flush 13937
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
QUERY_FILE_INFORMATION 13937
WriteX 13937 519 7 7
WriteX 13937 519 57 57
WriteX 13937 520 512 512
WriteX 13937 492 512 512
WriteX 13937 482 512 512
WriteX 13937 486 512 512
WriteX 13937 998 512 512
Flush 13937
WriteX 13937 520 512 512
Flush 13937
Close 13937
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13938
Close 13938
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13939
QUERY_FILE_INFORMATION 13939
ReadX 13939 0 512 512
ReadX 13939 490 512 512
ReadX 13939 484 512 512
ReadX 13939 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13940
Close 13940
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13939
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13941
Close 13941
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13942
ReadX 13942 0 24 24
Close 13942
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13943
QUERY_FILE_INFORMATION 13943
ReadX 13943 0 512 512
ReadX 13943 366 512 512
ReadX 13943 878 512 512
ReadX 13943 1390 512 512
ReadX 13943 1902 512 512
ReadX 13943 374 57 57
Close 13943
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13944
QUERY_FILE_INFORMATION 13944
ReadX 13944 0 512 512
ReadX 13944 366 512 512
ReadX 13944 878 512 512
ReadX 13944 1390 512 512
ReadX 13944 1902 512 512
QUERY_FILE_INFORMATION 13944
WriteX 13944 374 60 60
WriteX 13944 374 4 4
QUERY_FILE_INFORMATION 13944
WriteX 13944 374 11 11
ReadX 13944 374 57 57
ReadX 13944 374 57 57
ReadX 13944 292 4096 4096
ReadX 13944 364 512 512
ReadX 13944 512 4096 4096
ReadX 13944 4608 4096 4096
ReadX 13944 8704 4096 4096
ReadX 13944 12800 4096 4096
ReadX 13944 16896 4096 4096
ReadX 13944 20992 4096 4096
ReadX 13944 25088 4096 4096
ReadX 13944 29184 4096 4096
ReadX 13944 33280 4096 4096
ReadX 13944 37376 4096 4096
ReadX 13944 41472 4096 4096
ReadX 13944 45568 4096 4096
ReadX 13944 49664 4096 4096
ReadX 13944 53760 4096 4096
ReadX 13944 57856 4096 4096
ReadX 13944 61952 4096 4096
ReadX 13944 66048 4096 4096
ReadX 13944 70144 4096 4096
ReadX 13944 74240 162 162
ReadX 13944 308 4096 4096
ReadX 13944 4404 4096 4096
WriteX 13944 368 512 512
WriteX 13944 880 512 512
WriteX 13944 1392 512 512
Close 13944
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13945
Close 13945
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13946
QUERY_FILE_INFORMATION 13946
ReadX 13946 0 512 512
ReadX 13946 366 512 512
ReadX 13946 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13947
Close 13947
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13946
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13949
WriteX 13949 4607 1 1
QUERY_FILE_INFORMATION 13949
WriteX 13949 0 65471 65471
WriteX 13949 65471 65 65
WriteX 13949 65536 8866 8866
Close 13949
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13950
QUERY_FILE_INFORMATION 13950
ReadX 13950 0 512 512
ReadX 13950 366 512 512
ReadX 13950 878 512 512
ReadX 13950 1390 512 512
ReadX 13950 364 512 512
QUERY_FILE_INFORMATION 13950
QUERY_FILE_INFORMATION 13950
QUERY_FILE_INFORMATION 13950
WriteX 13950 374 448 448
QUERY_FILE_INFORMATION 13950
WriteX 13950 374 60 60
WriteX 13950 374 4 4
QUERY_FILE_INFORMATION 13950
WriteX 13950 374 11 11
QUERY_FILE_INFORMATION 13950
QUERY_FILE_INFORMATION 13950
WriteX 13950 374 7 7
WriteX 13950 374 57 57
WriteX 13950 368 512 512
WriteX 13950 880 512 512
WriteX 13950 1392 512 512
WriteX 13950 366 512 512
WriteX 13950 0 512 512
Flush 13950
WriteX 13950 368 512 512
Flush 13950
Close 13950
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13951
QUERY_FILE_INFORMATION 13951
ReadX 13951 0 512 512
ReadX 13951 366 512 512
ReadX 13951 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13951
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13952
Close 13952
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13953
ReadX 13953 0 24 24
Close 13953
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13954
QUERY_FILE_INFORMATION 13954
ReadX 13954 0 512 512
ReadX 13954 366 512 512
ReadX 13954 878 512 512
ReadX 13954 1390 512 512
ReadX 13954 1902 512 512
ReadX 13954 374 57 57
Close 13954
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13955
QUERY_FILE_INFORMATION 13955
ReadX 13955 0 512 512
ReadX 13955 366 512 512
ReadX 13955 878 512 512
ReadX 13955 1390 512 512
ReadX 13955 1902 512 512
QUERY_FILE_INFORMATION 13955
WriteX 13955 374 60 60
WriteX 13955 374 4 4
QUERY_FILE_INFORMATION 13955
WriteX 13955 374 11 11
WriteX 13955 368 512 512
WriteX 13955 880 512 512
WriteX 13955 1392 512 512
Close 13955
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13956
Close 13956
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13957
Close 13957
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13959
WriteX 13959 4607 1 1
QUERY_FILE_INFORMATION 13959
WriteX 13959 0 65471 65471
WriteX 13959 65471 65 65
WriteX 13959 65536 9298 9298
Close 13959
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13960
QUERY_FILE_INFORMATION 13960
ReadX 13960 0 512 512
ReadX 13960 368 512 512
ReadX 13960 880 512 512
ReadX 13960 1392 512 512
ReadX 13960 366 512 512
QUERY_FILE_INFORMATION 13960
QUERY_FILE_INFORMATION 13960
QUERY_FILE_INFORMATION 13960
WriteX 13960 376 448 448
QUERY_FILE_INFORMATION 13960
WriteX 13960 376 60 60
WriteX 13960 376 4 4
QUERY_FILE_INFORMATION 13960
WriteX 13960 376 11 11
QUERY_FILE_INFORMATION 13960
QUERY_FILE_INFORMATION 13960
WriteX 13960 376 7 7
WriteX 13960 376 57 57
WriteX 13960 370 512 512
WriteX 13960 882 512 512
WriteX 13960 1394 512 512
WriteX 13960 368 512 512
WriteX 13960 0 512 512
Flush 13960
WriteX 13960 370 512 512
Flush 13960
Close 13960
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13961
Close 13961
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13962
QUERY_FILE_INFORMATION 13962
ReadX 13962 0 512 512
ReadX 13962 368 512 512
ReadX 13962 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13963
Close 13963
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13965
Close 13965
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13966
ReadX 13966 0 24 24
Close 13966
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13967
QUERY_FILE_INFORMATION 13967
ReadX 13967 0 512 512
ReadX 13967 512 512 512
ReadX 13967 1024 512 512
ReadX 13967 2016 512 512
ReadX 13967 1056 512 512
ReadX 13967 1096 57 57
Close 13967
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13968
QUERY_FILE_INFORMATION 13968
ReadX 13968 0 512 512
ReadX 13968 512 512 512
ReadX 13968 1024 512 512
ReadX 13968 2016 512 512
ReadX 13968 1056 512 512
ReadX 13968 1096 57 57
ReadX 13968 1096 57 57
ReadX 13968 1088 62 62
ReadX 13968 1536 4096 4096
ReadX 13968 5632 4096 4096
ReadX 13968 9728 4096 4096
ReadX 13968 13824 2859 2859
ReadX 13968 1120 28 28
ReadX 13968 1148 20 20
ReadX 13968 1168 8 8
ReadX 13968 1176 88 88
ReadX 13968 1264 8 8
ReadX 13968 1272 4 4
ReadX 13968 1276 4 4
ReadX 13968 1280 1 1
ReadX 13968 1130 4 4
ReadX 13968 1134 4 4
ReadX 13968 1138 1 1
ReadX 13968 1131 4 4
ReadX 13968 1135 4 4
ReadX 13968 1139 1 1
ReadX 13968 1131 4 4
ReadX 13968 1135 4 4
ReadX 13968 1139 2 2
ReadX 13968 1132 4 4
ReadX 13968 1136 4 4
ReadX 13968 1140 25 25
ReadX 13968 1134 4 4
ReadX 13968 1138 8 8
ReadX 13968 1146 4 4
ReadX 13968 1150 8 8
ReadX 13968 1158 4 4
ReadX 13968 1162 8 8
ReadX 13968 1170 4 4
ReadX 13968 1174 4 4
ReadX 13968 1178 4 4
ReadX 13968 1182 4 4
ReadX 13968 1186 4 4
ReadX 13968 1190 4 4
ReadX 13968 1194 13900 13900
ReadX 13968 2048 4096 4096
Close 13968
QUERY_FS_INFORMATION 259
Close 13962
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13969
Close 13969
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13970
ReadX 13970 0 24 24
Close 13970
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13971
QUERY_FILE_INFORMATION 13971
ReadX 13971 0 512 512
ReadX 13971 368 512 512
ReadX 13971 880 512 512
ReadX 13971 1392 512 512
ReadX 13971 1904 512 512
ReadX 13971 376 57 57
Close 13971
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13972
QUERY_FILE_INFORMATION 13972
ReadX 13972 0 512 512
ReadX 13972 368 512 512
ReadX 13972 880 512 512
ReadX 13972 1392 512 512
ReadX 13972 1904 512 512
QUERY_FILE_INFORMATION 13972
WriteX 13972 376 60 60
WriteX 13972 376 4 4
QUERY_FILE_INFORMATION 13972
WriteX 13972 376 11 11
WriteX 13972 370 512 512
WriteX 13972 882 512 512
WriteX 13972 1394 512 512
Close 13972
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13973
Close 13973
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13974
Close 13974
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13976
WriteX 13976 4607 1 1
QUERY_FILE_INFORMATION 13976
WriteX 13976 0 65471 65471
WriteX 13976 65471 65 65
WriteX 13976 65536 11540 11540
Close 13976
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13977
QUERY_FILE_INFORMATION 13977
ReadX 13977 0 512 512
ReadX 13977 398 512 512
ReadX 13977 910 512 512
ReadX 13977 1422 512 512
ReadX 13977 396 512 512
QUERY_FILE_INFORMATION 13977
QUERY_FILE_INFORMATION 13977
QUERY_FILE_INFORMATION 13977
WriteX 13977 406 448 448
QUERY_FILE_INFORMATION 13977
WriteX 13977 406 60 60
WriteX 13977 406 4 4
QUERY_FILE_INFORMATION 13977
WriteX 13977 406 11 11
QUERY_FILE_INFORMATION 13977
QUERY_FILE_INFORMATION 13977
WriteX 13977 406 7 7
WriteX 13977 406 57 57
WriteX 13977 400 512 512
WriteX 13977 912 512 512
WriteX 13977 1424 512 512
WriteX 13977 398 512 512
WriteX 13977 0 512 512
Flush 13977
WriteX 13977 400 512 512
Flush 13977
Close 13977
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13978
Close 13978
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13979
QUERY_FILE_INFORMATION 13979
ReadX 13979 0 512 512
ReadX 13979 398 512 512
ReadX 13979 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13980
Close 13980
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13979
ReadX 13928 1434 512 512
Close 13928
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13981
WriteX 13981 0 65471 65471
WriteX 13981 65471 63 63
WriteX 13981 65534 65471 65471
WriteX 13981 131005 63 63
Close 13981
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13982
WriteX 13982 0 65471 65471
WriteX 13982 65471 63 63
WriteX 13982 65534 65471 65471
WriteX 13982 131005 63 63
WriteX 13982 131068 65471 65471
WriteX 13982 196539 63 63
WriteX 13982 196602 65471 65471
WriteX 13982 262073 63 63
Close 13982
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13983
WriteX 13983 0 65471 65471
WriteX 13983 65471 63 63
WriteX 13983 65534 65471 65471
WriteX 13983 131005 63 63
WriteX 13983 131068 65471 65471
WriteX 13983 196539 63 63
WriteX 13983 196602 65471 65471
WriteX 13983 262073 63 63
WriteX 13983 262136 65471 65471
WriteX 13983 327607 63 63
WriteX 13983 327670 65471 65471
WriteX 13983 393141 63 63
WriteX 13983 393204 65471 65471
WriteX 13983 458675 63 63
WriteX 13983 458738 65471 65471
WriteX 13983 524209 63 63
Close 13983
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13984
Close 13984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13985
ReadX 13985 0 512 512
ReadX 13985 512 511 511
ReadX 13985 1023 512 512
ReadX 13985 1535 512 512
Close 13985
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13986
ReadX 13986 0 512 512
ReadX 13986 512 510 510
ReadX 13986 1022 512 512
ReadX 13986 1534 510 510
ReadX 13986 2044 510 510
Close 13986
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13987
ReadX 13987 0 512 512
ReadX 13987 512 512 512
ReadX 13987 1024 512 512
ReadX 13987 1536 512 512
ReadX 13987 2048 512 512
ReadX 13987 2560 512 512
ReadX 13987 3072 512 512
ReadX 13987 3584 512 512
ReadX 13987 4096 512 512
ReadX 13987 4608 512 512
ReadX 13987 5120 512 512
ReadX 13987 5632 512 512
ReadX 13987 6144 512 512
ReadX 13987 6656 512 512
ReadX 13987 7168 512 512
ReadX 13987 7680 512 512
ReadX 13987 8192 512 512
ReadX 13987 8704 512 512
Close 13987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13988
Close 13988
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13989
QUERY_FILE_INFORMATION 13989
Close 13989
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13990
ReadX 13990 0 8192 8192
Close 13990
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13991
Close 13991
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13992
QUERY_FILE_INFORMATION 13992
Close 13992
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13993
ReadX 13993 0 8192 8192
Close 13993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13994
Close 13994
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13995
QUERY_FILE_INFORMATION 13995
Close 13995
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13996
ReadX 13996 0 8192 8192
Close 13996
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13997
ReadX 13997 0 8192 8192
ReadX 13997 8192 8192 8192
ReadX 13997 16384 8192 8192
ReadX 13997 24576 8192 8192
Close 13997
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13999
Close 13999
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14001
WriteX 14001 8191 1 1
QUERY_FILE_INFORMATION 14001
WriteX 14001 0 10438 10438
Close 14001
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14002
Close 14002
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14003
QUERY_FILE_INFORMATION 14003
QUERY_FILE_INFORMATION 14003
Close 14003
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14004
QUERY_FILE_INFORMATION 14004
QUERY_FILE_INFORMATION 14004
Close 14004
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14005
Close 14005
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14006
QUERY_FILE_INFORMATION 14006
QUERY_FILE_INFORMATION 14006
Close 14006
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14007
QUERY_FILE_INFORMATION 14007
QUERY_FILE_INFORMATION 14007
Close 14007
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14008
Close 14008
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14009
QUERY_FILE_INFORMATION 14009
QUERY_FILE_INFORMATION 14009
Close 14009
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14010
QUERY_FILE_INFORMATION 14010
QUERY_FILE_INFORMATION 14010
Close 14010
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14011
Close 14011
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14012
QUERY_FILE_INFORMATION 14012
QUERY_FILE_INFORMATION 14012
Close 14012
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14013
ReadX 14013 0 8 8
ReadX 14013 8 4 4
ReadX 14013 12 8 8
ReadX 14013 22 8 8
ReadX 14013 520 8 8
ReadX 14013 525 8 8
ReadX 14013 533 4 4
ReadX 14013 543 8 8
ReadX 14013 551 4 4
ReadX 14013 1058 8 8
ReadX 14013 1066 4 4
ReadX 14013 1081 8 8
ReadX 14013 1089 4 4
ReadX 14013 660 8 8
Close 14013
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14014
ReadX 14014 0 8192 8192
Close 14014
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14015
ReadX 14015 0 8192 8192
ReadX 14015 520 8192 8192
ReadX 14015 8712 8192 8192
ReadX 14015 16904 8192 8192
ReadX 14015 25096 8192 8192
ReadX 14015 33288 8192 8192
ReadX 14015 41480 8192 8192
ReadX 14015 49672 8192 8192
ReadX 14015 57864 8192 8192
ReadX 14015 66056 8192 8192
ReadX 14015 74248 8192 8192
ReadX 14015 82440 8192 8192
ReadX 14015 90632 8192 8192
ReadX 14015 98824 8192 8192
ReadX 14015 107016 8192 8192
ReadX 14015 115208 8192 8192
ReadX 14015 123400 8192 8192
ReadX 14015 131592 8192 8192
ReadX 14015 139784 8192 8192
ReadX 14015 147976 8192 8192
ReadX 14015 156168 8192 8192
Close 14015
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14016
QUERY_FILE_INFORMATION 14016
Close 14016
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14017
Close 14017
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14019
WriteX 14019 8191 1 1
QUERY_FILE_INFORMATION 14019
WriteX 14019 0 28489 28489
Close 14019
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14020
Close 14020
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14021
Close 14021
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14022
QUERY_FILE_INFORMATION 14022
Close 14022
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14023
ReadX 14023 0 8192 8192
Close 14023
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14024
Close 14024
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14025
QUERY_FILE_INFORMATION 14025
Close 14025
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14026
ReadX 14026 0 8192 8192
Close 14026
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14027
ReadX 14027 0 8192 8192
ReadX 14027 8192 8192 8192
ReadX 14027 16384 8192 8192
ReadX 14027 24576 8192 8192
ReadX 14027 32768 16384 16384
ReadX 14027 49152 8192 8192
ReadX 14027 57344 8192 8192
ReadX 14027 65536 8192 8192
Close 14027
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14029
Close 14029
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14031
WriteX 14031 8191 1 1
QUERY_FILE_INFORMATION 14031
WriteX 14031 0 29253 29253
Close 14031
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14032
Close 14032
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14033
QUERY_FILE_INFORMATION 14033
QUERY_FILE_INFORMATION 14033
Close 14033
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14034
QUERY_FILE_INFORMATION 14034
QUERY_FILE_INFORMATION 14034
Close 14034
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14035
QUERY_FILE_INFORMATION 14035
Close 14035
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14036
Close 14036
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14038
WriteX 14038 8191 1 1
QUERY_FILE_INFORMATION 14038
WriteX 14038 0 30183 30183
Close 14038
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14039
Close 14039
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 14040
WriteX 14040 0 510 510
WriteX 14040 510 512 512
WriteX 14040 1022 510 510
WriteX 14040 1532 510 510
WriteX 14040 2042 168 168
Close 14040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14041
Close 14041
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 14042
WriteX 14042 0 511 511
WriteX 14042 511 512 512
WriteX 14042 1023 512 512
WriteX 14042 1535 488 488
Close 14042
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14043
ReadX 14043 0 65471 65471
ReadX 14043 65471 63 63
ReadX 14043 65534 65471 65471
ReadX 14043 131005 63 63
ReadX 14043 131068 65471 65471
ReadX 14043 196539 63 63
ReadX 14043 196602 65471 65471
ReadX 14043 262073 63 63
ReadX 14043 262136 65471 65471
ReadX 14043 327607 63 63
ReadX 14043 327670 10 10
Close 14043
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14044
ReadX 14044 0 65471 65471
ReadX 14044 65471 63 63
ReadX 14044 65534 65471 65471
ReadX 14044 131005 63 63
ReadX 14044 131068 65471 65471
ReadX 14044 196539 63 63
ReadX 14044 196602 65471 65471
ReadX 14044 262073 63 63
ReadX 14044 262136 65471 65471
ReadX 14044 327607 63 63
ReadX 14044 327670 65471 65471
ReadX 14044 393141 63 63
ReadX 14044 393204 65471 65471
ReadX 14044 458675 63 63
ReadX 14044 458738 65471 65471
ReadX 14044 524209 63 63
ReadX 14044 524272 65471 65471
ReadX 14044 589743 63 63
ReadX 14044 589806 65471 65471
ReadX 14044 655277 63 63
ReadX 14044 655340 32 32
Close 14044
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14045
ReadX 14045 0 65471 65471
ReadX 14045 65471 63 63
ReadX 14045 65534 65471 65471
ReadX 14045 131005 63 63
ReadX 14045 131068 65471 65471
ReadX 14045 196539 63 63
ReadX 14045 196602 65471 65471
ReadX 14045 262073 63 63
ReadX 14045 262136 65471 65471
ReadX 14045 327607 63 63
ReadX 14045 327670 65471 65471
ReadX 14045 393141 63 63
ReadX 14045 393204 65471 65471
ReadX 14045 458675 63 63
ReadX 14045 458738 65471 65471
ReadX 14045 524209 63 63
ReadX 14045 524272 65471 65471
ReadX 14045 589743 63 63
ReadX 14045 589806 65471 65471
ReadX 14045 655277 63 63
ReadX 14045 655340 65471 65471
ReadX 14045 720811 63 63
ReadX 14045 720874 65471 65471
ReadX 14045 786345 63 63
ReadX 14045 786408 65471 65471
ReadX 14045 851879 63 63
ReadX 14045 851942 65471 65471
ReadX 14045 917413 63 63
ReadX 14045 917476 65471 65471
ReadX 14045 982947 63 63
ReadX 14045 983010 65471 65471
ReadX 14045 1048481 63 63
ReadX 14045 1048544 65471 65471
ReadX 14045 1114015 63 63
ReadX 14045 1114078 65471 65471
ReadX 14045 1179549 63 63
ReadX 14045 1179612 65471 65471
ReadX 14045 1245083 63 63
ReadX 14045 1245146 65471 65471
ReadX 14045 1310617 63 63
ReadX 14045 1310680 65471 65471
ReadX 14045 1376151 63 63
ReadX 14045 1376214 65471 65471
ReadX 14045 1441685 63 63
ReadX 14045 1441748 65471 65471
ReadX 14045 1507219 63 63
ReadX 14045 1507282 65471 65471
ReadX 14045 1572753 63 63
ReadX 14045 1572816 65471 65471
ReadX 14045 1638287 63 63
ReadX 14045 1638350 65471 65471
ReadX 14045 1703821 63 63
ReadX 14045 1703884 65471 65471
ReadX 14045 1769355 63 63
ReadX 14045 1769418 65471 65471
ReadX 14045 1834889 63 63
ReadX 14045 1834952 32824 32824
Close 14045
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14046
QUERY_FILE_INFORMATION 14046
ReadX 14046 0 512 512
ReadX 14046 512 512 512
ReadX 14046 1024 512 512
QUERY_FILE_INFORMATION 14046
QUERY_FILE_INFORMATION 14046
ReadX 14046 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 14046
QUERY_FILE_INFORMATION 14046
ReadX 14046 512 4096 4096
QUERY_FILE_INFORMATION 14046
QUERY_FILE_INFORMATION 14046
QUERY_FILE_INFORMATION 14046
WriteX 14046 512 4096 4096
WriteX 14046 1024 512 512
ReadX 14046 502 512 512
QUERY_FILE_INFORMATION 14046
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14046 2560 512 512
ReadX 14046 1536 512 512
ReadX 14046 2176 384 384
ReadX 14046 3072 128 128
ReadX 14046 3107 512 512
ReadX 14046 3619 512 512
ReadX 14046 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14046 286 123 123
ReadX 14046 292 24 24
ReadX 14046 512 2048 2048
ReadX 14046 512 2048 2048
ReadX 14046 2560 2048 2048
ReadX 14046 416 1536 1536
ReadX 14046 768 512 512
ReadX 14046 1280 2048 2048
ReadX 14046 3328 2048 2048
ReadX 14046 5376 2048 2048
ReadX 14046 7424 2048 2048
ReadX 14046 9472 2048 2048
ReadX 14046 11520 2048 2048
ReadX 14046 13568 2048 2048
ReadX 14046 15616 2048 2048
ReadX 14046 17664 2048 2048
ReadX 14046 19712 2048 2048
ReadX 14046 21760 2048 2048
ReadX 14046 23808 2048 2048
ReadX 14046 25856 2048 2048
ReadX 14046 27904 2048 2048
ReadX 14046 29952 2048 2048
ReadX 14046 32000 2048 2048
ReadX 14046 34048 2048 2048
ReadX 14046 36096 2048 2048
ReadX 14046 38144 2048 2048
ReadX 14046 40192 2048 2048
ReadX 14046 42240 512 512
ReadX 14046 42752 2048 2048
ReadX 14046 44800 2048 2048
ReadX 14046 46848 2048 2048
ReadX 14046 48896 2048 2048
ReadX 14046 50944 2048 2048
ReadX 14046 52992 2048 2048
ReadX 14046 55040 2048 2048
ReadX 14046 57088 2048 2048
ReadX 14046 316 2048 2048
ReadX 14046 2364 2048 2048
ReadX 14046 4412 2048 2048
ReadX 14046 6460 2048 2048
ReadX 14046 8508 2048 2048
ReadX 14046 10556 2048 2048
ReadX 14046 12604 2048 2048
ReadX 14046 14652 2048 2048
ReadX 14046 16700 2048 2048
ReadX 14046 18748 2048 2048
ReadX 14046 20796 2048 2048
ReadX 14046 22844 2048 2048
ReadX 14046 24892 2048 2048
ReadX 14046 26940 2048 2048
ReadX 14046 28988 2048 2048
ReadX 14046 31036 2048 2048
ReadX 14046 436 2048 2048
ReadX 14046 2484 2048 2048
ReadX 14046 4532 2048 2048
ReadX 14046 6580 2048 2048
ReadX 14046 8628 2048 2048
ReadX 14046 10676 2048 2048
ReadX 14046 476 2048 2048
ReadX 14046 476 2048 2048
ReadX 14046 476 2048 2048
ReadX 14046 2524 2048 2048
ReadX 14046 484 2048 2048
ReadX 14046 484 2048 2048
ReadX 14046 484 2048 2048
ReadX 14046 2532 665 665
ReadX 14046 492 665 665
ReadX 14046 492 665 665
ReadX 14046 492 665 665
ReadX 14046 296 512 512
ReadX 14046 318 512 512
ReadX 14046 300 512 512
ReadX 14046 312 512 512
ReadX 14046 320 512 512
ReadX 14046 832 354 354
ReadX 14046 504 4096 4096
ReadX 14046 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 14047
Close 14047
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 14048
WriteX 14048 1535 1 1
QUERY_FILE_INFORMATION 14048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14046 296 1251 1251
ReadX 14046 2176 384 384
ReadX 14046 3072 1634 1634
QUERY_FILE_INFORMATION 14048
WriteX 14048 0 57088 57088
WriteX 14048 0 4096 4096
Flush 14048
Close 14046
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14049
Close 14049
WriteX 14048 0 4096 4096
Close 14048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 14050
Close 14050
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14051
QUERY_FILE_INFORMATION 14051
ReadX 14051 0 512 512
ReadX 14051 512 512 512
ReadX 14051 1024 512 512
QUERY_FILE_INFORMATION 14051
QUERY_FILE_INFORMATION 14051
ReadX 14051 512 2048 2048
QUERY_FILE_INFORMATION 14051
QUERY_FILE_INFORMATION 14051
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14051 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 14052
WriteX 14052 1535 1 1
QUERY_FILE_INFORMATION 14052
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14051 1536 512 512
ReadX 14051 288 1251 1251
ReadX 14051 2048 2018 2018
QUERY_FILE_INFORMATION 14052
WriteX 14052 0 51456 51456
WriteX 14052 0 4096 4096
Flush 14052
QUERY_FILE_INFORMATION 14051
QUERY_FILE_INFORMATION 14051
Close 14051
WriteX 14052 0 4096 4096
Close 14052
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 14053
Close 14053
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14054
QUERY_FILE_INFORMATION 14054
ReadX 14054 0 512 512
ReadX 14054 512 512 512
ReadX 14054 1024 512 512
QUERY_FILE_INFORMATION 14054
QUERY_FILE_INFORMATION 14054
ReadX 14054 512 2048 2048
QUERY_FILE_INFORMATION 14054
QUERY_FILE_INFORMATION 14054
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14054 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14056
Close 14056
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14058
WriteX 14058 4045 1 1
QUERY_FILE_INFORMATION 14058
WriteX 14058 0 53077 53077
Close 14058
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 14059
WriteX 14059 1535 1 1
QUERY_FILE_INFORMATION 14059
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14054 1536 512 512
ReadX 14054 288 1251 1251
ReadX 14054 2048 2018 2018
QUERY_FILE_INFORMATION 14059
WriteX 14059 0 65471 65471
WriteX 14059 65471 65 65
WriteX 14059 65536 1856 1856
WriteX 14059 0 4096 4096
Flush 14059
QUERY_FILE_INFORMATION 14054
QUERY_FILE_INFORMATION 14054
Close 14054
WriteX 14059 0 4096 4096
Close 14059
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 14060
Close 14060
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14061
QUERY_FILE_INFORMATION 14061
ReadX 14061 0 512 512
ReadX 14061 512 512 512
ReadX 14061 1024 512 512
QUERY_FILE_INFORMATION 14061
QUERY_FILE_INFORMATION 14061
ReadX 14061 576 2048 2048
QUERY_FILE_INFORMATION 14061
QUERY_FILE_INFORMATION 14061
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14063
Close 14063
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14065
WriteX 14065 4076 1 1
QUERY_FILE_INFORMATION 14065
WriteX 14065 0 7983 7983
Close 14065
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14067
Close 14067
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14069
WriteX 14069 4095 1 1
QUERY_FILE_INFORMATION 14069
WriteX 14069 0 65471 65471
WriteX 14069 65471 65 65
WriteX 14069 65536 65471 65471
WriteX 14069 131007 65 65
WriteX 14069 131072 65471 65471
WriteX 14069 196543 65 65
WriteX 14069 196608 65471 65471
WriteX 14069 262079 65 65
WriteX 14069 262144 65471 65471
WriteX 14069 327615 65 65
WriteX 14069 327680 65471 65471
WriteX 14069 393151 65 65
WriteX 14069 393216 65471 65471
WriteX 14069 458687 65 65
WriteX 14069 458752 46731 46731
Close 14069
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 14070
WriteX 14070 1535 1 1
QUERY_FILE_INFORMATION 14070
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14061 1536 512 512
ReadX 14061 2048 2018 2018
ReadX 14061 4096 512 512
ReadX 14061 4608 2197 2197
QUERY_FILE_INFORMATION 14070
WriteX 14070 0 65471 65471
WriteX 14070 65471 65 65
WriteX 14070 65536 22848 22848
WriteX 14070 0 4096 4096
Flush 14070
QUERY_FILE_INFORMATION 14061
QUERY_FILE_INFORMATION 14061
Close 14061
WriteX 14070 0 4096 4096
Close 14070
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 14071
Close 14071
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14072
QUERY_FILE_INFORMATION 14072
ReadX 14072 0 512 512
ReadX 14072 512 512 512
ReadX 14072 1024 512 512
QUERY_FILE_INFORMATION 14072
QUERY_FILE_INFORMATION 14072
ReadX 14072 576 2048 2048
QUERY_FILE_INFORMATION 14072
QUERY_FILE_INFORMATION 14072
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14072 4096 512 512
Close 14072
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14073
QUERY_FILE_INFORMATION 14073
ReadX 14073 0 512 512
ReadX 14073 512 512 512
ReadX 14073 1024 512 512
QUERY_FILE_INFORMATION 14073
QUERY_FILE_INFORMATION 14073
ReadX 14073 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 14073
QUERY_FILE_INFORMATION 14073
ReadX 14073 288 4096 4096
QUERY_FILE_INFORMATION 14073
QUERY_FILE_INFORMATION 14073
QUERY_FILE_INFORMATION 14073
WriteX 14073 288 4096 4096
WriteX 14073 1024 512 512
ReadX 14073 1536 512 512
QUERY_FILE_INFORMATION 14073
ReadX 14073 288 2048 2048
ReadX 14073 2336 2048 2048
ReadX 14073 3072 1536 1536
ReadX 14073 544 512 512
ReadX 14073 1056 2048 2048
ReadX 14073 3104 2048 2048
ReadX 14073 5152 2048 2048
ReadX 14073 7200 2048 2048
ReadX 14073 9248 2048 2048
ReadX 14073 11296 2048 2048
ReadX 14073 13344 2048 2048
ReadX 14073 15392 2048 2048
ReadX 14073 17440 2048 2048
ReadX 14073 19488 2048 2048
ReadX 14073 21536 2048 2048
ReadX 14073 23584 2048 2048
ReadX 14073 25632 2048 2048
ReadX 14073 27680 2048 2048
ReadX 14073 29728 2048 2048
ReadX 14073 31776 2048 2048
ReadX 14073 33824 2048 2048
ReadX 14073 35872 2048 2048
ReadX 14073 37920 2048 2048
ReadX 14073 39968 2048 2048
ReadX 14073 42016 512 512
ReadX 14073 42528 512 512
ReadX 14073 43040 1536 1536
ReadX 14073 44576 2048 2048
ReadX 14073 46624 2048 2048
ReadX 14073 48672 2048 2048
ReadX 14073 50720 2048 2048
ReadX 14073 52768 2048 2048
ReadX 14073 54816 2048 2048
ReadX 14073 56864 2048 2048
ReadX 14073 58912 2048 2048
ReadX 14073 60960 2048 2048
ReadX 14073 63008 2048 2048
ReadX 14073 65056 2048 2048
ReadX 14073 67104 2048 2048
ReadX 14073 69152 2048 2048
ReadX 14073 71200 2048 2048
ReadX 14073 73248 2048 2048
ReadX 14073 75296 2048 2048
ReadX 14073 77344 2048 2048
ReadX 14073 79392 2048 2048
ReadX 14073 81440 2048 2048
ReadX 14073 83488 2048 2048
ReadX 14073 85536 512 512
ReadX 14073 86048 512 512
ReadX 14073 86560 1536 1536
ReadX 14073 88096 2048 2048
ReadX 14073 90144 2048 2048
ReadX 14073 92192 2048 2048
ReadX 14073 94240 2048 2048
ReadX 14073 96288 2048 2048
ReadX 14073 552 2048 2048
ReadX 14073 2600 2048 2048
ReadX 14073 4648 2048 2048
ReadX 14073 6696 2048 2048
ReadX 14073 8744 2048 2048
ReadX 14073 10792 2048 2048
ReadX 14073 12840 2048 2048
ReadX 14073 14888 2048 2048
ReadX 14073 16936 2048 2048
ReadX 14073 18984 2048 2048
ReadX 14073 21032 2048 2048
ReadX 14073 23080 2048 2048
ReadX 14073 25128 2048 2048
ReadX 14073 27176 2048 2048
ReadX 14073 29224 2048 2048
ReadX 14073 31272 2048 2048
ReadX 14073 33320 2048 2048
ReadX 14073 35368 2048 2048
ReadX 14073 37416 2048 2048
ReadX 14073 39464 2048 2048
ReadX 14073 41512 512 512
ReadX 14073 42024 512 512
ReadX 14073 42536 1536 1536
ReadX 14073 44072 2048 2048
ReadX 14073 46120 2048 2048
ReadX 14073 48168 2048 2048
ReadX 14073 50216 2048 2048
ReadX 14073 52264 2048 2048
ReadX 14073 54312 2048 2048
ReadX 14073 56360 2048 2048
ReadX 14073 58408 2048 2048
ReadX 14073 60456 2048 2048
ReadX 14073 62504 2048 2048
ReadX 14073 64552 2048 2048
ReadX 14073 66600 2048 2048
ReadX 14073 68648 2048 2048
ReadX 14073 70696 2048 2048
ReadX 14073 72744 2048 2048
ReadX 14073 74792 2048 2048
ReadX 14073 76840 2048 2048
ReadX 14073 78888 2048 2048
ReadX 14073 80936 2048 2048
ReadX 14073 82984 2048 2048
ReadX 14073 85032 512 512
ReadX 14073 85544 2048 2048
ReadX 14073 87592 2048 2048
ReadX 14073 89640 2048 2048
ReadX 14073 91688 2048 2048
ReadX 14073 93736 2048 2048
ReadX 14073 95784 2048 2048
ReadX 14073 97832 2048 2048
ReadX 14073 99880 2048 2048
ReadX 14073 101928 2048 2048
ReadX 14073 103976 2048 2048
ReadX 14073 106024 2048 2048
ReadX 14073 108072 2048 2048
ReadX 14073 110120 2048 2048
ReadX 14073 112168 2048 2048
ReadX 14073 114216 2048 2048
ReadX 14073 116264 2048 2048
ReadX 14073 118312 2048 2048
ReadX 14073 120360 2048 2048
ReadX 14073 122408 2048 2048
ReadX 14073 124456 512 512
ReadX 14073 124968 512 512
ReadX 14073 125480 1536 1536
ReadX 14073 127016 2048 2048
ReadX 14073 129064 2048 2048
ReadX 14073 131112 2048 2048
ReadX 14073 133160 2048 2048
ReadX 14073 135208 2048 2048
ReadX 14073 137256 2048 2048
ReadX 14073 139304 2048 2048
ReadX 14073 141352 2048 2048
ReadX 14073 143400 2048 2048
ReadX 14073 145448 2048 2048
ReadX 14073 147496 2048 2048
ReadX 14073 149544 2048 2048
ReadX 14073 151592 2048 2048
ReadX 14073 153640 2048 2048
ReadX 14073 155688 2048 2048
ReadX 14073 157736 2048 2048
ReadX 14073 159784 2048 2048
ReadX 14073 161832 2048 2048
ReadX 14073 163880 2048 2048
ReadX 14073 165928 2048 2048
ReadX 14073 167976 2048 2048
ReadX 14073 170024 512 512
ReadX 14073 1538 1536 1536
ReadX 14073 3074 2048 2048
ReadX 14073 5122 2048 2048
ReadX 14073 7170 2048 2048
ReadX 14073 9218 2048 2048
ReadX 14073 11266 2048 2048
ReadX 14073 13314 2048 2048
ReadX 14073 15362 2048 2048
ReadX 14073 17410 2048 2048
ReadX 14073 19458 2048 2048
ReadX 14073 21506 2048 2048
ReadX 14073 23554 2048 2048
ReadX 14073 25602 2048 2048
ReadX 14073 27650 2048 2048
ReadX 14073 29698 2048 2048
ReadX 14073 31746 2048 2048
ReadX 14073 33794 2048 2048
ReadX 14073 35842 2048 2048
ReadX 14073 37890 2048 2048
ReadX 14073 39938 2048 2048
ReadX 14073 41986 2048 2048
ReadX 14073 44034 875 875
ReadX 14073 1730 4096 4096
ReadX 14073 1724 1536 1536
ReadX 14073 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14074
Close 14074
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14075
WriteX 14075 2047 1 1
QUERY_FILE_INFORMATION 14075
Close 14073
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14076
Close 14076
WriteX 14075 0 42388 42388
Close 14075
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14077
Close 14077
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14078
QUERY_FILE_INFORMATION 14078
ReadX 14078 0 512 512
ReadX 14078 1756 512 512
ReadX 14078 2268 512 512
QUERY_FILE_INFORMATION 14078
QUERY_FILE_INFORMATION 14078
ReadX 14078 1744 512 512
ReadX 14078 2256 512 512
ReadX 14078 2768 512 512
ReadX 14078 3280 512 512
ReadX 14078 3792 512 512
ReadX 14078 4304 512 512
ReadX 14078 512 2048 2048
QUERY_FILE_INFORMATION 14078
QUERY_FILE_INFORMATION 14078
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14079
WriteX 14079 2047 1 1
QUERY_FILE_INFORMATION 14079
QUERY_FILE_INFORMATION 14078
QUERY_FILE_INFORMATION 14078
Close 14078
WriteX 14079 0 42652 42652
Close 14079
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 14080
Close 14080
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14081
QUERY_FILE_INFORMATION 14081
ReadX 14081 0 512 512
ReadX 14081 1762 512 512
ReadX 14081 2274 512 512
QUERY_FILE_INFORMATION 14081
QUERY_FILE_INFORMATION 14081
ReadX 14081 1750 512 512
ReadX 14081 2262 512 512
ReadX 14081 2774 512 512
ReadX 14081 3286 512 512
ReadX 14081 3798 512 512
ReadX 14081 4310 512 512
ReadX 14081 512 2048 2048
QUERY_FILE_INFORMATION 14081
QUERY_FILE_INFORMATION 14081
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14083
Close 14083
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14085
WriteX 14085 4080 1 1
QUERY_FILE_INFORMATION 14085
WriteX 14085 0 65471 65471
WriteX 14085 65471 65 65
WriteX 14085 65536 49 49
Close 14085
Close 14081
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14086
WriteX 14086 0 65471 65471
WriteX 14086 65471 63 63
WriteX 14086 65534 65471 65471
WriteX 14086 131005 63 63
Close 14086
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14087
WriteX 14087 0 65471 65471
WriteX 14087 65471 63 63
WriteX 14087 65534 65471 65471
WriteX 14087 131005 63 63
WriteX 14087 131068 65471 65471
WriteX 14087 196539 63 63
WriteX 14087 196602 65471 65471
WriteX 14087 262073 63 63
Close 14087
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14088
WriteX 14088 0 65471 65471
WriteX 14088 65471 63 63
WriteX 14088 65534 65471 65471
WriteX 14088 131005 63 63
WriteX 14088 131068 65471 65471
WriteX 14088 196539 63 63
WriteX 14088 196602 65471 65471
WriteX 14088 262073 63 63
WriteX 14088 262136 65471 65471
WriteX 14088 327607 63 63
WriteX 14088 327670 65471 65471
WriteX 14088 393141 63 63
WriteX 14088 393204 65471 65471
WriteX 14088 458675 63 63
WriteX 14088 458738 65471 65471
WriteX 14088 524209 63 63
Close 14088
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14089
Close 14089
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14090
Close 14090
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14093
Close 14093
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 14095
Close 14095
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 12327
Close 12327
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12330
Close 12330
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12332
Close 12332
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12333
Close 12333
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12336
Close 12336
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12340
Close 12340
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12344
Close 12344
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12348
Close 12348
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12352
Close 12352
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12356
Close 12356
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12360
Close 12360
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12364
Close 12364
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12366
Close 12366
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12368
Close 12368
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12370
WriteX 12370 4095 1 1
QUERY_FILE_INFORMATION 12370
QUERY_FS_INFORMATION 259
WriteX 12370 0 65471 65471
WriteX 12370 65471 65 65
WriteX 12370 65536 65471 65471
WriteX 12370 131007 65 65
WriteX 12370 131072 65471 65471
WriteX 12370 196543 65 65
WriteX 12370 196608 65471 65471
WriteX 12370 262079 65 65
WriteX 12370 262144 26634 26634
Close 12370
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12375
QUERY_FILE_INFORMATION 12375
QUERY_FILE_INFORMATION 12375
Close 12375
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12376
Close 12376
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12377
Close 12377
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12378
QUERY_FILE_INFORMATION 12378
ReadX 12378 0 512 512
ReadX 12378 288 512 512
ReadX 12378 800 512 512
Close 12378
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12379
ReadX 12379 0 24 24
Close 12379
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12380
ReadX 12380 0 24 24
Close 12380
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 12381
QUERY_FILE_INFORMATION 12381
ReadX 12381 0 512 512
ReadX 12381 288 512 512
ReadX 12381 800 512 512
ReadX 12381 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12381 1759 2849 2849
Close 12381
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12382
Close 12382
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12385
Close 12385
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12387
Close 12387
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12388
Close 12388
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12391
Close 12391
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12393
Close 12393
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12394
Close 12394
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12397
Close 12397
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12401
Close 12401
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12405
Close 12405
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12409
Close 12409
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12413
Close 12413
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12417
Close 12417
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12420
Close 12420
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12424
Close 12424
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12428
Close 12428
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 12430
Close 12430
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 12431
Close 12431
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12440
QUERY_FILE_INFORMATION 12440
QUERY_FILE_INFORMATION 12440
Close 12440
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12441
Close 12441
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12442
Close 12442
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12443
QUERY_FILE_INFORMATION 12443
ReadX 12443 0 512 512
ReadX 12443 288 512 512
ReadX 12443 800 512 512
Close 12443
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12444
ReadX 12444 0 24 24
Close 12444
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12445
QUERY_FILE_INFORMATION 12445
ReadX 12445 0 512 512
ReadX 12445 288 512 512
ReadX 12445 800 512 512
ReadX 12445 512 36 36
Close 12445
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 12446
QUERY_FILE_INFORMATION 12446
ReadX 12446 0 512 512
ReadX 12446 288 512 512
ReadX 12446 800 512 512
ReadX 12446 512 682 682
ReadX 12446 3584 106 106
ReadX 12446 3712 10 10
ReadX 12446 3722 10 10
ReadX 12446 512 2048 2048
ReadX 12446 3072 512 512
ReadX 12446 276 84 84
ReadX 12446 273 49 49
ReadX 12446 2560 512 512
Close 12446
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12456
QUERY_FILE_INFORMATION 12456
QUERY_FILE_INFORMATION 12456
Close 12456
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12457
Close 12457
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12458
Close 12458
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12459
QUERY_FILE_INFORMATION 12459
ReadX 12459 0 512 512
ReadX 12459 288 512 512
ReadX 12459 800 512 512
Close 12459
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12460
ReadX 12460 0 24 24
Close 12460
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12461
QUERY_FILE_INFORMATION 12461
ReadX 12461 0 512 512
ReadX 12461 288 512 512
ReadX 12461 800 512 512
ReadX 12461 512 36 36
Close 12461
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 12462
QUERY_FILE_INFORMATION 12462
ReadX 12462 0 512 512
ReadX 12462 288 512 512
ReadX 12462 800 512 512
ReadX 12462 512 682 682
ReadX 12462 3072 106 106
ReadX 12462 3200 10 10
ReadX 12462 3210 10 10
ReadX 12462 512 2048 2048
ReadX 12462 2560 512 512
ReadX 12462 3887 84 84
ReadX 12462 3838 49 49
ReadX 12462 2048 512 512
Close 12462
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12463
Close 12463
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12464
QUERY_FILE_INFORMATION 12464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 12464
QUERY_FILE_INFORMATION 12464
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 12465
QUERY_FILE_INFORMATION 12465
QUERY_FILE_INFORMATION 12465
QUERY_FILE_INFORMATION 12465
ReadX 12465 2156 24 24
ReadX 12465 2139 276 276
ReadX 12465 2136 14 14
ReadX 12465 2136 7 7
ReadX 12465 2138 12 12
ReadX 12465 2137 8 8
ReadX 12465 2135 15 15
ReadX 12465 0 16 16
ReadX 12465 16 2048 2048
ReadX 12465 2064 2048 2048
ReadX 12465 257 2048 2048
ReadX 12465 385 2048 2048
ReadX 12465 513 2048 2048
ReadX 12465 641 2048 2048
ReadX 12465 769 2048 2048
ReadX 12465 897 2048 2048
ReadX 12465 1025 2048 2048
ReadX 12465 1153 2048 2048
ReadX 12465 1281 2048 2048
ReadX 12465 1409 2048 2048
ReadX 12465 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12467
Close 12467
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12469
WriteX 12469 15 1 1
QUERY_FILE_INFORMATION 12469
WriteX 12469 0 10575 10575
Flush 12469
Close 12469
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12470
Close 12470
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12471
QUERY_FILE_INFORMATION 12471
QUERY_FILE_INFORMATION 12471
QUERY_FILE_INFORMATION 12471
ReadX 12471 2157 24 24
ReadX 12471 2139 276 276
ReadX 12471 2137 14 14
ReadX 12471 2137 7 7
ReadX 12471 2139 12 12
ReadX 12471 2138 8 8
ReadX 12471 2136 15 15
Close 12465
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12472
Close 12472
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12473
QUERY_FILE_INFORMATION 12473
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12474
QUERY_FILE_INFORMATION 12474
ReadX 12474 0 512 512
ReadX 12474 512 512 512
ReadX 12474 1024 512 512
QUERY_FILE_INFORMATION 12474
QUERY_FILE_INFORMATION 12474
Close 12474
QUERY_FILE_INFORMATION 12473
ReadX 12473 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 12475
QUERY_FILE_INFORMATION 12475
ReadX 12475 0 512 512
ReadX 12475 512 512 512
ReadX 12475 1024 512 512
ReadX 12475 288 20 20
ReadX 12475 308 2084 2084
ReadX 12475 388 2084 2084
ReadX 12475 388 2084 2084
ReadX 12464 2157 1386 1386
ReadX 12475 2472 399 399
ReadX 12475 3072 1536 1536
ReadX 12475 544 149 149
ReadX 12475 693 485 485
Close 12475
ReadX 12464 2157 4096 4096
ReadX 12464 6253 4096 4096
ReadX 12464 10349 4096 4096
ReadX 12464 14445 4096 4096
ReadX 12464 18541 4096 4096
ReadX 12464 22637 256 256
ReadX 12464 22893 4096 4096
ReadX 12464 26989 4096 4096
ReadX 12464 31085 4096 4096
ReadX 12464 35181 4096 4096
ReadX 12464 39277 4096 4096
ReadX 12464 43373 4096 4096
ReadX 12464 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12464 2157 1024 1024
ReadX 12464 1667 4688 4688
ReadX 12464 6355 3516 3516
ReadX 12464 9871 16384 16384
ReadX 12464 26255 3771 3771
ReadX 12464 30026 2048 2048
ReadX 12464 32074 1024 1024
ReadX 12464 33098 6652 6652
ReadX 12464 39750 16384 16384
ReadX 12464 56134 10496 10496
ReadX 12464 66630 1784 1784
ReadX 12464 68414 90 90
ReadX 12464 68504 273 273
ReadX 12464 68777 1600 1600
ReadX 12464 70377 640 640
ReadX 12464 71017 1280 1280
ReadX 12464 72297 8464 8464
ReadX 12464 80761 158 158
ReadX 12464 80919 912 912
ReadX 12464 81831 1980 1980
ReadX 12464 83811 2256 2256
ReadX 12464 86067 400 400
ReadX 12464 86467 252 252
ReadX 12464 86719 42 42
ReadX 12464 86761 725 725
ReadX 12464 2009 512 512
ReadX 12464 3895 9 9
ReadX 12464 3781 46 46
ReadX 12464 4059 92 92
ReadX 12464 3781 92 92
ReadX 12464 3986 184 184
ReadX 12464 3987 16384 16384
ReadX 12464 3902 16384 16384
ReadX 12464 3781 10240 10240
ReadX 12464 3821 16384 16384
ReadX 12464 3891 935 935
ReadX 12464 4060 10240 10240
ReadX 12464 4059 184 184
ReadX 12464 256 184 184
ReadX 12464 256 1026 1026
ReadX 12464 3901 326 326
ReadX 12464 3899 652 652
ReadX 12464 256 2 2
ReadX 12464 258 4948 4948
Close 12464
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12477
Close 12477
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12479
WriteX 12479 4055 1 1
QUERY_FILE_INFORMATION 12479
WriteX 12479 0 65471 65471
WriteX 12479 65471 65 65
WriteX 12479 65536 65471 65471
WriteX 12479 131007 65 65
WriteX 12479 131072 65471 65471
WriteX 12479 196543 65 65
WriteX 12479 196608 65471 65471
WriteX 12479 262079 65 65
WriteX 12479 262144 65471 65471
WriteX 12479 327615 65 65
WriteX 12479 327680 65471 65471
WriteX 12479 393151 65 65
WriteX 12479 393216 65471 65471
WriteX 12479 458687 65 65
WriteX 12479 458752 65471 65471
WriteX 12479 524223 65 65
WriteX 12479 524288 65471 65471
WriteX 12479 589759 65 65
WriteX 12479 589824 35257 35257
Close 12479
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12481
Close 12481
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12483
WriteX 12483 4055 1 1
QUERY_FILE_INFORMATION 12483
WriteX 12483 0 65471 65471
WriteX 12483 65471 65 65
WriteX 12483 65536 65471 65471
WriteX 12483 131007 65 65
WriteX 12483 131072 65471 65471
WriteX 12483 196543 65 65
WriteX 12483 196608 65471 65471
WriteX 12483 262079 65 65
WriteX 12483 262144 65471 65471
WriteX 12483 327615 65 65
WriteX 12483 327680 65471 65471
WriteX 12483 393151 65 65
WriteX 12483 393216 65471 65471
WriteX 12483 458687 65 65
WriteX 12483 458752 65471 65471
WriteX 12483 524223 65 65
WriteX 12483 524288 65471 65471
WriteX 12483 589759 65 65
WriteX 12483 589824 57598 57598
Close 12483
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12485
WriteX 12485 15 1 1
QUERY_FILE_INFORMATION 12485
WriteX 12485 0 12543 12543
Flush 12485
Close 12485
Close 12471
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12486
Close 12486
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 12487
QUERY_FILE_INFORMATION 12487
QUERY_FILE_INFORMATION 12487
QUERY_FILE_INFORMATION 12487
ReadX 12487 288 24 24
ReadX 12487 287 276 276
ReadX 12487 286 14 14
ReadX 12487 286 7 7
ReadX 12487 287 12 12
ReadX 12487 287 8 8
ReadX 12487 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12488
Close 12488
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12489
QUERY_FILE_INFORMATION 12489
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 12489
QUERY_FILE_INFORMATION 12489
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 12490
QUERY_FILE_INFORMATION 12490
QUERY_FILE_INFORMATION 12490
QUERY_FILE_INFORMATION 12490
ReadX 12490 1938 24 24
ReadX 12490 1920 276 276
ReadX 12490 1918 14 14
ReadX 12490 1918 7 7
ReadX 12490 1919 12 12
ReadX 12490 1919 8 8
ReadX 12490 1917 15 15
ReadX 12490 0 16 16
ReadX 12490 16 2048 2048
ReadX 12490 2064 2048 2048
ReadX 12490 257 2048 2048
ReadX 12490 385 2048 2048
ReadX 12490 513 2048 2048
ReadX 12490 641 2048 2048
ReadX 12490 769 2048 2048
ReadX 12490 897 2048 2048
ReadX 12490 1025 2048 2048
ReadX 12490 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12492
Close 12492
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12494
WriteX 12494 15 1 1
QUERY_FILE_INFORMATION 12494
WriteX 12494 0 11588 11588
Flush 12494
Close 12494
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12495
Close 12495
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12496
QUERY_FILE_INFORMATION 12496
QUERY_FILE_INFORMATION 12496
QUERY_FILE_INFORMATION 12496
ReadX 12496 1909 24 24
ReadX 12496 1892 276 276
ReadX 12496 1889 14 14
ReadX 12496 1889 7 7
ReadX 12496 1891 12 12
ReadX 12496 1890 8 8
ReadX 12496 1888 15 15
Close 12490
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12498
WriteX 12498 15 1 1
QUERY_FILE_INFORMATION 12498
WriteX 12498 0 11615 11615
Flush 12498
Close 12498
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12496
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12499
Close 12499
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12500
QUERY_FILE_INFORMATION 12500
QUERY_FILE_INFORMATION 12500
QUERY_FILE_INFORMATION 12500
ReadX 12500 1947 24 24
ReadX 12500 1929 276 276
ReadX 12500 1927 14 14
ReadX 12500 1927 7 7
ReadX 12500 1929 12 12
ReadX 12500 1928 8 8
ReadX 12500 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12502
Close 12502
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12504
WriteX 12504 4088 1 1
QUERY_FILE_INFORMATION 12504
WriteX 12504 0 4089 4089
WriteX 12504 0 65471 65471
WriteX 12504 65471 65 65
WriteX 12504 65536 16050 16050
Close 12504
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12489 1939 64 64
ReadX 12489 128 248 248
ReadX 12489 128 568 568
ReadX 12489 3872 1536 1536
ReadX 12489 3456 2560 2560
ReadX 12489 3136 512 512
ReadX 12489 2880 4096 4096
ReadX 12489 3264 3072 3072
ReadX 12489 320 4096 4096
ReadX 12489 1024 4096 4096
ReadX 12489 3616 4096 4096
ReadX 12489 1939 64 64
ReadX 12489 128 248 248
ReadX 12489 128 608 608
ReadX 12489 2858 1024 1024
ReadX 12489 2810 4096 4096
ReadX 12489 2826 4096 4096
ReadX 12489 2580 2048 2048
ReadX 12489 2800 2560 2560
ReadX 12489 2100 4096 4096
ReadX 12489 2084 4096 4096
ReadX 12489 868 4096 4096
ReadX 12489 2324 4096 4096
ReadX 12489 884 4096 4096
ReadX 12489 2604 1024 1024
ReadX 12489 580 4096 4096
ReadX 12489 596 4096 4096
ReadX 12489 2752 4096 4096
ReadX 12489 2842 1024 1024
ReadX 12489 660 4096 4096
ReadX 12489 2720 4096 4096
ReadX 12489 2736 4096 4096
ReadX 12489 628 4096 4096
ReadX 12489 2704 4096 4096
ReadX 12489 1556 4096 4096
ReadX 12489 576 4096 4096
ReadX 12489 3168 1536 1536
ReadX 12489 832 4096 4096
ReadX 12489 1088 4096 4096
ReadX 12489 1344 4096 4096
ReadX 12489 1600 4096 4096
ReadX 12489 1856 4096 4096
ReadX 12489 2112 4096 4096
ReadX 12489 1892 4096 4096
ReadX 12489 820 4096 4096
ReadX 12489 788 4096 4096
ReadX 12489 1604 4096 4096
ReadX 12489 3648 4096 4096
ReadX 12489 2608 4096 4096
ReadX 12489 548 4096 4096
ReadX 12489 740 4096 4096
ReadX 12489 1344 4096 4096
ReadX 12489 3392 4096 4096
ReadX 12489 3904 4096 4096
ReadX 12489 644 4096 4096
ReadX 12489 676 4096 4096
ReadX 12489 2688 4096 4096
ReadX 12489 320 4096 4096
ReadX 12489 900 4096 4096
ReadX 12489 1908 4096 4096
ReadX 12489 852 4096 4096
ReadX 12489 724 4096 4096
ReadX 12489 2292 4096 4096
ReadX 12489 612 4096 4096
ReadX 12489 388 4096 4096
ReadX 12489 2368 4096 4096
ReadX 12489 2624 4096 4096
ReadX 12489 500 4096 4096
ReadX 12489 356 4096 4096
ReadX 12489 1024 4096 4096
ReadX 12489 576 4096 4096
ReadX 12489 340 4096 4096
ReadX 12489 420 4096 4096
ReadX 12489 1600 4096 4096
ReadX 12489 404 4096 4096
ReadX 12489 1428 4096 4096
ReadX 12489 2656 4096 4096
ReadX 12489 2624 4096 4096
ReadX 12489 452 4096 4096
ReadX 12489 692 4096 4096
ReadX 12489 564 4096 4096
ReadX 12489 372 4096 4096
ReadX 12489 468 4096 4096
ReadX 12489 484 4096 4096
ReadX 12489 1088 4096 4096
ReadX 12489 1924 4096 4096
ReadX 12489 2768 4096 4096
ReadX 12489 832 4096 4096
ReadX 12489 836 4096 4096
ReadX 12489 1856 4096 4096
ReadX 12489 2640 4096 4096
ReadX 12489 436 4096 4096
ReadX 12489 1828 4096 4096
ReadX 12489 804 4096 4096
ReadX 12489 1860 4096 4096
ReadX 12489 1812 4096 4096
ReadX 12489 756 4096 4096
ReadX 12489 1636 4096 4096
ReadX 12489 772 4096 4096
ReadX 12489 2036 4096 4096
ReadX 12489 1220 4096 4096
ReadX 12489 1652 4096 4096
ReadX 12489 2588 4096 4096
ReadX 12489 916 4096 4096
ReadX 12489 260 4096 4096
ReadX 12489 932 4096 4096
ReadX 12489 2624 4096 4096
ReadX 12489 308 4096 4096
ReadX 12489 292 4096 4096
ReadX 12489 1140 4096 4096
ReadX 12489 276 4096 4096
ReadX 12489 2020 4096 4096
ReadX 12489 2880 4096 4096
ReadX 12489 516 4096 4096
ReadX 12489 1844 4096 4096
ReadX 12489 1124 4096 4096
ReadX 12489 3136 4096 4096
ReadX 12489 324 4096 4096
ReadX 12489 1156 4096 4096
ReadX 12489 1172 4096 4096
ReadX 12489 2112 4096 4096
ReadX 12489 2368 4096 4096
ReadX 12489 964 4096 4096
ReadX 12489 980 4096 4096
ReadX 12489 1012 4096 4096
ReadX 12489 532 4096 4096
ReadX 12489 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 12489 1620 4096 4096
ReadX 12489 1604 4096 4096
ReadX 12489 2116 4096 4096
ReadX 12489 2132 4096 4096
ReadX 12489 2148 4096 4096
ReadX 12489 2276 4096 4096
ReadX 12489 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12506
Close 12506
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12508
QUERY_FILE_INFORMATION 12473
WriteX 12508 4088 1 1
QUERY_FILE_INFORMATION 12508
QUERY_FILE_INFORMATION 12473
Close 12473
WriteX 12508 0 65471 65471
WriteX 12508 65471 65 65
WriteX 12508 65536 64850 64850
Close 12508
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12510
WriteX 12510 15 1 1
QUERY_FILE_INFORMATION 12510
ReadX 12489 2068 4096 4096
ReadX 12489 1588 4096 4096
ReadX 12489 1572 4096 4096
WriteX 12510 0 18630 18630
Flush 12510
Close 12510
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 12500
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12511
Close 12511
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 12512
QUERY_FILE_INFORMATION 12512
QUERY_FILE_INFORMATION 12512
QUERY_FILE_INFORMATION 12512
ReadX 12512 661 24 24
ReadX 12512 659 356 356
ReadX 12512 659 14 14
ReadX 12512 659 7 7
ReadX 12512 659 12 12
ReadX 12512 659 8 8
ReadX 12512 659 15 15
ReadX 12512 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 12489 612 4096 4096
ReadX 12489 564 4096 4096
ReadX 12489 1876 4096 4096
ReadX 12489 628 4096 4096
ReadX 12489 740 4096 4096
ReadX 12489 724 4096 4096
ReadX 12489 644 4096 4096
ReadX 12489 2324 4096 4096
ReadX 12489 660 4096 4096
ReadX 12489 852 4096 4096
ReadX 12489 868 4096 4096
Close 12512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 12487
ReadX 12489 2368 4096 4096
ReadX 12489 1024 4096 4096
ReadX 12489 320 4096 4096
ReadX 12489 580 4096 4096
ReadX 12489 3136 512 512
ReadX 12489 2880 4096 4096
Close 12489
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12513
WriteX 12513 0 65471 65471
WriteX 12513 65471 63 63
WriteX 12513 65534 65471 65471
WriteX 12513 131005 63 63
Close 12513
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12514
WriteX 12514 0 65471 65471
WriteX 12514 65471 63 63
WriteX 12514 65534 65471 65471
WriteX 12514 131005 63 63
WriteX 12514 131068 65471 65471
WriteX 12514 196539 63 63
WriteX 12514 196602 65471 65471
WriteX 12514 262073 63 63
Close 12514
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12515
WriteX 12515 0 65471 65471
WriteX 12515 65471 63 63
WriteX 12515 65534 65471 65471
WriteX 12515 131005 63 63
WriteX 12515 131068 65471 65471
WriteX 12515 196539 63 63
WriteX 12515 196602 65471 65471
WriteX 12515 262073 63 63
WriteX 12515 262136 65471 65471
WriteX 12515 327607 63 63
WriteX 12515 327670 65471 65471
WriteX 12515 393141 63 63
WriteX 12515 393204 65471 65471
WriteX 12515 458675 63 63
WriteX 12515 458738 65471 65471
WriteX 12515 524209 63 63
Close 12515
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12516
Close 12516
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12517
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12517 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12518
ReadX 12518 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12519
ReadX 12519 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12520
ReadX 12520 0 511 511
ReadX 12517 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12517
Close 12518
Close 12519
Close 12520
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12521
ReadX 12521 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12522
ReadX 12522 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12523
ReadX 12523 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12524
ReadX 12524 0 511 511
ReadX 12521 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12525
FIND_FIRST \clients\client1\~dmtmp\*
Close 12525
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 12526
QUERY_FILE_INFORMATION 12526
WriteX 12526 2047 1 1
QUERY_FILE_INFORMATION 12526
WriteX 12526 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 12527
Close 12527
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12528
WriteX 12528 52 1 1
QUERY_FILE_INFORMATION 12528
WriteX 12528 0 53 53
WriteX 12528 53 28 28
WriteX 12528 81 4 4
WriteX 12528 85 28 28
WriteX 12528 113 38 38
WriteX 12528 151 28 28
WriteX 12528 179 2 2
WriteX 12528 181 28 28
WriteX 12528 209 3 3
WriteX 12528 212 279 279
WriteX 12528 9 4 4
Close 12528
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 12529
ReadX 12529 0 53 53
ReadX 12529 53 28 28
ReadX 12529 81 4 4
ReadX 12529 85 28 28
ReadX 12529 113 38 38
ReadX 12529 151 28 28
ReadX 12529 179 2 2
ReadX 12529 181 28 28
ReadX 12529 209 3 3
Close 12529
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 12521
Close 12522
Close 12523
Close 12524
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12530
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12531
ReadX 12531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12532
ReadX 12532 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12533
ReadX 12533 0 511 511
ReadX 12530 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 12535
Close 12535
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12536
WriteX 12536 52 1 1
QUERY_FILE_INFORMATION 12536
WriteX 12536 0 53 53
WriteX 12536 53 28 28
WriteX 12536 81 28 28
WriteX 12536 109 28 28
WriteX 12536 137 28 28
WriteX 12536 165 28 28
WriteX 12536 193 28 28
WriteX 12536 221 28 28
WriteX 12536 249 4 4
WriteX 12536 253 4 4
WriteX 12536 257 4 4
WriteX 12536 261 28 28
WriteX 12536 289 2 2
WriteX 12536 291 2 2
WriteX 12536 293 2 2
WriteX 12536 295 248 248
WriteX 12536 9 4 4
Close 12536
Close 12530
Close 12531
Close 12532
Close 12533
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12537
ReadX 12537 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12538
ReadX 12538 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12539
ReadX 12539 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12540
ReadX 12540 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12541
ReadX 12541 0 53 53
ReadX 12541 53 28 28
ReadX 12541 81 28 28
ReadX 12541 109 28 28
ReadX 12541 137 28 28
ReadX 12541 165 28 28
ReadX 12541 193 28 28
ReadX 12541 221 28 28
ReadX 12541 249 4 4
ReadX 12541 253 4 4
ReadX 12541 257 4 4
ReadX 12541 261 28 28
ReadX 12541 289 2 2
ReadX 12541 291 2 2
ReadX 12541 293 2 2
Close 12541
ReadX 12537 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12537
Close 12538
Close 12539
Close 12540
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 12526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12542
Close 12542
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12543
ReadX 12543 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12544
ReadX 12544 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12545
ReadX 12545 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12546
ReadX 12546 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12547
ReadX 12547 0 53 53
ReadX 12547 53 28 28
ReadX 12547 81 28 28
ReadX 12547 109 28 28
ReadX 12547 137 28 28
ReadX 12547 165 28 28
ReadX 12547 193 28 28
ReadX 12547 221 28 28
ReadX 12547 249 4 4
ReadX 12547 253 4 4
ReadX 12547 257 4 4
ReadX 12547 261 28 28
ReadX 12547 289 2 2
ReadX 12547 291 2 2
ReadX 12547 293 2 2
Close 12547
ReadX 12543 2048 2048 2048
Close 12543
Close 12544
Close 12545
Close 12546
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12548
ReadX 12548 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12549
ReadX 12549 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12550
ReadX 12550 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12551
ReadX 12551 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12552
ReadX 12552 0 53 53
ReadX 12552 53 28 28
ReadX 12552 81 28 28
ReadX 12552 109 28 28
ReadX 12552 137 28 28
ReadX 12552 165 28 28
ReadX 12552 193 28 28
ReadX 12552 221 28 28
ReadX 12552 249 4 4
ReadX 12552 253 4 4
ReadX 12552 257 4 4
ReadX 12552 261 28 28
ReadX 12552 289 2 2
ReadX 12552 291 2 2
ReadX 12552 293 2 2
Close 12552
ReadX 12548 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 12556
FIND_FIRST \clients\client1\~dmtmp\*
Close 12556
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12557
QUERY_FILE_INFORMATION 12557
WriteX 12557 2047 1 1
QUERY_FILE_INFORMATION 12557
WriteX 12557 0 2048 2048
Close 12557
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12558
ReadX 12558 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 12558
Close 12548
Close 12549
Close 12550
Close 12551
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12559
ReadX 12559 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 12559 4095 1 1
QUERY_FILE_INFORMATION 12559
WriteX 12559 2048 2048 2048
QUERY_FILE_INFORMATION 12559
Flush 12559
WriteX 12559 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12560
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12561
ReadX 12561 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12562
ReadX 12562 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12563
ReadX 12563 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12564
ReadX 12564 0 53 53
ReadX 12564 53 28 28
ReadX 12564 81 28 28
ReadX 12564 109 28 28
ReadX 12564 137 28 28
ReadX 12564 165 28 28
ReadX 12564 193 28 28
ReadX 12564 221 28 28
ReadX 12564 249 4 4
ReadX 12564 253 4 4
ReadX 12564 257 4 4
ReadX 12564 261 28 28
ReadX 12564 289 2 2
ReadX 12564 291 2 2
ReadX 12564 293 2 2
Close 12564
ReadX 12560 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 12568
FIND_FIRST \clients\client1\~dmtmp\*
Close 12568
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12569
QUERY_FILE_INFORMATION 12569
WriteX 12569 2047 1 1
QUERY_FILE_INFORMATION 12569
WriteX 12569 0 2048 2048
Close 12569
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12570
ReadX 12570 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 12574
Close 12574
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12575
QUERY_FILE_INFORMATION 12575
WriteX 12575 2047 1 1
QUERY_FILE_INFORMATION 12575
WriteX 12575 0 2048 2048
Close 12575
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12576
ReadX 12576 0 511 511
ReadX 12560 384 2048 2048
ReadX 12560 768 16384 16384
ReadX 12560 1792 14336 14336
Close 12576
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12577
ReadX 12577 0 511 511
Close 12577
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 12579
Close 12579
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 12570 4095 1 1
QUERY_FILE_INFORMATION 12570
WriteX 12570 2048 2048 2048
WriteX 12570 0 88 88
Close 12570
WriteX 12560 1152 2048 2048
WriteX 12560 1408 6144 6144
WriteX 12560 1920 2048 2048
WriteX 12560 0 88 88
Close 12560
WriteX 12561 0 88 88
Close 12561
WriteX 12562 0 88 88
Close 12562
Close 12563
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12580
ReadX 12580 0 511 511
ReadX 12580 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12580
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12581
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12581 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12582
ReadX 12582 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12583
ReadX 12583 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12584
ReadX 12584 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12585
ReadX 12585 0 53 53
ReadX 12585 53 28 28
ReadX 12585 81 28 28
ReadX 12585 109 28 28
ReadX 12585 137 28 28
ReadX 12585 165 28 28
ReadX 12585 193 28 28
ReadX 12585 221 28 28
ReadX 12585 249 4 4
ReadX 12585 253 4 4
ReadX 12585 257 4 4
ReadX 12585 261 28 28
ReadX 12585 289 2 2
ReadX 12585 291 2 2
ReadX 12585 293 2 2
Close 12585
ReadX 12581 2048 2048 2048
Close 12581
Close 12582
Close 12583
Close 12584
Close 12559
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 12586
QUERY_FILE_INFORMATION 12586
Close 12586
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12587
Close 12587
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12588
ReadX 12588 0 511 511
ReadX 12588 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12589
ReadX 12589 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12590
ReadX 12590 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12591
ReadX 12591 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12592
ReadX 12592 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12593
ReadX 12593 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12594
ReadX 12594 0 53 53
ReadX 12594 53 2 2
ReadX 12594 55 2 2
ReadX 12594 57 184 184
ReadX 12594 241 298 298
Close 12594
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12595
ReadX 12595 0 41 41
ReadX 12588 2048 2048 2048
Close 12595
Close 12588
Close 12589
Close 12592
Close 12593
Close 12590
Close 12591
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12596
ReadX 12596 0 511 511
ReadX 12596 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12597
ReadX 12597 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12598
ReadX 12598 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12599
ReadX 12599 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12600
ReadX 12600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12601
ReadX 12601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12602
ReadX 12602 0 53 53
ReadX 12602 53 2 2
ReadX 12602 55 2 2
ReadX 12602 57 184 184
ReadX 12602 241 298 298
Close 12602
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12603
ReadX 12603 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12604
ReadX 12604 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12605
ReadX 12605 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12606
ReadX 12606 0 511 511
ReadX 12605 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12607
ReadX 12607 0 53 53
ReadX 12607 53 2 2
ReadX 12607 55 480 480
ReadX 12607 535 2 2
Close 12607
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12608
ReadX 12608 0 41 41
ReadX 12596 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 12612
FIND_FIRST \clients\client1\~dmtmp\*
Close 12612
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12613
QUERY_FILE_INFORMATION 12613
WriteX 12613 2047 1 1
QUERY_FILE_INFORMATION 12613
WriteX 12613 0 2048 2048
Close 12613
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12614
ReadX 12614 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12614
Close 12603
Close 12604
Close 12605
Close 12606
Close 12608
Close 12596
Close 12597
Close 12600
Close 12601
Close 12598
Close 12599
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12615
ReadX 12615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12616
Close 12616
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12617
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12617 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12618
ReadX 12618 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12619
ReadX 12619 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12620
ReadX 12620 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12621
ReadX 12621 0 53 53
ReadX 12621 53 2 2
ReadX 12621 55 480 480
ReadX 12621 535 2 2
Close 12621
ReadX 12617 2048 2048 2048
Close 12617
Close 12618
Close 12619
Close 12620
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12622
ReadX 12622 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12623
ReadX 12623 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12624
ReadX 12624 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12625
ReadX 12625 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12626
ReadX 12626 0 53 53
ReadX 12626 53 2 2
ReadX 12626 55 480 480
ReadX 12626 535 2 2
Close 12626
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12627
ReadX 12627 0 511 511
ReadX 12627 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12628
ReadX 12628 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12629
ReadX 12629 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12630
ReadX 12630 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12631
ReadX 12631 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12632
ReadX 12632 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12633
ReadX 12633 0 41 41
ReadX 12627 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12634
ReadX 12634 0 53 53
ReadX 12634 53 2 2
ReadX 12634 55 2 2
ReadX 12634 57 184 184
ReadX 12634 241 298 298
Close 12634
ReadX 12622 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 12638
FIND_FIRST \clients\client1\~dmtmp\*
Close 12638
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12639
QUERY_FILE_INFORMATION 12639
WriteX 12639 2047 1 1
QUERY_FILE_INFORMATION 12639
WriteX 12639 0 2048 2048
Close 12639
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12640
ReadX 12640 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 12640
Close 12633
Close 12627
Close 12628
Close 12631
Close 12632
Close 12629
Close 12630
Close 12622
Close 12623
Close 12624
Close 12625
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12641
ReadX 12641 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 12615 4095 1 1
QUERY_FILE_INFORMATION 12615
WriteX 12615 2048 2048 2048
QUERY_FILE_INFORMATION 12615
Flush 12615
WriteX 12615 0 88 88
WriteX 12641 4095 1 1
QUERY_FILE_INFORMATION 12641
WriteX 12641 2048 2048 2048
QUERY_FILE_INFORMATION 12641
Flush 12641
WriteX 12641 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12642
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12642 0 511 511
ReadX 12642 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12643
ReadX 12643 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12644
ReadX 12644 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12645
ReadX 12645 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12646
ReadX 12646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12647
ReadX 12647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12648
ReadX 12648 0 53 53
ReadX 12648 53 2 2
ReadX 12648 55 2 2
ReadX 12648 57 184 184
ReadX 12648 241 298 298
Close 12648
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12649
ReadX 12649 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12650
ReadX 12650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12651
ReadX 12651 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12652
ReadX 12652 0 511 511
ReadX 12651 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12653
ReadX 12653 0 53 53
ReadX 12653 53 2 2
ReadX 12653 55 480 480
ReadX 12653 535 2 2
Close 12653
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12654
ReadX 12654 0 41 41
ReadX 12642 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12655
ReadX 12655 0 53 53
ReadX 12655 53 2 2
ReadX 12655 55 480 480
ReadX 12655 535 2 2
Close 12655
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12656
ReadX 12656 0 53 53
ReadX 12656 53 2 2
ReadX 12656 55 2 2
ReadX 12656 57 184 184
ReadX 12656 241 298 298
Close 12656
ReadX 12649 2048 2048 2048
ReadX 12650 2048 2048 2048
ReadX 12649 320 16384 16384
ReadX 12649 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 12657
FIND_FIRST \clients\client1\~dmtmp\*
Close 12657
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12658
QUERY_FILE_INFORMATION 12658
WriteX 12658 4095 1 1
QUERY_FILE_INFORMATION 12658
WriteX 12658 0 4096 4096
Close 12658
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 12659
ReadX 12659 0 41 41
Close 12649
Close 12650
Close 12651
Close 12652
Close 12654
Close 12642
Close 12643
Close 12646
Close 12647
Close 12644
Close 12645
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 12660
Close 12660
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12661
QUERY_FILE_INFORMATION 12661
WriteX 12661 4095 1 1
QUERY_FILE_INFORMATION 12661
WriteX 12661 0 4096 4096
Close 12661
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12662
ReadX 12662 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 12659
ReadX 12659 0 4096 4096
WriteX 12662 0 4096 4096
Close 12662
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 12664
ReadX 12664 0 41 41
Close 12659
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 12664
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 12665
Close 12665
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12666
ReadX 12666 0 41 41
Close 12666
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 12667
Close 12667
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12668
QUERY_FILE_INFORMATION 12668
WriteX 12668 2047 1 1
QUERY_FILE_INFORMATION 12668
WriteX 12668 0 2048 2048
Close 12668
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12669
ReadX 12669 0 511 511
ReadX 12669 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12670
ReadX 12670 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12670
Close 12669
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12671
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12671 0 511 511
ReadX 12671 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12672
ReadX 12672 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12673
ReadX 12673 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12674
ReadX 12674 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12675
ReadX 12675 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12676
ReadX 12676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12677
ReadX 12677 0 53 53
ReadX 12677 53 2 2
ReadX 12677 55 2 2
ReadX 12677 57 184 184
ReadX 12677 241 298 298
Close 12677
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12678
ReadX 12678 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12679
ReadX 12679 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12680
ReadX 12680 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12681
ReadX 12681 0 511 511
ReadX 12680 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12682
ReadX 12682 0 53 53
ReadX 12682 53 2 2
ReadX 12682 55 480 480
ReadX 12682 535 2 2
Close 12682
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12683
ReadX 12683 0 41 41
ReadX 12671 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12684
ReadX 12684 0 53 53
ReadX 12684 53 2 2
ReadX 12684 55 480 480
ReadX 12684 535 2 2
Close 12684
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12685
ReadX 12685 0 53 53
ReadX 12685 53 2 2
ReadX 12685 55 2 2
ReadX 12685 57 184 184
ReadX 12685 241 298 298
Close 12685
ReadX 12678 2048 2048 2048
Close 12678
Close 12679
Close 12680
Close 12681
Close 12683
Close 12671
Close 12672
Close 12675
Close 12676
Close 12673
Close 12674
Close 12615
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 12686
QUERY_FILE_INFORMATION 12686
Close 12686
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 12641
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 12687
QUERY_FILE_INFORMATION 12687
Close 12687
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12688
Close 12688
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12689
ReadX 12689 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12690
ReadX 12690 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12691
ReadX 12691 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12692
ReadX 12692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12693
ReadX 12693 0 53 53
ReadX 12693 53 2 2
ReadX 12693 55 480 480
ReadX 12693 535 2 2
Close 12693
ReadX 12689 2048 2048 2048
Close 12689
Close 12690
Close 12691
Close 12692
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12694
ReadX 12694 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12695
ReadX 12695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12696
ReadX 12696 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12697
ReadX 12697 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12698
ReadX 12698 0 53 53
ReadX 12698 53 2 2
ReadX 12698 55 480 480
ReadX 12698 535 2 2
Close 12698
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12699
ReadX 12699 0 511 511
ReadX 12699 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12700
ReadX 12700 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12701
ReadX 12701 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12702
ReadX 12702 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12703
ReadX 12703 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12704
ReadX 12704 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12705
ReadX 12705 0 41 41
ReadX 12699 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12706
ReadX 12706 0 53 53
ReadX 12706 53 2 2
ReadX 12706 55 2 2
ReadX 12706 57 184 184
ReadX 12706 241 298 298
Close 12706
ReadX 12694 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 12710
FIND_FIRST \clients\client1\~dmtmp\*
Close 12710
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12711
QUERY_FILE_INFORMATION 12711
WriteX 12711 2047 1 1
QUERY_FILE_INFORMATION 12711
WriteX 12711 0 2048 2048
Close 12711
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12712
ReadX 12712 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12712
Close 12705
Close 12699
Close 12700
Close 12703
Close 12704
Close 12701
Close 12702
Close 12694
Close 12695
Close 12696
Close 12697
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12713
ReadX 12713 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12714
Close 12714
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12715 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12716
ReadX 12716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12717
ReadX 12717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12718
ReadX 12718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12719
ReadX 12719 0 53 53
ReadX 12719 53 28 28
ReadX 12719 81 28 28
ReadX 12719 109 28 28
ReadX 12719 137 28 28
ReadX 12719 165 28 28
ReadX 12719 193 28 28
ReadX 12719 221 28 28
ReadX 12719 249 4 4
ReadX 12719 253 4 4
ReadX 12719 257 4 4
ReadX 12719 261 28 28
ReadX 12719 289 2 2
ReadX 12719 291 2 2
ReadX 12719 293 2 2
Close 12719
ReadX 12715 2048 2048 2048
Close 12715
Close 12716
Close 12717
Close 12718
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12720
ReadX 12720 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12721
ReadX 12721 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12722
ReadX 12722 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12723
ReadX 12723 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12724
ReadX 12724 0 53 53
ReadX 12724 53 28 28
ReadX 12724 81 28 28
ReadX 12724 109 28 28
ReadX 12724 137 28 28
ReadX 12724 165 28 28
ReadX 12724 193 28 28
ReadX 12724 221 28 28
ReadX 12724 249 4 4
ReadX 12724 253 4 4
ReadX 12724 257 4 4
ReadX 12724 261 28 28
ReadX 12724 289 2 2
ReadX 12724 291 2 2
ReadX 12724 293 2 2
Close 12724
ReadX 12720 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 12728
FIND_FIRST \clients\client1\~dmtmp\*
Close 12728
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12729
QUERY_FILE_INFORMATION 12729
WriteX 12729 2047 1 1
QUERY_FILE_INFORMATION 12729
WriteX 12729 0 2048 2048
Close 12729
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12730
ReadX 12730 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12730
Close 12720
Close 12721
Close 12722
Close 12723
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12731
ReadX 12731 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12732
Close 12732
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12733
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12733 0 511 511
ReadX 12733 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12734
ReadX 12734 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12735
ReadX 12735 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12736
ReadX 12736 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12737
ReadX 12737 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12738
ReadX 12738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12739
ReadX 12739 0 53 53
ReadX 12739 53 2 2
ReadX 12739 55 2 2
ReadX 12739 57 184 184
ReadX 12739 241 298 298
Close 12739
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12740
ReadX 12740 0 41 41
ReadX 12733 2048 2048 2048
Close 12740
Close 12733
Close 12734
Close 12737
Close 12738
Close 12735
Close 12736
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12741
ReadX 12741 0 511 511
ReadX 12741 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12742
ReadX 12742 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12743
ReadX 12743 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12744
ReadX 12744 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12745
ReadX 12745 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12746
ReadX 12746 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12747
ReadX 12747 0 53 53
ReadX 12747 53 2 2
ReadX 12747 55 2 2
ReadX 12747 57 184 184
ReadX 12747 241 298 298
Close 12747
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12748
ReadX 12748 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12749
ReadX 12749 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12750
ReadX 12750 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12751
ReadX 12751 0 511 511
ReadX 12750 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12752
ReadX 12752 0 53 53
ReadX 12752 53 2 2
ReadX 12752 55 480 480
ReadX 12752 535 2 2
Close 12752
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12753
ReadX 12753 0 41 41
ReadX 12741 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 12757
FIND_FIRST \clients\client1\~dmtmp\*
Close 12757
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12758
QUERY_FILE_INFORMATION 12758
WriteX 12758 2047 1 1
QUERY_FILE_INFORMATION 12758
WriteX 12758 0 2048 2048
Close 12758
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12759
ReadX 12759 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 12759
Close 12748
Close 12749
Close 12750
Close 12751
Close 12753
Close 12741
Close 12742
Close 12745
Close 12746
Close 12743
Close 12744
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12760
ReadX 12760 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 12713 4095 1 1
QUERY_FILE_INFORMATION 12713
WriteX 12713 2048 2048 2048
QUERY_FILE_INFORMATION 12713
Flush 12713
WriteX 12713 0 88 88
WriteX 12731 4095 1 1
QUERY_FILE_INFORMATION 12731
WriteX 12731 2048 2048 2048
QUERY_FILE_INFORMATION 12731
Flush 12731
WriteX 12731 0 88 88
WriteX 12760 4095 1 1
QUERY_FILE_INFORMATION 12760
WriteX 12760 2048 2048 2048
QUERY_FILE_INFORMATION 12760
Flush 12760
WriteX 12760 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12761
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12761 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12762
ReadX 12762 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12763
ReadX 12763 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12764
ReadX 12764 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12765
ReadX 12765 0 53 53
ReadX 12765 53 2 2
ReadX 12765 55 480 480
ReadX 12765 535 2 2
Close 12765
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12766
ReadX 12766 0 511 511
ReadX 12766 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12767
ReadX 12767 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12768
ReadX 12768 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12769
ReadX 12769 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12770
ReadX 12770 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12771
ReadX 12771 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12772
ReadX 12772 0 41 41
ReadX 12766 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12773
ReadX 12773 0 53 53
ReadX 12773 53 2 2
ReadX 12773 55 2 2
ReadX 12773 57 184 184
ReadX 12773 241 298 298
Close 12773
ReadX 12761 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12774
ReadX 12774 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12775
ReadX 12775 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12776
ReadX 12776 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12777
ReadX 12777 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12778
ReadX 12778 0 53 53
ReadX 12778 53 28 28
ReadX 12778 81 28 28
ReadX 12778 109 28 28
ReadX 12778 137 28 28
ReadX 12778 165 28 28
ReadX 12778 193 28 28
ReadX 12778 221 28 28
ReadX 12778 249 4 4
ReadX 12778 253 4 4
ReadX 12778 257 4 4
ReadX 12778 261 28 28
ReadX 12778 289 2 2
ReadX 12778 291 2 2
ReadX 12778 293 2 2
Close 12778
ReadX 12774 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12779
ReadX 12779 0 53 53
ReadX 12779 53 2 2
ReadX 12779 55 2 2
ReadX 12779 57 184 184
ReadX 12779 241 298 298
Close 12779
ReadX 12763 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12780
ReadX 12780 0 53 53
ReadX 12780 53 2 2
ReadX 12780 55 480 480
ReadX 12780 535 2 2
Close 12780
ReadX 12774 4096 16384 16384
ReadX 12774 1280 16384 16384
ReadX 12774 2304 6144 6144
ReadX 12774 2688 2048 2048
ReadX 12761 4096 16384 16384
ReadX 12761 1280 16384 16384
ReadX 12761 2304 16384 16384
ReadX 12761 3328 16384 16384
ReadX 12761 272 16384 16384
ReadX 12761 336 16384 16384
ReadX 12761 400 16384 16384
ReadX 12761 464 16384 16384
ReadX 12761 528 16384 16384
ReadX 12761 592 16384 16384
ReadX 12761 656 16384 16384
ReadX 12761 720 16384 16384
ReadX 12761 784 16384 16384
ReadX 12761 848 16384 16384
ReadX 12761 912 16384 16384
ReadX 12767 2048 2048 2048
ReadX 12766 760 2048 2048
ReadX 12766 1144 2048 2048
ReadX 12766 408 2048 2048
ReadX 12766 912 2048 2048
ReadX 12766 1096 2048 2048
ReadX 12766 776 2048 2048
ReadX 12766 560 2048 2048
ReadX 12766 376 2048 2048
ReadX 12766 320 2048 2048
ReadX 12766 3072 2048 2048
ReadX 12766 784 2048 2048
ReadX 12766 2176 2048 2048
ReadX 12766 792 2048 2048
ReadX 12766 576 2048 2048
ReadX 12766 600 2048 2048
ReadX 12766 728 2048 2048
ReadX 12766 1112 2048 2048
ReadX 12766 664 2048 2048
ReadX 12766 976 2048 2048
ReadX 12766 3840 2048 2048
ReadX 12766 296 2048 2048
ReadX 12766 480 2048 2048
ReadX 12766 680 2048 2048
ReadX 12766 696 2048 2048
ReadX 12766 832 2048 2048
ReadX 12766 1016 2048 2048
ReadX 12766 1104 2048 2048
ReadX 12766 3200 2048 2048
ReadX 12766 264 2048 2048
ReadX 12766 448 2048 2048
ReadX 12766 648 2048 2048
ReadX 12766 1136 2048 2048
ReadX 12766 288 2048 2048
ReadX 12766 352 2048 2048
ReadX 12766 536 2048 2048
ReadX 12766 800 2048 2048
ReadX 12766 736 2048 2048
ReadX 12766 392 2048 2048
ReadX 12766 752 2048 2048
ReadX 12766 880 2048 2048
ReadX 12766 1064 2048 2048
ReadX 12766 1128 2048 2048
ReadX 12766 1536 2048 2048
ReadX 12766 2432 2048 2048
ReadX 12766 688 2048 2048
ReadX 12766 872 2048 2048
ReadX 12766 1072 2048 2048
ReadX 12766 984 2048 2048
ReadX 12766 704 2048 2048
ReadX 12766 3328 2048 2048
ReadX 12766 888 2048 2048
ReadX 12766 496 2048 2048
ReadX 12766 624 2048 2048
ReadX 12766 808 2048 2048
ReadX 12766 1008 2048 2048
ReadX 12766 1152 2048 2048
ReadX 12766 416 2048 2048
ReadX 12766 584 2048 2048
ReadX 12766 384 2048 2048
ReadX 12766 568 2048 2048
ReadX 12766 512 2048 2048
ReadX 12766 1408 2048 2048
ReadX 12766 472 2048 2048
ReadX 12766 672 2048 2048
ReadX 12766 2560 2048 2048
ReadX 12766 544 2048 2048
ReadX 12766 920 2048 2048
ReadX 12766 1120 2048 2048
ReadX 12766 2304 2048 2048
ReadX 12766 1080 2048 2048
ReadX 12766 1664 2048 2048
ReadX 12766 608 2048 2048
ReadX 12766 2688 2048 2048
ReadX 12766 3712 2048 2048
ReadX 12766 616 2048 2048
ReadX 12766 632 2048 2048
ReadX 12766 944 2048 2048
ReadX 12766 856 2048 2048
ReadX 12766 768 2048 2048
ReadX 12766 720 2048 2048
ReadX 12766 640 2048 2048
ReadX 12766 1048 2048 2048
ReadX 12766 1040 2048 2048
ReadX 12766 1032 2048 2048
ReadX 12766 1000 2048 2048
ReadX 12766 992 2048 2048
ReadX 12766 968 2048 2048
ReadX 12766 952 2048 2048
ReadX 12766 1056 2048 2048
ReadX 12766 816 2048 2048
ReadX 12766 864 2048 2048
ReadX 12766 2816 2048 2048
ReadX 12766 640 2048 2048
ReadX 12766 1024 2048 2048
ReadX 12766 504 2048 2048
ReadX 12766 424 2048 2048
ReadX 12766 840 2048 2048
ReadX 12766 896 2048 2048
ReadX 12766 520 2048 2048
ReadX 12766 960 2048 2048
ReadX 12766 552 2048 2048
ReadX 12766 488 2048 2048
ReadX 12766 824 2048 2048
ReadX 12766 304 2048 2048
ReadX 12766 768 2048 2048
ReadX 12766 712 2048 2048
ReadX 12766 512 2048 2048
ReadX 12766 432 2048 2048
ReadX 12766 384 2048 2048
ReadX 12766 2944 2048 2048
ReadX 12766 1088 2048 2048
ReadX 12766 928 2048 2048
ReadX 12766 280 2048 2048
ReadX 12766 744 2048 2048
ReadX 12766 3968 2048 2048
ReadX 12766 336 2048 2048
ReadX 12766 592 2048 2048
ReadX 12766 312 2048 2048
ReadX 12766 400 2048 2048
ReadX 12766 904 2048 2048
ReadX 12766 464 2048 2048
ReadX 12766 3456 2048 2048
ReadX 12766 848 2048 2048
ReadX 12766 936 2048 2048
ReadX 12766 656 2048 2048
ReadX 12766 344 2048 2048
ReadX 12766 440 2048 2048
ReadX 12766 4096 2048 2048
ReadX 12766 528 2048 2048
ReadX 12766 2048 2048 2048
ReadX 12766 1024 2048 2048
ReadX 12766 456 2048 2048
ReadX 12766 1792 2048 2048
ReadX 12766 1152 2048 2048
ReadX 12766 3584 2048 2048
ReadX 12766 1920 2048 2048
ReadX 12766 1280 2048 2048
ReadX 12766 896 2048 2048
ReadX 12766 328 2048 2048
Close 12774
Close 12775
Close 12776
Close 12777
Close 12772
Close 12766
Close 12767
Close 12770
Close 12771
Close 12768
Close 12769
Close 12761
Close 12762
Close 12763
Close 12764
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12781
FIND_FIRST \clients\client1\~dmtmp\*
Close 12781
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12782
QUERY_FILE_INFORMATION 12782
WriteX 12782 0 2048 2048
WriteX 12782 18431 1 1
QUERY_FILE_INFORMATION 12782
WriteX 12782 2048 16384 16384
WriteX 12782 1152 16384 16384
WriteX 12782 2176 16384 16384
WriteX 12782 3200 16384 16384
WriteX 12782 264 16384 16384
WriteX 12782 328 16384 16384
WriteX 12782 392 16384 16384
WriteX 12782 456 16384 16384
WriteX 12782 520 16384 16384
WriteX 12782 584 16384 16384
WriteX 12782 648 16384 16384
WriteX 12782 712 16384 16384
WriteX 12782 776 16384 16384
WriteX 12782 840 16384 16384
WriteX 12782 904 16384 16384
WriteX 12782 968 16384 16384
WriteX 12782 1032 16384 16384
WriteX 12782 1096 16384 16384
WriteX 12782 1160 16384 16384
WriteX 12782 1224 16384 16384
WriteX 12782 1288 16384 16384
WriteX 12782 1352 16384 16384
WriteX 12782 1416 16384 16384
WriteX 12782 1480 16384 16384
WriteX 12782 1544 16384 16384
WriteX 12782 1608 16384 16384
WriteX 12782 1672 16384 16384
WriteX 12782 1736 16384 16384
WriteX 12782 1800 16384 16384
WriteX 12782 1864 16384 16384
WriteX 12782 1928 16384 16384
WriteX 12782 1992 16384 16384
WriteX 12782 2056 16384 16384
WriteX 12782 2120 16384 16384
WriteX 12782 2184 16384 16384
WriteX 12782 2248 16384 16384
WriteX 12782 2312 16384 16384
WriteX 12782 2376 16384 16384
WriteX 12782 2440 16384 16384
WriteX 12782 0 88 88
Close 12782
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12783
ReadX 12783 0 511 511
ReadX 12783 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12783
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12784
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12784 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12785
ReadX 12785 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12786
ReadX 12786 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12787
ReadX 12787 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12788
ReadX 12788 0 53 53
ReadX 12788 53 2 2
ReadX 12788 55 480 480
ReadX 12788 535 2 2
Close 12788
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12789
ReadX 12789 0 511 511
ReadX 12789 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12790
ReadX 12790 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12791
ReadX 12791 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12792
ReadX 12792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12793
ReadX 12793 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12794
ReadX 12794 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12795
ReadX 12795 0 41 41
ReadX 12789 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12796
ReadX 12796 0 53 53
ReadX 12796 53 2 2
ReadX 12796 55 2 2
ReadX 12796 57 184 184
ReadX 12796 241 298 298
Close 12796
ReadX 12784 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12797
ReadX 12797 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12798
ReadX 12798 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12799
ReadX 12799 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12800
ReadX 12800 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12801
ReadX 12801 0 53 53
ReadX 12801 53 28 28
ReadX 12801 81 28 28
ReadX 12801 109 28 28
ReadX 12801 137 28 28
ReadX 12801 165 28 28
ReadX 12801 193 28 28
ReadX 12801 221 28 28
ReadX 12801 249 4 4
ReadX 12801 253 4 4
ReadX 12801 257 4 4
ReadX 12801 261 28 28
ReadX 12801 289 2 2
ReadX 12801 291 2 2
ReadX 12801 293 2 2
Close 12801
ReadX 12797 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12802
ReadX 12802 0 53 53
ReadX 12802 53 2 2
ReadX 12802 55 2 2
ReadX 12802 57 184 184
ReadX 12802 241 298 298
Close 12802
ReadX 12786 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12803
ReadX 12803 0 53 53
ReadX 12803 53 2 2
ReadX 12803 55 480 480
ReadX 12803 535 2 2
Close 12803
Close 12797
Close 12798
Close 12799
Close 12800
Close 12795
Close 12789
Close 12790
Close 12793
Close 12794
Close 12791
Close 12792
Close 12784
Close 12785
Close 12786
Close 12787
Close 12713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 12804
QUERY_FILE_INFORMATION 12804
Close 12804
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 12731
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 12805
QUERY_FILE_INFORMATION 12805
Close 12805
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 12760
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 12806
QUERY_FILE_INFORMATION 12806
Close 12806
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12807
Close 12807
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12808
ReadX 12808 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12809
ReadX 12809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12810
ReadX 12810 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12811
ReadX 12811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12812
ReadX 12812 0 53 53
ReadX 12812 53 28 28
ReadX 12812 81 28 28
ReadX 12812 109 28 28
ReadX 12812 137 28 28
ReadX 12812 165 28 28
ReadX 12812 193 28 28
ReadX 12812 221 28 28
ReadX 12812 249 4 4
ReadX 12812 253 4 4
ReadX 12812 257 4 4
ReadX 12812 261 28 28
ReadX 12812 289 2 2
ReadX 12812 291 2 2
ReadX 12812 293 2 2
Close 12812
ReadX 12808 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 12808 384 2048 2048
ReadX 12808 768 16384 16384
ReadX 12808 1792 14336 14336
ReadX 12811 2048 2048 2048
ReadX 12810 2048 2048 2048
WriteX 12808 1152 2048 2048
WriteX 12811 2048 2048 2048
WriteX 12810 2048 2048 2048
WriteX 12808 0 88 88
WriteX 12809 0 88 88
WriteX 12810 0 88 88
WriteX 12811 0 88 88
Close 12808
Close 12809
Close 12810
Close 12811
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12813
Close 12813
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12814
ReadX 12814 0 511 511
ReadX 12814 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12815
ReadX 12815 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12816
ReadX 12816 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12817
ReadX 12817 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12818
ReadX 12818 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12819
ReadX 12819 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12820
ReadX 12820 0 53 53
ReadX 12820 53 2 2
ReadX 12820 55 2 2
ReadX 12820 57 184 184
ReadX 12820 241 298 298
Close 12820
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12821
ReadX 12821 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12822
ReadX 12822 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12823
ReadX 12823 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12824
ReadX 12824 0 511 511
ReadX 12823 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12825
ReadX 12825 0 53 53
ReadX 12825 53 2 2
ReadX 12825 55 480 480
ReadX 12825 535 2 2
Close 12825
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12826
ReadX 12826 0 41 41
ReadX 12814 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 12827
QUERY_FILE_INFORMATION 12827
QUERY_FILE_INFORMATION 12827
ReadX 12827 0 8192 8192
Close 12827
ReadX 12814 1152 2048 2048
ReadX 12814 4096 16384 16384
Close 12821
Close 12822
Close 12823
Close 12824
Close 12826
Close 12814
Close 12815
Close 12818
Close 12819
Close 12816
Close 12817
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12828
Close 12828
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12829
QUERY_FILE_INFORMATION 12829
ReadX 12829 0 64 64
ReadX 12829 144 64 64
ReadX 12829 224 156 156
ReadX 12829 1193 128 128
ReadX 12829 1201 128 128
ReadX 12829 1072 4 4
ReadX 12829 1076 1925 1925
ReadX 12829 758 4 4
ReadX 12829 762 4557 4557
ReadX 12829 1052 4 4
ReadX 12829 1056 314 314
ReadX 12829 1056 11056 11056
Close 12829
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12830
ReadX 12830 0 511 511
ReadX 12830 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12831
ReadX 12831 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12832
ReadX 12832 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12833
ReadX 12833 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12834
ReadX 12834 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12835
ReadX 12835 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12836
ReadX 12836 0 53 53
ReadX 12836 53 2 2
ReadX 12836 55 2 2
ReadX 12836 57 184 184
ReadX 12836 241 298 298
Close 12836
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12837
ReadX 12837 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12838
ReadX 12838 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12839
ReadX 12839 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12840
ReadX 12840 0 511 511
ReadX 12839 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12841
ReadX 12841 0 53 53
ReadX 12841 53 2 2
ReadX 12841 55 480 480
ReadX 12841 535 2 2
Close 12841
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12842
ReadX 12842 0 41 41
ReadX 12830 2048 2048 2048
ReadX 12831 2048 2048 2048
ReadX 12830 1144 2048 2048
ReadX 12830 1152 2048 2048
ReadX 12830 4096 16384 16384
WriteX 12830 2048 2048 2048
WriteX 12831 2048 2048 2048
WriteX 12830 0 88 88
WriteX 12831 0 88 88
Close 12837
Close 12838
Close 12839
Close 12840
Close 12842
Close 12830
Close 12831
Close 12834
Close 12835
Close 12832
Close 12833
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12843
Close 12843
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 12844
QUERY_FILE_INFORMATION 12844
ReadX 12844 0 64 64
ReadX 12844 144 64 64
ReadX 12844 224 84 84
ReadX 12844 478 16 16
ReadX 12844 1056 6176 6176
Close 12844
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12845
ReadX 12845 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12846
ReadX 12846 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 12847
ReadX 12847 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12848
ReadX 12848 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 12849
ReadX 12849 0 53 53
ReadX 12849 53 28 28
ReadX 12849 81 28 28
ReadX 12849 109 28 28
ReadX 12849 137 28 28
ReadX 12849 165 28 28
ReadX 12849 193 28 28
ReadX 12849 221 28 28
ReadX 12849 249 4 4
ReadX 12849 253 4 4
ReadX 12849 257 4 4
ReadX 12849 261 28 28
ReadX 12849 289 2 2
ReadX 12849 291 2 2
ReadX 12849 293 2 2
Close 12849
ReadX 12845 2048 2048 2048
ReadX 12846 2048 2048 2048
ReadX 12845 1280 2048 2048
ReadX 12848 2048 2048 2048
ReadX 12847 2048 2048 2048
WriteX 12845 1280 2048 2048
WriteX 12848 2048 2048 2048
WriteX 12847 2048 2048 2048
WriteX 12846 2048 2048 2048
WriteX 12845 0 88 88
WriteX 12846 0 88 88
WriteX 12847 0 88 88
WriteX 12848 0 88 88
WriteX 12845 1280 2048 2048
WriteX 12848 2048 2048 2048
WriteX 12847 2048 2048 2048
WriteX 12846 2048 2048 2048
WriteX 12845 0 88 88
WriteX 12846 0 88 88
WriteX 12847 0 88 88
WriteX 12848 0 88 88
WriteX 12845 1280 2048 2048
WriteX 12848 2048 2048 2048
WriteX 12847 2048 2048 2048
WriteX 12846 2048 2048 2048
WriteX 12845 0 88 88
WriteX 12846 0 88 88
WriteX 12847 0 88 88
WriteX 12848 0 88 88
Close 12845
Close 12846
Close 12847
Close 12848
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12850
ReadX 12850 0 511 511
ReadX 12850 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12851
ReadX 12851 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12852
ReadX 12852 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12853
ReadX 12853 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12854
ReadX 12854 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12855
ReadX 12855 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12856
ReadX 12856 0 53 53
ReadX 12856 53 2 2
ReadX 12856 55 2 2
ReadX 12856 57 184 184
ReadX 12856 241 298 298
Close 12856
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12857
ReadX 12857 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12858
ReadX 12858 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12859
ReadX 12859 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12860
ReadX 12860 0 511 511
ReadX 12859 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12861
ReadX 12861 0 53 53
ReadX 12861 53 2 2
ReadX 12861 55 480 480
ReadX 12861 535 2 2
Close 12861
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12862
ReadX 12862 0 41 41
ReadX 12850 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 12866
FIND_FIRST \clients\client1\~dmtmp\*
Close 12866
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12867
QUERY_FILE_INFORMATION 12867
WriteX 12867 2047 1 1
QUERY_FILE_INFORMATION 12867
WriteX 12867 0 2048 2048
Close 12867
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12868
ReadX 12868 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 12868 4095 1 1
QUERY_FILE_INFORMATION 12868
WriteX 12868 2048 2048 2048
WriteX 12868 0 88 88
Close 12868
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12869
ReadX 12869 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 12869 2048 2048 2048
Close 12857
Close 12858
Close 12859
Close 12860
Close 12862
Close 12850
Close 12851
Close 12854
Close 12855
Close 12852
Close 12853
WriteX 12869 2048 2048 2048
WriteX 12869 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12870
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12870 0 511 511
ReadX 12870 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12871
ReadX 12871 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12872
ReadX 12872 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12873
ReadX 12873 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12874
ReadX 12874 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12875
ReadX 12875 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12876
ReadX 12876 0 53 53
ReadX 12876 53 2 2
ReadX 12876 55 2 2
ReadX 12876 57 184 184
ReadX 12876 241 298 298
Close 12876
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12877
ReadX 12877 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12878
ReadX 12878 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12879
ReadX 12879 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12880
ReadX 12880 0 511 511
ReadX 12879 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12881
ReadX 12881 0 53 53
ReadX 12881 53 2 2
ReadX 12881 55 480 480
ReadX 12881 535 2 2
Close 12881
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12882
ReadX 12882 0 41 41
ReadX 12870 2048 2048 2048
ReadX 12870 1152 2048 2048
ReadX 12870 4096 16384 16384
ReadX 12870 1280 16384 16384
ReadX 12870 2304 16384 16384
ReadX 12870 3328 16384 16384
ReadX 12870 272 16384 16384
ReadX 12870 336 16384 16384
ReadX 12870 400 16384 16384
ReadX 12870 464 16384 16384
ReadX 12870 528 16384 16384
ReadX 12870 592 16384 16384
ReadX 12870 656 16384 16384
ReadX 12870 720 16384 16384
ReadX 12870 784 16384 16384
ReadX 12870 848 16384 16384
ReadX 12870 912 16384 16384
ReadX 12870 976 16384 16384
ReadX 12870 1040 16384 16384
ReadX 12870 1104 12288 12288
Close 12877
Close 12878
Close 12879
Close 12880
Close 12882
Close 12870
Close 12871
Close 12874
Close 12875
Close 12872
Close 12873
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12883
FIND_FIRST \clients\client1\~dmtmp\*
Close 12883
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12884
QUERY_FILE_INFORMATION 12884
WriteX 12884 0 2048 2048
WriteX 12884 2048 4096 4096
WriteX 12884 0 88 88
Close 12884
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12885
ReadX 12885 0 511 511
ReadX 12885 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12885
WriteX 12869 2048 2048 2048
WriteX 12869 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12886
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12886 0 511 511
ReadX 12886 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12887
ReadX 12887 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12888
ReadX 12888 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12889
ReadX 12889 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12890
ReadX 12890 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12891
ReadX 12891 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12892
ReadX 12892 0 53 53
ReadX 12892 53 2 2
ReadX 12892 55 2 2
ReadX 12892 57 184 184
ReadX 12892 241 298 298
Close 12892
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12893
ReadX 12893 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12894
ReadX 12894 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12895
ReadX 12895 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12896
ReadX 12896 0 511 511
ReadX 12895 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12897
ReadX 12897 0 53 53
ReadX 12897 53 2 2
ReadX 12897 55 480 480
ReadX 12897 535 2 2
Close 12897
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12898
ReadX 12898 0 41 41
ReadX 12886 2048 2048 2048
ReadX 12886 1152 2048 2048
ReadX 12886 4096 16384 16384
ReadX 12886 1280 16384 16384
ReadX 12886 2304 16384 16384
ReadX 12886 3328 16384 16384
ReadX 12886 272 16384 16384
ReadX 12886 336 16384 16384
ReadX 12886 400 16384 16384
ReadX 12886 464 16384 16384
ReadX 12886 528 16384 16384
ReadX 12886 592 16384 16384
ReadX 12886 656 16384 16384
ReadX 12886 720 16384 16384
ReadX 12886 784 16384 16384
ReadX 12886 848 16384 16384
ReadX 12886 912 16384 16384
ReadX 12886 976 16384 16384
ReadX 12886 1040 16384 16384
ReadX 12886 1104 12288 12288
Close 12893
Close 12894
Close 12895
Close 12896
Close 12898
Close 12886
Close 12887
Close 12890
Close 12891
Close 12888
Close 12889
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12899
FIND_FIRST \clients\client1\~dmtmp\*
Close 12899
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12900
QUERY_FILE_INFORMATION 12900
WriteX 12900 0 2048 2048
WriteX 12900 2048 4096 4096
WriteX 12900 0 88 88
Close 12900
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12901
ReadX 12901 0 511 511
ReadX 12901 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 12901
Close 12869
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 12902
QUERY_FILE_INFORMATION 12902
Close 12902
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12903
Close 12903
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12904
QUERY_FILE_INFORMATION 12904
ReadX 12904 0 64 64
ReadX 12904 144 64 64
ReadX 12904 224 156 156
ReadX 12904 1193 128 128
ReadX 12904 1201 128 128
ReadX 12904 1072 4 4
ReadX 12904 1076 1925 1925
ReadX 12904 758 4 4
ReadX 12904 762 4557 4557
ReadX 12904 1052 4 4
ReadX 12904 1056 314 314
ReadX 12904 1056 11056 11056
Close 12904
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12905
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12905 0 511 511
ReadX 12905 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12906
ReadX 12906 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12907
ReadX 12907 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12908
ReadX 12908 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12909
ReadX 12909 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12910
ReadX 12910 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12911
ReadX 12911 0 53 53
ReadX 12911 53 2 2
ReadX 12911 55 2 2
ReadX 12911 57 184 184
ReadX 12911 241 298 298
Close 12911
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12912
ReadX 12912 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12913
ReadX 12913 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12914
ReadX 12914 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12915
ReadX 12915 0 511 511
ReadX 12914 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12916
ReadX 12916 0 53 53
ReadX 12916 53 2 2
ReadX 12916 55 480 480
ReadX 12916 535 2 2
Close 12916
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12917
ReadX 12917 0 41 41
ReadX 12905 2048 2048 2048
ReadX 12905 1152 2048 2048
ReadX 12905 4096 16384 16384
Close 12912
Close 12913
Close 12914
Close 12915
Close 12917
Close 12905
Close 12906
Close 12909
Close 12910
Close 12907
Close 12908
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12918
ReadX 12918 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12919
ReadX 12919 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12920
ReadX 12920 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12921
ReadX 12921 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12922
ReadX 12922 0 53 53
ReadX 12922 53 2 2
ReadX 12922 55 480 480
ReadX 12922 535 2 2
Close 12922
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12923
ReadX 12923 0 511 511
ReadX 12923 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12924
ReadX 12924 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12925
ReadX 12925 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12926
ReadX 12926 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12927
ReadX 12927 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12928
ReadX 12928 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12929
ReadX 12929 0 41 41
ReadX 12923 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12930
ReadX 12930 0 53 53
ReadX 12930 53 2 2
ReadX 12930 55 2 2
ReadX 12930 57 184 184
ReadX 12930 241 298 298
Close 12930
ReadX 12918 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 12934
FIND_FIRST \clients\client1\~dmtmp\*
Close 12934
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12935
QUERY_FILE_INFORMATION 12935
WriteX 12935 2047 1 1
QUERY_FILE_INFORMATION 12935
WriteX 12935 0 2048 2048
Close 12935
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12936
ReadX 12936 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 12936 4095 1 1
QUERY_FILE_INFORMATION 12936
WriteX 12936 2048 2048 2048
WriteX 12936 0 88 88
Close 12936
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12937
ReadX 12937 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12937 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 12941
Close 12941
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12942
QUERY_FILE_INFORMATION 12942
WriteX 12942 2047 1 1
QUERY_FILE_INFORMATION 12942
WriteX 12942 0 2048 2048
Close 12942
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12943
ReadX 12943 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 12943 4095 1 1
QUERY_FILE_INFORMATION 12943
WriteX 12943 2048 2048 2048
WriteX 12943 0 88 88
Close 12943
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12944
ReadX 12944 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 12944 2048 2048 2048
Close 12929
Close 12923
Close 12924
Close 12927
Close 12928
Close 12925
Close 12926
Close 12918
Close 12919
Close 12920
Close 12921
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12945
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12945 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12946
ReadX 12946 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 12947
ReadX 12947 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 12948
ReadX 12948 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 12949
ReadX 12949 0 53 53
ReadX 12949 53 2 2
ReadX 12949 55 480 480
ReadX 12949 535 2 2
Close 12949
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12950
ReadX 12950 0 511 511
ReadX 12950 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 12951
ReadX 12951 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 12952
ReadX 12952 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 12953
ReadX 12953 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 12954
ReadX 12954 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 12955
ReadX 12955 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12956
ReadX 12956 0 41 41
ReadX 12950 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 12957
ReadX 12957 0 53 53
ReadX 12957 53 2 2
ReadX 12957 55 2 2
ReadX 12957 57 184 184
ReadX 12957 241 298 298
Close 12957
ReadX 12945 2048 2048 2048
ReadX 12945 384 16384 16384
ReadX 12945 1408 16384 16384
ReadX 12945 2560 16384 16384
ReadX 12945 3584 16384 16384
ReadX 12945 288 16384 16384
ReadX 12945 352 16384 16384
ReadX 12945 416 16384 16384
ReadX 12945 480 16384 16384
ReadX 12945 552 16384 16384
ReadX 12945 616 16384 16384
ReadX 12945 680 16384 16384
ReadX 12945 744 16384 16384
ReadX 12945 808 16384 16384
ReadX 12945 872 16384 16384
ReadX 12945 936 10240 10240
Close 12956
Close 12950
Close 12951
Close 12954
Close 12955
Close 12952
Close 12953
Close 12945
Close 12946
Close 12947
Close 12948
Close 12937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 12958
QUERY_FILE_INFORMATION 12958
Close 12958
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 12944
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 12959
QUERY_FILE_INFORMATION 12959
Close 12959
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12960
ReadX 12960 0 65471 65471
ReadX 12960 65471 63 63
ReadX 12960 65534 65471 65471
ReadX 12960 131005 63 63
ReadX 12960 131068 65471 65471
ReadX 12960 196539 63 63
ReadX 12960 196602 65471 65471
ReadX 12960 262073 63 63
ReadX 12960 262136 65471 65471
ReadX 12960 327607 63 63
ReadX 12960 327670 10 10
Close 12960
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12961
ReadX 12961 0 65471 65471
ReadX 12961 65471 63 63
ReadX 12961 65534 65471 65471
ReadX 12961 131005 63 63
ReadX 12961 131068 65471 65471
ReadX 12961 196539 63 63
ReadX 12961 196602 65471 65471
ReadX 12961 262073 63 63
ReadX 12961 262136 65471 65471
ReadX 12961 327607 63 63
ReadX 12961 327670 65471 65471
ReadX 12961 393141 63 63
ReadX 12961 393204 65471 65471
ReadX 12961 458675 63 63
ReadX 12961 458738 65471 65471
ReadX 12961 524209 63 63
ReadX 12961 524272 65471 65471
ReadX 12961 589743 63 63
ReadX 12961 589806 65471 65471
ReadX 12961 655277 63 63
ReadX 12961 655340 32 32
Close 12961
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 12962
ReadX 12962 0 65471 65471
ReadX 12962 65471 63 63
ReadX 12962 65534 65471 65471
ReadX 12962 131005 63 63
ReadX 12962 131068 65471 65471
ReadX 12962 196539 63 63
ReadX 12962 196602 65471 65471
ReadX 12962 262073 63 63
ReadX 12962 262136 65471 65471
ReadX 12962 327607 63 63
ReadX 12962 327670 65471 65471
ReadX 12962 393141 63 63
ReadX 12962 393204 65471 65471
ReadX 12962 458675 63 63
ReadX 12962 458738 65471 65471
ReadX 12962 524209 63 63
ReadX 12962 524272 65471 65471
ReadX 12962 589743 63 63
ReadX 12962 589806 65471 65471
ReadX 12962 655277 63 63
ReadX 12962 655340 65471 65471
ReadX 12962 720811 63 63
ReadX 12962 720874 65471 65471
ReadX 12962 786345 63 63
ReadX 12962 786408 65471 65471
ReadX 12962 851879 63 63
ReadX 12962 851942 65471 65471
ReadX 12962 917413 63 63
ReadX 12962 917476 65471 65471
ReadX 12962 982947 63 63
ReadX 12962 983010 65471 65471
ReadX 12962 1048481 63 63
ReadX 12962 1048544 65471 65471
ReadX 12962 1114015 63 63
ReadX 12962 1114078 65471 65471
ReadX 12962 1179549 63 63
ReadX 12962 1179612 65471 65471
ReadX 12962 1245083 63 63
ReadX 12962 1245146 65471 65471
ReadX 12962 1310617 63 63
ReadX 12962 1310680 65471 65471
ReadX 12962 1376151 63 63
ReadX 12962 1376214 65471 65471
ReadX 12962 1441685 63 63
ReadX 12962 1441748 65471 65471
ReadX 12962 1507219 63 63
ReadX 12962 1507282 65471 65471
ReadX 12962 1572753 63 63
ReadX 12962 1572816 65471 65471
ReadX 12962 1638287 63 63
ReadX 12962 1638350 65471 65471
ReadX 12962 1703821 63 63
ReadX 12962 1703884 65471 65471
ReadX 12962 1769355 63 63
ReadX 12962 1769418 65471 65471
ReadX 12962 1834889 63 63
ReadX 12962 1834952 32824 32824
Close 12962
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12963
QUERY_FILE_INFORMATION 12963
ReadX 12963 0 512 512
ReadX 12963 512 512 512
ReadX 12963 1024 512 512
QUERY_FILE_INFORMATION 12963
QUERY_FILE_INFORMATION 12963
ReadX 12963 2560 2048 2048
ReadX 12963 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 12964
WriteX 12964 52 1 1
QUERY_FILE_INFORMATION 12964
WriteX 12964 0 53 53
Close 12964
ReadX 12963 2208 650 650
ReadX 12963 1920 2048 2048
ReadX 12963 2112 2048 2048
ReadX 12963 1856 2048 2048
ReadX 12963 1824 2048 2048
ReadX 12963 1536 512 512
ReadX 12963 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12965
Close 12965
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12963 1568 512 512
ReadX 12963 1536 512 512
ReadX 12963 2176 384 384
ReadX 12963 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12966
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 12963 288 2048 2048
ReadX 12963 2336 2048 2048
ReadX 12963 4384 2048 2048
ReadX 12963 6432 2048 2048
ReadX 12963 8480 2048 2048
ReadX 12963 10528 2048 2048
ReadX 12963 12576 2048 2048
WriteX 12966 15359 1 1
QUERY_FILE_INFORMATION 12966
ReadX 12963 14624 2048 2048
ReadX 12963 16672 2048 2048
ReadX 12963 18720 2048 2048
ReadX 12963 1728 2048 2048
WriteX 12966 0 15360 15360
Close 12966
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 12967
QUERY_FILE_INFORMATION 12967
ReadX 12967 0 512 512
ReadX 12967 2048 512 512
ReadX 12967 2560 512 512
QUERY_FILE_INFORMATION 12967
QUERY_FILE_INFORMATION 12967
QUERY_FILE_INFORMATION 12967
QUERY_FILE_INFORMATION 12967
QUERY_FILE_INFORMATION 12967
WriteX 12967 2152 384 384
QUERY_FILE_INFORMATION 12967
WriteX 12967 2150 22 22
WriteX 12967 2144 106 106
QUERY_FILE_INFORMATION 12967
WriteX 12967 2176 496 496
ReadX 12967 2176 496 496
QUERY_FILE_INFORMATION 12967
WriteX 12967 2440 384 384
QUERY_FILE_INFORMATION 12967
WriteX 12967 2152 384 384
WriteX 12967 2432 112 112
QUERY_FILE_INFORMATION 12967
WriteX 12967 2439 16 16
QUERY_FILE_INFORMATION 12967
WriteX 12967 2208 220 220
ReadX 12967 2208 220 220
QUERY_FILE_INFORMATION 12967
QUERY_FILE_INFORMATION 12967
WriteX 12967 2440 220 220
QUERY_FILE_INFORMATION 12967
WriteX 12967 2453 36 36
WriteX 12967 2080 512 512
WriteX 12967 2176 512 512
WriteX 12967 2112 512 512
WriteX 12967 2048 512 512
WriteX 12967 0 512 512
QUERY_FILE_INFORMATION 12963
QUERY_FILE_INFORMATION 12963
WriteX 12967 2080 512 512
Close 12967
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 12968
Close 12968
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12969
QUERY_FILE_INFORMATION 12969
ReadX 12969 0 512 512
ReadX 12969 2048 512 512
ReadX 12969 2560 512 512
QUERY_FILE_INFORMATION 12969
QUERY_FILE_INFORMATION 12969
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 12970
Close 12970
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 12963
ReadX 12969 1408 512 512
ReadX 12969 2048 512 512
ReadX 12969 1536 512 512
ReadX 12969 2560 512 512
ReadX 12969 3072 512 512
ReadX 12969 3584 512 512
ReadX 12969 4096 512 512
ReadX 12969 4608 512 512
ReadX 12969 5120 512 512
ReadX 12969 5632 512 512
ReadX 12969 6144 512 512
ReadX 12969 6656 512 512
ReadX 12969 7168 512 512
ReadX 12969 7680 512 512
ReadX 12969 8192 512 512
ReadX 12969 8704 512 512
ReadX 12969 9216 512 512
ReadX 12969 9728 512 512
ReadX 12969 10240 512 512
ReadX 12969 10752 512 512
ReadX 12969 11264 512 512
ReadX 12969 11776 512 512
ReadX 12969 12288 512 512
ReadX 12969 12800 512 512
ReadX 12969 13312 512 512
ReadX 12969 13824 512 512
ReadX 12969 14336 512 512
ReadX 12969 14848 512 512
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 15360 512 0
ReadX 12969 2560 2048 2048
ReadX 12969 4608 2048 2048
ReadX 12969 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12971
QUERY_FILE_INFORMATION 12971
ReadX 12971 0 512 512
ReadX 12971 512 512 512
ReadX 12971 1024 512 512
QUERY_FILE_INFORMATION 12971
QUERY_FILE_INFORMATION 12971
ReadX 12971 352 2048 2048
ReadX 12971 608 1097 1097
ReadX 12971 576 1609 1609
ReadX 12971 4096 512 512
ReadX 12971 1536 512 512
ReadX 12971 3840 256 256
ReadX 12971 288 576 576
ReadX 12971 512 512 512
ReadX 12971 480 512 512
ReadX 12971 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 12972
ReadX 12972 0 4096 4096
ReadX 12972 4096 4096 4096
ReadX 12972 8192 4096 4096
Close 12971
Close 12972
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12973
WriteX 12973 15359 1 1
QUERY_FILE_INFORMATION 12973
WriteX 12973 0 15360 15360
Close 12973
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 12974
QUERY_FILE_INFORMATION 12974
ReadX 12974 0 512 512
ReadX 12974 2048 512 512
ReadX 12974 2560 512 512
QUERY_FILE_INFORMATION 12974
QUERY_FILE_INFORMATION 12974
QUERY_FILE_INFORMATION 12974
QUERY_FILE_INFORMATION 12974
QUERY_FILE_INFORMATION 12974
WriteX 12974 2152 384 384
QUERY_FILE_INFORMATION 12974
WriteX 12974 2150 22 22
WriteX 12974 2144 106 106
QUERY_FILE_INFORMATION 12974
WriteX 12974 2176 476 476
ReadX 12974 2176 476 476
QUERY_FILE_INFORMATION 12974
WriteX 12974 2440 384 384
QUERY_FILE_INFORMATION 12974
WriteX 12974 2152 384 384
WriteX 12974 2432 92 92
QUERY_FILE_INFORMATION 12974
WriteX 12974 2437 36 36
QUERY_FILE_INFORMATION 12974
WriteX 12974 2208 220 220
ReadX 12974 2208 220 220
QUERY_FILE_INFORMATION 12974
QUERY_FILE_INFORMATION 12974
WriteX 12974 2440 220 220
QUERY_FILE_INFORMATION 12974
WriteX 12974 2453 36 36
WriteX 12974 2080 512 512
WriteX 12974 2176 512 512
WriteX 12974 2112 512 512
WriteX 12974 2048 512 512
WriteX 12974 0 512 512
QUERY_FILE_INFORMATION 12969
QUERY_FILE_INFORMATION 12969
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 12969
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12975
Close 12975
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12976
QUERY_FILE_INFORMATION 12976
ReadX 12976 0 512 512
ReadX 12976 2048 512 512
ReadX 12976 2560 512 512
QUERY_FILE_INFORMATION 12976
QUERY_FILE_INFORMATION 12976
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 12977
Close 12977
WriteX 12974 2080 512 512
Close 12974
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 12978
Close 12978
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 12979
QUERY_FILE_INFORMATION 12979
ReadX 12979 0 512 512
ReadX 12979 2048 512 512
ReadX 12979 2560 512 512
QUERY_FILE_INFORMATION 12979
QUERY_FILE_INFORMATION 12979
ReadX 12979 1312 512 512
ReadX 12979 1536 512 512
ReadX 12979 2048 512 512
ReadX 12979 576 512 512
ReadX 12979 1088 512 512
ReadX 12979 1056 512 512
ReadX 12979 1120 512 512
ReadX 12979 1184 512 512
ReadX 12979 2560 2048 2048
ReadX 12979 4608 2048 2048
ReadX 12979 6656 2048 2048
ReadX 12979 8704 2048 2048
ReadX 12979 10752 2048 2048
ReadX 12979 12800 2048 2048
ReadX 12979 14848 2048 512
ReadX 12979 15360 1536 0
ReadX 12979 1088 2048 2048
ReadX 12979 3136 2048 2048
ReadX 12979 1665 5835 5835
ReadX 12979 1856 2048 2048
ReadX 12979 2112 512 512
ReadX 12979 2152 384 384
ReadX 12979 2432 92 92
ReadX 12979 2176 512 512
ReadX 12979 2440 220 220
QUERY_FILE_INFORMATION 12979
QUERY_FILE_INFORMATION 12979
ReadX 12979 2432 512 512
WriteX 12979 2272 512 512
ReadX 12979 2144 512 512
WriteX 12979 2304 512 512
WriteX 12979 2272 92 92
WriteX 12979 2208 512 512
WriteX 12979 2720 512 512
WriteX 12979 0 512 512
QUERY_FILE_INFORMATION 12979
QUERY_FILE_INFORMATION 12979
ReadX 12979 1312 4096 4096
ReadX 12979 5408 4096 4096
ReadX 12979 9504 3305 3305
ReadX 12979 512 4096 4096
QUERY_FILE_INFORMATION 12979
QUERY_FILE_INFORMATION 12979
QUERY_FILE_INFORMATION 12979
WriteX 12979 3132 50 50
WriteX 12979 3182 4096 4096
WriteX 12979 7278 4096 4096
WriteX 12979 15469 1 1
QUERY_FILE_INFORMATION 12979
WriteX 12979 11374 4096 4096
WriteX 12979 15470 3584 3584
WriteX 12979 2144 512 512
WriteX 12979 2336 4096 4096
WriteX 12979 6432 4096 4096
WriteX 12979 10528 4096 4096
WriteX 12979 14624 462 462
WriteX 12979 2048 512 512
WriteX 12979 2560 512 512
WriteX 12979 0 512 512
QUERY_FILE_INFORMATION 12979
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 0 512 512
ReadX 12980 1152 512 512
ReadX 12980 1664 512 512
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 512 2048 2048
ReadX 12980 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 12981
WriteX 12981 52 1 1
QUERY_FILE_INFORMATION 12981
WriteX 12981 0 53 53
Close 12981
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 1120 504 504
ReadX 12980 896 2048 2048
ReadX 12980 1056 1528 1528
ReadX 12980 864 2048 2048
ReadX 12980 832 2048 2048
ReadX 12980 736 2048 2048
ReadX 12980 1216 512 512
ReadX 12980 1256 384 384
ReadX 12980 1536 140 140
ReadX 12980 1280 512 512
ReadX 12980 1548 252 252
ReadX 12979 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12982
Close 12982
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12980 2560 2048 2048
ReadX 12980 4608 2048 2048
ReadX 12980 6656 2048 2048
ReadX 12980 8704 2048 2048
ReadX 12980 10752 2048 2048
WriteX 12983 12005 1 1
QUERY_FILE_INFORMATION 12983
WriteX 12983 0 12006 12006
Close 12983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 12984
QUERY_FILE_INFORMATION 12984
ReadX 12984 0 512 512
ReadX 12984 1152 512 512
ReadX 12984 1664 512 512
QUERY_FILE_INFORMATION 12984
QUERY_FILE_INFORMATION 12984
QUERY_FILE_INFORMATION 12984
QUERY_FILE_INFORMATION 12984
QUERY_FILE_INFORMATION 12984
QUERY_FILE_INFORMATION 12984
QUERY_FILE_INFORMATION 12984
WriteX 12984 1256 384 384
QUERY_FILE_INFORMATION 12984
WriteX 12984 1254 22 22
WriteX 12984 1248 106 106
QUERY_FILE_INFORMATION 12984
WriteX 12984 1280 508 508
ReadX 12984 1280 508 508
QUERY_FILE_INFORMATION 12984
WriteX 12984 1544 384 384
QUERY_FILE_INFORMATION 12984
WriteX 12984 1256 384 384
WriteX 12984 1536 124 124
QUERY_FILE_INFORMATION 12984
WriteX 12984 1543 4 4
QUERY_FILE_INFORMATION 12984
WriteX 12984 1312 252 252
ReadX 12984 1312 252 252
QUERY_FILE_INFORMATION 12984
QUERY_FILE_INFORMATION 12984
WriteX 12984 1544 252 252
QUERY_FILE_INFORMATION 12984
WriteX 12984 1559 4 4
WriteX 12984 1184 512 512
WriteX 12984 1280 512 512
WriteX 12984 1216 512 512
WriteX 12984 1152 512 512
WriteX 12984 0 512 512
QUERY_FILE_INFORMATION 12980
QUERY_FILE_INFORMATION 12980
WriteX 12984 1184 512 512
Close 12984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 12985
Close 12985
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12986
QUERY_FILE_INFORMATION 12986
ReadX 12986 0 512 512
ReadX 12986 1152 512 512
ReadX 12986 1664 512 512
QUERY_FILE_INFORMATION 12986
QUERY_FILE_INFORMATION 12986
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 12987
Close 12987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 12980
ReadX 12986 736 512 512
ReadX 12986 1536 2048 2048
ReadX 12986 3584 2048 2048
ReadX 12986 5632 2048 2048
ReadX 12986 7680 2048 2048
ReadX 12986 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12988
WriteX 12988 11990 1 1
QUERY_FILE_INFORMATION 12988
WriteX 12988 0 11991 11991
Close 12988
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 12989
QUERY_FILE_INFORMATION 12989
ReadX 12989 0 512 512
ReadX 12989 1184 512 512
ReadX 12989 1696 512 512
QUERY_FILE_INFORMATION 12989
QUERY_FILE_INFORMATION 12989
QUERY_FILE_INFORMATION 12989
QUERY_FILE_INFORMATION 12989
QUERY_FILE_INFORMATION 12989
QUERY_FILE_INFORMATION 12989
QUERY_FILE_INFORMATION 12989
WriteX 12989 1288 384 384
QUERY_FILE_INFORMATION 12989
WriteX 12989 1286 22 22
WriteX 12989 1280 106 106
QUERY_FILE_INFORMATION 12989
WriteX 12989 1312 508 508
ReadX 12989 1312 508 508
QUERY_FILE_INFORMATION 12989
WriteX 12989 1576 384 384
QUERY_FILE_INFORMATION 12989
WriteX 12989 1288 384 384
WriteX 12989 1568 124 124
QUERY_FILE_INFORMATION 12989
WriteX 12989 1575 4 4
QUERY_FILE_INFORMATION 12989
WriteX 12989 1344 252 252
ReadX 12989 1344 252 252
QUERY_FILE_INFORMATION 12989
QUERY_FILE_INFORMATION 12989
WriteX 12989 1576 252 252
QUERY_FILE_INFORMATION 12989
WriteX 12989 1591 4 4
WriteX 12989 1216 512 512
WriteX 12989 1312 512 512
WriteX 12989 1248 512 512
WriteX 12989 1184 512 512
WriteX 12989 0 512 512
QUERY_FILE_INFORMATION 12986
QUERY_FILE_INFORMATION 12986
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 12986
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12990
Close 12990
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12991
QUERY_FILE_INFORMATION 12991
ReadX 12991 0 512 512
ReadX 12991 1152 512 512
ReadX 12991 1664 512 512
QUERY_FILE_INFORMATION 12991
QUERY_FILE_INFORMATION 12991
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 12992
Close 12992
WriteX 12989 1216 512 512
Close 12989
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 12993
Close 12993
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 12994
QUERY_FILE_INFORMATION 12994
ReadX 12994 0 512 512
ReadX 12994 1184 512 512
ReadX 12994 1696 512 512
QUERY_FILE_INFORMATION 12994
QUERY_FILE_INFORMATION 12994
ReadX 12994 1536 512 512
ReadX 12994 736 512 512
ReadX 12994 2048 512 512
ReadX 12994 2560 512 512
ReadX 12994 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12995
Close 12995
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 12994 914 3899 3899
ReadX 12994 1248 512 512
ReadX 12994 1288 384 384
ReadX 12994 1568 124 124
ReadX 12994 1312 512 512
ReadX 12994 1576 252 252
QUERY_FILE_INFORMATION 12994
QUERY_FILE_INFORMATION 12994
ReadX 12994 1568 512 512
WriteX 12994 1408 512 512
ReadX 12994 1280 512 512
WriteX 12994 1440 512 512
WriteX 12994 1408 124 124
WriteX 12994 1344 512 512
WriteX 12994 1856 512 512
WriteX 12994 0 512 512
QUERY_FILE_INFORMATION 12994
QUERY_FILE_INFORMATION 12994
ReadX 12994 544 4096 4096
ReadX 12994 4640 4096 4096
ReadX 12994 8736 1637 1637
ReadX 12994 512 4096 4096
QUERY_FILE_INFORMATION 12994
QUERY_FILE_INFORMATION 12994
WriteX 12994 1280 512 512
WriteX 12994 1472 3584 3584
WriteX 12994 5056 4096 4096
WriteX 12994 13247 1 1
QUERY_FILE_INFORMATION 12994
WriteX 12994 9152 4096 4096
WriteX 12994 13248 1736 1736
WriteX 12994 1184 512 512
WriteX 12994 1696 512 512
WriteX 12994 0 512 512
QUERY_FILE_INFORMATION 12994
ReadX 12994 1632 1024 1024
ReadX 12994 288 1024 1024
ReadX 12994 1312 2048 2048
ReadX 12994 3360 1024 1024
ReadX 12994 1696 1024 1024
ReadX 12994 2720 512 512
ReadX 12994 3232 512 512
ReadX 12994 3744 512 512
ReadX 12994 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 12994 2066 3998 3998
ReadX 12994 1448 384 384
ReadX 12994 1408 124 124
ReadX 12994 1416 252 252
QUERY_FILE_INFORMATION 12994
QUERY_FILE_INFORMATION 12994
ReadX 12994 1408 512 512
WriteX 12994 1536 512 512
ReadX 12994 1440 512 512
WriteX 12994 2048 512 512
WriteX 12994 1536 124 124
WriteX 12994 512 512 512
WriteX 12994 1024 512 512
WriteX 12994 0 512 512
QUERY_FILE_INFORMATION 12994
ReadX 12994 1696 4096 4096
ReadX 12994 5792 4096 4096
ReadX 12994 9888 1736 1736
ReadX 12994 1280 512 512
ReadX 12994 1472 3584 3584
QUERY_FILE_INFORMATION 12994
QUERY_FILE_INFORMATION 12994
WriteX 12994 3940 156 156
WriteX 12994 4096 512 512
WriteX 12994 544 3584 3584
WriteX 12994 4128 4096 4096
WriteX 12994 8224 3584 3584
WriteX 12994 1344 512 512
WriteX 12994 1856 1536 1536
WriteX 12994 2336 512 512
WriteX 12994 3584 356 356
WriteX 12994 2560 512 512
WriteX 12994 3072 512 512
WriteX 12994 0 512 512
QUERY_FILE_INFORMATION 12994
Close 12976
Close 12979
Close 12994
Close 12991
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 12996
Close 12996
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 12997
Close 12997
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 12998
WriteX 12998 0 65471 65471
WriteX 12998 65471 63 63
WriteX 12998 65534 65471 65471
WriteX 12998 131005 63 63
Close 12998
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 12999
WriteX 12999 0 65471 65471
WriteX 12999 65471 63 63
WriteX 12999 65534 65471 65471
WriteX 12999 131005 63 63
WriteX 12999 131068 65471 65471
WriteX 12999 196539 63 63
WriteX 12999 196602 65471 65471
WriteX 12999 262073 63 63
Close 12999
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13000
WriteX 13000 0 65471 65471
WriteX 13000 65471 63 63
WriteX 13000 65534 65471 65471
WriteX 13000 131005 63 63
WriteX 13000 131068 65471 65471
WriteX 13000 196539 63 63
WriteX 13000 196602 65471 65471
WriteX 13000 262073 63 63
WriteX 13000 262136 65471 65471
WriteX 13000 327607 63 63
WriteX 13000 327670 65471 65471
WriteX 13000 393141 63 63
WriteX 13000 393204 65471 65471
WriteX 13000 458675 63 63
WriteX 13000 458738 65471 65471
WriteX 13000 524209 63 63
Close 13000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13001
QUERY_FILE_INFORMATION 13001
QUERY_FILE_INFORMATION 13001
ReadX 13001 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13002
Close 13002
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13003
WriteX 13003 63 1 1
QUERY_FILE_INFORMATION 13003
WriteX 13003 0 64 64
ReadX 13001 992 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 344 2048 2048
ReadX 13001 1344 2048 2048
ReadX 13001 1352 2048 2048
ReadX 13001 1320 2048 2048
ReadX 13001 1360 2048 2048
ReadX 13001 1344 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2304 2048 2048
ReadX 13001 1472 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 1480 2048 2048
ReadX 13001 1488 2048 2048
ReadX 13001 1496 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 1504 2048 2048
ReadX 13001 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 1000 2048 2048
ReadX 13001 1416 2048 2048
ReadX 13001 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13001 360 2048 2048
ReadX 13001 368 2048 2048
ReadX 13001 360 2048 2048
ReadX 13001 376 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 1232 2048 2048
ReadX 13001 2432 6144 6144
ReadX 13001 2376 2048 2048
ReadX 13001 2360 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 2376 2048 2048
ReadX 13001 2384 2048 2048
ReadX 13001 2368 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 1296 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 13001 0 2048 2048
ReadX 13001 2688 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 2688 2048 2048
WriteX 13001 2688 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 2688 2048 2048
ReadX 13001 2688 2048 2048
ReadX 13001 2688 2048 2048
WriteX 13001 2688 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13001 2688 2048 2048
ReadX 13001 2688 2048 2048
WriteX 13001 2688 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 320 4096 4096
ReadX 13001 0 2048 2048
ReadX 13001 3584 2048 2048
ReadX 13001 3584 2048 2048
ReadX 13001 3584 2048 2048
ReadX 13001 0 2048 2048
WriteX 13001 3584 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2688 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 2688 2048 2048
ReadX 13001 2688 2048 2048
WriteX 13001 2688 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 3200 2048 2048
ReadX 13001 3200 2048 2048
ReadX 13001 3200 2048 2048
WriteX 13001 3200 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 3456 2048 2048
ReadX 13001 3456 2048 2048
ReadX 13001 3456 2048 2048
WriteX 13001 3456 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2496 2048 2048
ReadX 13001 2472 2048 2048
ReadX 13001 2456 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 2472 2048 2048
ReadX 13001 2480 2048 2048
ReadX 13001 2464 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 2488 2048 2048
ReadX 13001 2568 8192 8192
ReadX 13001 1000 2048 2048
ReadX 13001 328 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 2048 2048 2048
ReadX 13001 2560 2048 2048
ReadX 13001 920 2048 2048
WriteX 13001 2048 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 312 2048 2048
WriteX 13001 336 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 328 2048 2048
WriteX 13001 2560 2048 2048
WriteX 13001 3840 2048 2048
WriteX 13001 920 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2432 2048 2048
WriteX 13001 2432 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2456 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 328 2048 2048
ReadX 13001 2560 2048 2048
ReadX 13001 2048 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 336 2048 2048
ReadX 13001 920 2048 2048
WriteX 13001 1536 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 2048 2048 2048
WriteX 13001 2560 2048 2048
WriteX 13001 336 2048 2048
WriteX 13001 920 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2048 2048 2048
ReadX 13001 2432 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 2048 2048 2048
WriteX 13001 2432 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2456 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1536 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 336 2048 2048
ReadX 13001 920 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 1536 2048 2048
WriteX 13001 336 2048 2048
WriteX 13001 920 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2432 2048 2048
WriteX 13001 2432 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2456 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1536 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 336 2048 2048
ReadX 13001 920 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 1536 2048 2048
WriteX 13001 336 2048 2048
WriteX 13001 920 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2432 2048 2048
WriteX 13001 2432 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2456 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1536 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 336 2048 2048
ReadX 13001 920 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 1536 2048 2048
WriteX 13001 336 2048 2048
WriteX 13001 920 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2432 2048 2048
WriteX 13001 2432 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2456 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1536 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 336 2048 2048
ReadX 13001 920 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 1536 2048 2048
WriteX 13001 336 2048 2048
WriteX 13001 920 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2432 2048 2048
WriteX 13001 2432 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
Flush 13001
ReadX 13001 2456 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1536 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 336 2048 2048
ReadX 13001 920 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 1536 2048 2048
WriteX 13001 336 2048 2048
WriteX 13001 920 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2432 2048 2048
WriteX 13001 2432 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2624 6144 6144
ReadX 13001 2616 2048 2048
ReadX 13001 2688 2048 2048
ReadX 13001 2600 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 2616 2048 2048
ReadX 13001 2608 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 344 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 520 2048 2048
ReadX 13001 1392 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 400 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 536 2048 2048
ReadX 13001 824 2048 2048
ReadX 13001 832 2048 2048
ReadX 13001 384 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 408 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 552 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 824 2048 2048
ReadX 13001 840 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 768 2048 2048
ReadX 13001 2048 2048 2048
WriteX 13001 1415 1 1
WriteX 13001 352 2048 2048
WriteX 13001 1112 2048 2048
WriteX 13001 1400 2048 2048
WriteX 13001 1408 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 2048 2048 2048
WriteX 13001 768 2048 2048
WriteX 13001 344 2048 2048
WriteX 13001 1000 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 416 2048 2048
ReadX 13001 424 2048 2048
ReadX 13001 432 2048 2048
ReadX 13001 440 2048 2048
ReadX 13001 576 16384 16384
ReadX 13001 448 2048 2048
ReadX 13001 456 2048 2048
ReadX 13001 464 2048 2048
ReadX 13001 640 16384 16384
ReadX 13001 704 16384 16384
ReadX 13001 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 13001 848 2048 2048
ReadX 13001 560 2048 2048
ReadX 13001 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 2600 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 352 2048 2048
ReadX 13001 1928 8192 8192
ReadX 13001 528 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 824 2048 2048
ReadX 13001 0 2048 2048
Flush 13001
ReadX 13001 2600 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 352 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 824 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 856 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 392 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 472 2048 2048
ReadX 13001 480 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 488 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 928 2048 2048
ReadX 13001 936 2048 2048
ReadX 13001 976 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 392 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 952 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 528 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 528 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 816 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13001 1336 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 528 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 528 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1240 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2200 4096 4096
ReadX 13001 2152 2048 2048
ReadX 13001 2160 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1312 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 1928 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 824 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1416 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 352 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 824 2048 2048
ReadX 13001 384 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13001 352 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 768 2048 2048
ReadX 13001 2048 2048 2048
ReadX 13001 352 2048 2048
WriteX 13001 1551 1 1
WriteX 13001 1512 2048 2048
WriteX 13001 1520 2048 2048
WriteX 13001 1528 2048 2048
WriteX 13001 1544 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 2048 2048 2048
WriteX 13001 768 2048 2048
WriteX 13001 344 2048 2048
WriteX 13001 1000 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2048 2048 2048
WriteX 13001 2048 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 1000 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1240 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 344 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 384 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 768 2048 2048
WriteX 13001 1567 1 1
WriteX 13001 1552 2048 2048
WriteX 13001 1560 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 768 2048 2048
WriteX 13001 344 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 1328 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1240 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2200 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1240 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 344 2048 2048
ReadX 13001 384 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 2048 2048 2048
ReadX 13001 768 2048 2048
WriteX 13001 1583 1 1
WriteX 13001 1568 2048 2048
WriteX 13001 1576 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 2048 2048 2048
WriteX 13001 768 2048 2048
WriteX 13001 344 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 864 2048 2048
ReadX 13001 872 2048 2048
ReadX 13001 912 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 2688 2048 2048
ReadX 13001 1000 2048 2048
WriteX 13001 2688 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 2944 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 0 2048 2048
Flush 13001
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 2688 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 2688 2048 2048
WriteX 13001 2688 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 392 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 416 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 416 2048 2048
ReadX 13001 864 2048 2048
ReadX 13001 872 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 312 2048 2048
ReadX 13001 888 2048 2048
ReadX 13001 400 2048 2048
ReadX 13001 896 2048 2048
WriteX 13001 1584 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 400 2048 2048
WriteX 13001 416 2048 2048
WriteX 13001 864 2048 2048
WriteX 13001 872 2048 2048
WriteX 13001 888 2048 2048
WriteX 13001 896 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 584 2048 2048
ReadX 13001 392 2048 2048
WriteX 13001 392 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 1328 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 0 2048 2048
ReadX 13001 408 2048 2048
ReadX 13001 1328 2048 2048
ReadX 13001 864 2048 2048
ReadX 13001 912 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 3840 2048 2048
ReadX 13001 312 2048 2048
ReadX 13001 1584 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 408 2048 2048
WriteX 13001 912 2048 2048
WriteX 13001 1584 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 408 2048 2048
ReadX 13001 392 2048 2048
WriteX 13001 392 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 528 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 528 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 552 2048 2048
ReadX 13001 1336 2048 2048
WriteX 13001 552 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 0 2048 2048
ReadX 13001 552 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 2664 2048 2048
ReadX 13001 2648 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 2672 2048 2048
ReadX 13001 2656 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13001 528 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 1336 2048 2048
ReadX 13001 2680 2048 2048
ReadX 13001 2760 8192 8192
ReadX 13001 544 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 568 2048 2048
ReadX 13001 544 2048 2048
ReadX 13001 0 2048 2048
Flush 13001
ReadX 13001 2816 6144 6144
ReadX 13001 2760 2048 2048
ReadX 13001 2744 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 2752 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 528 2048 2048
ReadX 13001 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13005
Close 13005
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13007
WriteX 13007 4065 1 1
QUERY_FILE_INFORMATION 13007
WriteX 13007 0 62591 62591
Close 13007
ReadX 13001 0 2048 2048
ReadX 13001 2808 2048 2048
ReadX 13001 2792 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 2800 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 384 2048 2048
ReadX 13001 392 2048 2048
ReadX 13001 1384 2048 2048
ReadX 13001 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13009
Close 13009
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13011
WriteX 13011 4094 1 1
QUERY_FILE_INFORMATION 13011
WriteX 13011 0 10845 10845
Close 13011
ReadX 13001 1432 2048 2048
ReadX 13001 1304 2048 2048
ReadX 13001 1368 2048 2048
ReadX 13001 2304 2048 2048
ReadX 13001 1440 2048 2048
ReadX 13001 1424 2048 2048
ReadX 13001 1448 2048 2048
ReadX 13001 1456 2048 2048
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13013
Close 13013
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13015
ReadX 13001 0 2048 2048
WriteX 13015 4081 1 1
QUERY_FILE_INFORMATION 13015
WriteX 13015 0 30118 30118
Close 13015
ReadX 13001 1344 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1152 2048 2048
ReadX 13001 1152 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 1000 2048 2048
ReadX 13001 768 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 344 2048 2048
WriteX 13001 1000 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 1416 2048 2048
ReadX 13001 1416 2048 2048
ReadX 13001 344 2048 2048
ReadX 13001 896 2048 2048
WriteX 13001 1538 2 2
WriteX 13001 344 2048 2048
WriteX 13001 1416 2048 2048
WriteX 13001 1538 2 2
ReadX 13001 2048 2048 2048
WriteX 13001 2048 2048 2048
WriteX 13001 1538 2 2
Close 13001
Close 13003
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13016
ReadX 13016 0 65471 65471
ReadX 13016 65471 63 63
ReadX 13016 65534 65471 65471
ReadX 13016 131005 63 63
ReadX 13016 131068 65471 65471
ReadX 13016 196539 63 63
ReadX 13016 196602 65471 65471
ReadX 13016 262073 63 63
ReadX 13016 262136 65471 65471
ReadX 13016 327607 63 63
ReadX 13016 327670 10 10
Close 13016
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13017
ReadX 13017 0 65471 65471
ReadX 13017 65471 63 63
ReadX 13017 65534 65471 65471
ReadX 13017 131005 63 63
ReadX 13017 131068 65471 65471
ReadX 13017 196539 63 63
ReadX 13017 196602 65471 65471
ReadX 13017 262073 63 63
ReadX 13017 262136 65471 65471
ReadX 13017 327607 63 63
ReadX 13017 327670 65471 65471
ReadX 13017 393141 63 63
ReadX 13017 393204 65471 65471
ReadX 13017 458675 63 63
ReadX 13017 458738 65471 65471
ReadX 13017 524209 63 63
ReadX 13017 524272 65471 65471
ReadX 13017 589743 63 63
ReadX 13017 589806 65471 65471
ReadX 13017 655277 63 63
ReadX 13017 655340 32 32
Close 13017
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13018
ReadX 13018 0 65471 65471
ReadX 13018 65471 63 63
ReadX 13018 65534 65471 65471
ReadX 13018 131005 63 63
ReadX 13018 131068 65471 65471
ReadX 13018 196539 63 63
ReadX 13018 196602 65471 65471
ReadX 13018 262073 63 63
ReadX 13018 262136 65471 65471
ReadX 13018 327607 63 63
ReadX 13018 327670 65471 65471
ReadX 13018 393141 63 63
ReadX 13018 393204 65471 65471
ReadX 13018 458675 63 63
ReadX 13018 458738 65471 65471
ReadX 13018 524209 63 63
ReadX 13018 524272 65471 65471
ReadX 13018 589743 63 63
ReadX 13018 589806 65471 65471
ReadX 13018 655277 63 63
ReadX 13018 655340 65471 65471
ReadX 13018 720811 63 63
ReadX 13018 720874 65471 65471
ReadX 13018 786345 63 63
ReadX 13018 786408 65471 65471
ReadX 13018 851879 63 63
ReadX 13018 851942 65471 65471
ReadX 13018 917413 63 63
ReadX 13018 917476 65471 65471
ReadX 13018 982947 63 63
ReadX 13018 983010 65471 65471
ReadX 13018 1048481 63 63
ReadX 13018 1048544 65471 65471
ReadX 13018 1114015 63 63
ReadX 13018 1114078 65471 65471
ReadX 13018 1179549 63 63
ReadX 13018 1179612 65471 65471
ReadX 13018 1245083 63 63
ReadX 13018 1245146 65471 65471
ReadX 13018 1310617 63 63
ReadX 13018 1310680 65471 65471
ReadX 13018 1376151 63 63
ReadX 13018 1376214 65471 65471
ReadX 13018 1441685 63 63
ReadX 13018 1441748 65471 65471
ReadX 13018 1507219 63 63
ReadX 13018 1507282 65471 65471
ReadX 13018 1572753 63 63
ReadX 13018 1572816 65471 65471
ReadX 13018 1638287 63 63
ReadX 13018 1638350 65471 65471
ReadX 13018 1703821 63 63
ReadX 13018 1703884 65471 65471
ReadX 13018 1769355 63 63
ReadX 13018 1769418 65471 65471
ReadX 13018 1834889 63 63
ReadX 13018 1834952 32824 32824
Close 13018
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13019
Close 13019
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13020
ReadX 13020 0 24 24
Close 13020
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13021
QUERY_FILE_INFORMATION 13021
ReadX 13021 0 512 512
ReadX 13021 464 512 512
ReadX 13021 498 512 512
ReadX 13021 472 512 512
ReadX 13021 466 512 512
ReadX 13021 978 512 512
ReadX 13021 497 57 57
Close 13021
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13022
QUERY_FILE_INFORMATION 13022
ReadX 13022 0 512 512
ReadX 13022 464 512 512
ReadX 13022 498 512 512
ReadX 13022 472 512 512
ReadX 13022 462 512 512
ReadX 13022 468 512 512
ReadX 13022 466 512 512
QUERY_FILE_INFORMATION 13022
WriteX 13022 482 60 60
WriteX 13022 482 4 4
QUERY_FILE_INFORMATION 13022
WriteX 13022 482 11 11
ReadX 13022 497 57 57
ReadX 13022 497 57 57
ReadX 13022 368 4096 4096
ReadX 13022 460 512 512
ReadX 13022 512 4096 4096
ReadX 13022 4608 4096 4096
ReadX 13022 8704 4096 4096
ReadX 13022 12800 4096 4096
ReadX 13022 16896 4096 4096
ReadX 13022 20992 4096 4096
ReadX 13022 25088 4096 4096
ReadX 13022 29184 4096 4096
ReadX 13022 33280 4096 4096
ReadX 13022 37376 4096 4096
ReadX 13022 41472 4096 4096
ReadX 13022 45568 4096 4096
ReadX 13022 49664 4096 4096
ReadX 13022 53760 4096 4096
ReadX 13022 57856 4096 4096
ReadX 13022 61952 4096 4096
ReadX 13022 66048 4096 4096
ReadX 13022 70144 4096 4096
ReadX 13022 497 20 20
ReadX 13022 496 103 103
ReadX 13022 500 448 448
ReadX 13022 470 512 512
ReadX 13022 486 2692 2692
ReadX 13022 290 4096 4096
ReadX 13022 4386 4096 4096
ReadX 13022 8482 4096 4096
ReadX 13022 500 20 20
ReadX 13022 483 108 108
ReadX 13022 482 292 292
ReadX 13022 338 4096 4096
ReadX 13022 4434 3103 3103
ReadX 13022 384 28 28
ReadX 13022 412 20 20
ReadX 13022 432 8 8
ReadX 13022 440 136 136
ReadX 13022 576 8 8
ReadX 13022 584 4 4
ReadX 13022 588 4 4
ReadX 13022 592 39 39
ReadX 13022 384 4 4
ReadX 13022 388 4 4
ReadX 13022 392 23 23
ReadX 13022 385 4 4
ReadX 13022 389 4 4
ReadX 13022 393 12 12
ReadX 13022 405 4 4
ReadX 13022 409 4 4
ReadX 13022 413 1 1
ReadX 13022 385 4 4
ReadX 13022 389 4 4
ReadX 13022 393 1 1
ReadX 13022 385 4 4
ReadX 13022 389 4 4
ReadX 13022 393 12 12
ReadX 13022 405 4 4
ReadX 13022 409 4 4
ReadX 13022 413 2 2
ReadX 13022 385 4 4
ReadX 13022 389 4 4
ReadX 13022 393 25 25
ReadX 13022 385 4 4
ReadX 13022 389 8 8
ReadX 13022 397 4 4
ReadX 13022 401 8 8
ReadX 13022 409 4 4
ReadX 13022 413 8 8
ReadX 13022 421 4 4
ReadX 13022 425 8 8
ReadX 13022 433 4 4
ReadX 13022 437 4 4
ReadX 13022 441 4 4
ReadX 13022 445 4 4
ReadX 13022 449 4 4
ReadX 13022 453 4 4
ReadX 13022 457 4 4
ReadX 13022 461 4 4
ReadX 13022 465 10670 10670
ReadX 13022 428 4096 4096
WriteX 13022 498 512 512
WriteX 13022 472 512 512
WriteX 13022 462 512 512
WriteX 13022 468 512 512
Close 13022
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13023
Close 13023
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13024
QUERY_FILE_INFORMATION 13024
ReadX 13024 0 512 512
ReadX 13024 464 512 512
ReadX 13024 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13025
Close 13025
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13024
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13027
WriteX 13027 4607 1 1
QUERY_FILE_INFORMATION 13027
WriteX 13027 0 65471 65471
WriteX 13027 65471 65 65
WriteX 13027 65536 19979 19979
Close 13027
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13028
QUERY_FILE_INFORMATION 13028
ReadX 13028 0 512 512
ReadX 13028 462 512 512
ReadX 13028 974 512 512
ReadX 13028 1486 512 512
ReadX 13028 460 512 512
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
WriteX 13028 470 448 448
QUERY_FILE_INFORMATION 13028
WriteX 13028 470 60 60
WriteX 13028 470 4 4
QUERY_FILE_INFORMATION 13028
WriteX 13028 470 11 11
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
WriteX 13028 464 512 512
WriteX 13028 976 512 512
WriteX 13028 1488 512 512
WriteX 13028 462 512 512
WriteX 13028 0 512 512
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
ReadX 13028 470 512 512
WriteX 13028 482 512 512
WriteX 13028 482 292 292
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
WriteX 13028 483 20 20
WriteX 13028 483 108 108
QUERY_FILE_INFORMATION 13028
WriteX 13028 484 448 448
QUERY_FILE_INFORMATION 13028
WriteX 13028 484 44 44
WriteX 13028 484 20 20
WriteX 13028 480 512 512
WriteX 13028 472 512 512
WriteX 13028 476 512 512
WriteX 13028 988 512 512
WriteX 13028 474 512 512
Flush 13028
WriteX 13028 0 512 512
Flush 13028
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
WriteX 13028 480 512 512
WriteX 13028 472 512 512
WriteX 13028 476 512 512
QUERY_FILE_INFORMATION 13028
WriteX 13028 496 320 320
QUERY_FILE_INFORMATION 13028
WriteX 13028 496 60 60
ReadX 13028 484 512 512
WriteX 13028 500 512 512
WriteX 13028 470 512 512
WriteX 13028 486 2692 2692
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
WriteX 13028 497 25 25
WriteX 13028 496 103 103
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
WriteX 13028 497 44 44
WriteX 13028 497 20 20
WriteX 13028 498 512 512
WriteX 13028 462 512 512
WriteX 13028 466 512 512
WriteX 13028 978 512 512
WriteX 13028 464 512 512
Flush 13028
WriteX 13028 0 512 512
Flush 13028
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
QUERY_FILE_INFORMATION 13028
WriteX 13028 497 7 7
WriteX 13028 497 57 57
WriteX 13028 498 512 512
WriteX 13028 472 512 512
WriteX 13028 462 512 512
WriteX 13028 466 512 512
WriteX 13028 978 512 512
Flush 13028
WriteX 13028 498 512 512
Flush 13028
Close 13028
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13029
QUERY_FILE_INFORMATION 13029
ReadX 13029 0 512 512
ReadX 13029 464 512 512
ReadX 13029 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13030
ReadX 13030 0 20 20
ReadX 13030 14 40 40
ReadX 13030 54 64 64
ReadX 13030 118 1152 1152
Close 13030
Close 13029
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13031
Close 13031
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13032
ReadX 13032 0 24 24
Close 13032
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13033
QUERY_FILE_INFORMATION 13033
ReadX 13033 0 512 512
ReadX 13033 464 512 512
ReadX 13033 498 512 512
ReadX 13033 472 512 512
ReadX 13033 462 512 512
ReadX 13033 466 512 512
ReadX 13033 978 512 512
ReadX 13033 497 57 57
Close 13033
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13034
QUERY_FILE_INFORMATION 13034
ReadX 13034 0 512 512
ReadX 13034 464 512 512
ReadX 13034 498 512 512
ReadX 13034 472 512 512
ReadX 13034 468 512 512
ReadX 13034 462 512 512
ReadX 13034 466 512 512
QUERY_FILE_INFORMATION 13034
WriteX 13034 482 60 60
WriteX 13034 482 4 4
QUERY_FILE_INFORMATION 13034
WriteX 13034 482 11 11
WriteX 13034 498 512 512
WriteX 13034 472 512 512
WriteX 13034 462 512 512
WriteX 13034 466 512 512
WriteX 13034 978 512 512
Close 13034
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13035
Close 13035
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13036
Close 13036
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13038
WriteX 13038 4607 1 1
QUERY_FILE_INFORMATION 13038
WriteX 13038 0 65471 65471
WriteX 13038 65471 65 65
WriteX 13038 65536 17654 17654
Close 13038
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13039
QUERY_FILE_INFORMATION 13039
ReadX 13039 0 512 512
ReadX 13039 474 512 512
ReadX 13039 986 512 512
ReadX 13039 1498 512 512
ReadX 13039 472 512 512
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
WriteX 13039 482 448 448
QUERY_FILE_INFORMATION 13039
WriteX 13039 482 60 60
WriteX 13039 482 4 4
QUERY_FILE_INFORMATION 13039
WriteX 13039 482 11 11
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
WriteX 13039 476 512 512
WriteX 13039 988 512 512
WriteX 13039 1500 512 512
WriteX 13039 474 512 512
WriteX 13039 0 512 512
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
ReadX 13039 482 512 512
WriteX 13039 494 512 512
WriteX 13039 494 292 292
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
WriteX 13039 495 20 20
WriteX 13039 495 108 108
QUERY_FILE_INFORMATION 13039
WriteX 13039 496 448 448
QUERY_FILE_INFORMATION 13039
WriteX 13039 496 44 44
WriteX 13039 496 20 20
WriteX 13039 492 512 512
WriteX 13039 484 512 512
WriteX 13039 488 512 512
WriteX 13039 1000 512 512
WriteX 13039 486 512 512
Flush 13039
WriteX 13039 0 512 512
Flush 13039
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
WriteX 13039 492 512 512
WriteX 13039 484 512 512
WriteX 13039 488 512 512
QUERY_FILE_INFORMATION 13039
WriteX 13039 508 320 320
QUERY_FILE_INFORMATION 13039
WriteX 13039 508 60 60
ReadX 13039 496 512 512
WriteX 13039 512 512 512
WriteX 13039 482 512 512
WriteX 13039 498 2692 2692
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
WriteX 13039 509 25 25
WriteX 13039 508 103 103
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
WriteX 13039 509 44 44
WriteX 13039 509 20 20
WriteX 13039 510 512 512
WriteX 13039 474 512 512
WriteX 13039 478 512 512
WriteX 13039 990 512 512
WriteX 13039 476 512 512
Flush 13039
WriteX 13039 0 512 512
Flush 13039
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
QUERY_FILE_INFORMATION 13039
WriteX 13039 509 7 7
WriteX 13039 509 57 57
WriteX 13039 510 512 512
WriteX 13039 484 512 512
WriteX 13039 474 512 512
WriteX 13039 478 512 512
WriteX 13039 990 512 512
Flush 13039
WriteX 13039 510 512 512
Flush 13039
Close 13039
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13040
Close 13040
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13041
QUERY_FILE_INFORMATION 13041
ReadX 13041 0 512 512
ReadX 13041 476 512 512
ReadX 13041 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13042
Close 13042
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13043
QUERY_FILE_INFORMATION 13043
ReadX 13043 0 512 512
ReadX 13043 512 512 512
ReadX 13043 770 512 512
ReadX 13043 1282 512 512
ReadX 13043 1794 512 512
ReadX 13043 2562 512 512
ReadX 13043 3586 512 512
ReadX 13043 3828 512 512
ReadX 13043 288 512 512
ReadX 13043 1024 512 512
ReadX 13043 954 512 512
ReadX 13043 295 512 512
ReadX 13043 320 512 512
ReadX 13043 322 512 512
ReadX 13043 834 512 512
ReadX 13043 1346 512 512
ReadX 13043 1858 512 512
ReadX 13043 323 512 512
ReadX 13043 835 512 512
ReadX 13043 1347 512 512
ReadX 13043 1859 512 512
ReadX 13043 2371 345 345
ReadX 13043 322 167 167
ReadX 13043 489 512 512
ReadX 13043 1001 512 512
ReadX 13043 1513 512 512
ReadX 13043 2025 512 512
ReadX 13043 2537 512 512
ReadX 13043 3049 512 512
ReadX 13043 3561 345 345
ReadX 13043 323 167 167
ReadX 13043 490 512 512
ReadX 13043 1002 512 512
ReadX 13043 1514 512 512
ReadX 13043 2026 512 512
ReadX 13043 2538 512 512
ReadX 13043 3050 512 512
ReadX 13043 3562 512 512
ReadX 13043 4074 512 512
ReadX 13043 4586 512 512
ReadX 13043 5098 512 512
ReadX 13043 5610 512 512
ReadX 13043 6122 512 512
ReadX 13043 6634 512 512
ReadX 13043 7146 512 512
ReadX 13043 7658 512 512
ReadX 13043 8170 512 512
ReadX 13043 8682 512 512
ReadX 13043 9194 512 512
ReadX 13043 9706 512 512
ReadX 13043 10218 512 512
ReadX 13043 10730 345 345
ReadX 13043 11075 512 512
ReadX 13043 11587 167 167
ReadX 13043 11754 512 512
ReadX 13043 12266 512 512
ReadX 13043 12778 512 512
ReadX 13043 13290 512 512
ReadX 13043 13802 512 512
ReadX 13043 14314 512 512
ReadX 13043 14826 512 512
ReadX 13043 15338 512 512
ReadX 13043 337 512 512
ReadX 13043 337 512 512
ReadX 13043 849 34 34
ReadX 13043 352 512 512
ReadX 13043 864 512 512
ReadX 13043 1376 512 512
ReadX 13043 1888 512 512
ReadX 13043 2400 512 512
ReadX 13043 2912 512 512
ReadX 13043 3424 512 512
ReadX 13043 3936 512 512
ReadX 13043 1632 512 512
ReadX 13043 2144 512 512
ReadX 13043 1682 512 512
ReadX 13043 258 512 512
ReadX 13043 360 144 144
ReadX 13043 2517 512 512
ReadX 13043 3029 512 512
ReadX 13043 1751 512 512
ReadX 13043 2263 512 512
ReadX 13043 2775 512 512
ReadX 13043 3287 512 512
ReadX 13043 3799 512 512
ReadX 13043 4311 512 512
ReadX 13043 4823 512 512
ReadX 13043 5335 512 512
ReadX 13043 5847 512 512
ReadX 13043 6359 512 512
ReadX 13043 6871 512 512
ReadX 13043 7383 512 512
ReadX 13043 7895 512 512
ReadX 13043 8407 512 512
ReadX 13043 8919 512 512
ReadX 13043 9431 512 512
ReadX 13043 9943 512 512
ReadX 13043 10455 512 512
ReadX 13043 10967 512 512
ReadX 13043 11479 512 512
ReadX 13043 2556 512 512
ReadX 13043 3068 512 512
ReadX 13043 3580 512 512
ReadX 13043 4092 512 512
ReadX 13043 4604 512 512
ReadX 13043 5116 512 512
ReadX 13043 5628 512 512
ReadX 13043 6140 512 512
ReadX 13043 6652 512 512
ReadX 13043 7164 512 512
ReadX 13043 7676 512 512
ReadX 13043 8188 512 512
ReadX 13043 8700 512 512
ReadX 13043 9212 512 512
ReadX 13043 9724 512 512
ReadX 13043 10236 512 512
ReadX 13043 10748 512 512
ReadX 13043 11260 512 512
ReadX 13043 11772 512 512
ReadX 13043 12284 512 512
ReadX 13043 12796 49 49
ReadX 13043 260 463 463
ReadX 13043 723 512 512
ReadX 13043 1235 512 512
ReadX 13043 1747 512 512
ReadX 13043 2259 512 512
ReadX 13043 2771 512 512
ReadX 13043 3283 512 512
ReadX 13043 3795 512 512
ReadX 13043 4307 512 512
ReadX 13043 4819 512 512
ReadX 13043 5331 512 512
ReadX 13043 5843 512 512
ReadX 13043 6355 512 512
ReadX 13043 6867 512 512
ReadX 13043 7379 512 512
ReadX 13043 7891 512 512
ReadX 13043 8403 512 512
ReadX 13043 8915 512 512
ReadX 13043 9427 512 512
ReadX 13043 9939 512 512
ReadX 13043 10451 512 512
ReadX 13043 10963 402 402
ReadX 13043 593 240 240
ReadX 13043 2048 272 272
ReadX 13043 2320 512 512
ReadX 13043 2832 512 512
ReadX 13043 3344 512 512
ReadX 13043 3856 512 512
ReadX 13043 4368 512 512
ReadX 13043 4880 512 512
ReadX 13043 5392 240 240
ReadX 13043 608 272 272
ReadX 13043 880 512 512
ReadX 13043 1392 512 512
ReadX 13043 1904 512 512
ReadX 13043 2416 512 512
ReadX 13043 2928 512 512
ReadX 13043 3440 512 512
ReadX 13043 3952 512 512
ReadX 13043 4464 512 512
ReadX 13043 4976 512 512
ReadX 13043 5488 512 512
ReadX 13043 6000 512 512
ReadX 13043 6512 512 512
ReadX 13043 7024 512 512
ReadX 13043 7536 512 512
ReadX 13043 8048 512 512
ReadX 13043 8560 512 512
ReadX 13043 9072 512 512
ReadX 13043 9584 512 512
ReadX 13043 10096 512 512
ReadX 13043 1683 512 512
ReadX 13043 514 512 512
ReadX 13043 620 512 512
ReadX 13043 770 512 512
ReadX 13043 1282 512 512
ReadX 13043 1794 512 512
ReadX 13043 2000 512 512
ReadX 13043 1434 512 512
ReadX 13043 2050 512 512
ReadX 13043 2118 512 512
ReadX 13043 1715 512 512
ReadX 13043 1024 512 512
ReadX 13043 954 512 512
ReadX 13043 1880 512 512
ReadX 13043 1286 512 512
ReadX 13043 1510 512 512
ReadX 13043 2562 512 512
ReadX 13043 2610 512 512
ReadX 13043 3586 512 512
ReadX 13043 3812 512 512
ReadX 13043 3828 512 512
ReadX 13043 4046 512 512
ReadX 13043 4066 512 512
ReadX 13043 1747 512 512
ReadX 13043 1026 512 512
ReadX 13043 1538 512 512
ReadX 13043 514 512 512
ReadX 13043 751 512 512
ReadX 13043 1263 512 512
ReadX 13043 620 512 512
ReadX 13043 1132 512 512
ReadX 13043 1644 512 512
ReadX 13043 2156 512 512
ReadX 13043 2668 512 512
ReadX 13043 3180 512 512
ReadX 13043 3692 512 512
ReadX 13043 4204 394 394
ReadX 13043 606 118 118
ReadX 13043 724 512 512
ReadX 13043 1236 512 512
ReadX 13043 1748 512 512
ReadX 13043 2260 512 512
ReadX 13043 2772 512 512
ReadX 13043 3284 512 512
ReadX 13043 3796 394 394
ReadX 13043 636 118 118
ReadX 13043 754 512 512
ReadX 13043 1266 512 512
ReadX 13043 1778 512 512
ReadX 13043 2290 512 512
ReadX 13043 2802 512 512
ReadX 13043 3314 512 512
ReadX 13043 3826 512 512
ReadX 13043 4338 512 512
ReadX 13043 4850 512 512
ReadX 13043 5362 512 512
ReadX 13043 5874 512 512
ReadX 13043 6386 512 512
ReadX 13043 6898 512 512
ReadX 13043 7410 512 512
ReadX 13043 7922 512 512
ReadX 13043 8434 512 512
ReadX 13043 8946 512 512
ReadX 13043 9458 512 512
ReadX 13043 9970 512 512
ReadX 13043 10482 512 512
ReadX 13043 723 512 512
ReadX 13043 1235 512 512
ReadX 13043 725 512 512
ReadX 13043 729 512 512
ReadX 13043 1241 512 512
ReadX 13043 1753 512 512
ReadX 13043 2265 512 512
ReadX 13043 2777 512 512
ReadX 13043 3289 512 512
ReadX 13043 3801 512 512
ReadX 13043 4313 512 512
ReadX 13043 4825 512 512
ReadX 13043 5337 512 512
ReadX 13043 5849 512 512
ReadX 13043 6361 512 512
ReadX 13043 755 512 512
ReadX 13043 1267 512 512
ReadX 13043 1779 512 512
ReadX 13043 2291 512 512
ReadX 13043 2803 512 512
ReadX 13043 3315 512 512
ReadX 13043 3827 512 512
ReadX 13043 4339 244 244
ReadX 13043 4583 512 512
ReadX 13043 5095 268 268
ReadX 13043 5363 512 512
ReadX 13043 5875 512 512
ReadX 13043 6387 512 512
ReadX 13043 6899 512 512
ReadX 13043 7411 512 512
ReadX 13043 7923 512 512
ReadX 13043 8435 512 512
ReadX 13043 8947 512 512
ReadX 13043 9459 512 512
ReadX 13043 9971 512 512
ReadX 13043 10483 512 512
ReadX 13043 10995 512 512
ReadX 13043 11507 512 512
ReadX 13043 12019 512 512
ReadX 13043 12531 512 512
ReadX 13043 13043 512 512
ReadX 13043 13555 512 512
ReadX 13043 14067 512 512
ReadX 13043 14579 512 512
ReadX 13043 15091 512 512
ReadX 13043 15603 342 342
ReadX 13043 725 512 512
ReadX 13043 2000 512 512
ReadX 13043 3918 512 512
ReadX 13043 727 512 512
ReadX 13043 258 512 512
ReadX 13043 376 512 512
ReadX 13043 1109 512 512
ReadX 13043 1028 512 512
ReadX 13043 1540 512 512
ReadX 13043 2052 512 512
ReadX 13043 2564 512 512
ReadX 13043 3076 512 512
ReadX 13043 3588 512 512
ReadX 13043 4100 512 512
ReadX 13043 4612 412 412
ReadX 13043 1012 100 100
ReadX 13043 1112 512 512
ReadX 13043 1624 512 512
ReadX 13043 2136 512 512
ReadX 13043 2648 512 512
ReadX 13043 3160 512 512
ReadX 13043 3672 512 512
ReadX 13043 4184 412 412
ReadX 13043 1044 100 100
ReadX 13043 1144 512 512
ReadX 13043 1656 512 512
ReadX 13043 2168 512 512
ReadX 13043 2680 512 512
ReadX 13043 3192 512 512
ReadX 13043 3704 512 512
ReadX 13043 4216 512 512
ReadX 13043 4728 512 512
ReadX 13043 5240 512 512
ReadX 13043 5752 512 512
ReadX 13043 6264 512 512
ReadX 13043 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 13043 7288 512 512
ReadX 13043 7800 512 512
ReadX 13043 8312 512 512
ReadX 13043 8824 512 512
ReadX 13043 9336 512 512
ReadX 13043 9848 512 512
ReadX 13043 10360 512 512
ReadX 13043 10872 512 512
ReadX 13043 11384 512 512
ReadX 13043 11896 512 512
ReadX 13043 12408 512 512
ReadX 13043 1088 512 512
ReadX 13043 1600 512 512
ReadX 13043 1090 512 512
ReadX 13043 1094 512 512
ReadX 13043 1606 512 512
ReadX 13043 2118 512 512
ReadX 13043 2630 512 512
ReadX 13043 3142 512 512
ReadX 13043 3654 512 512
ReadX 13043 4166 512 512
ReadX 13043 4678 512 512
ReadX 13043 1111 512 512
ReadX 13043 1623 512 512
ReadX 13043 2135 512 512
ReadX 13043 2647 512 512
ReadX 13043 3159 512 512
ReadX 13043 3671 512 512
ReadX 13043 4183 512 512
ReadX 13043 4695 512 512
ReadX 13043 5207 512 512
ReadX 13043 5719 512 512
ReadX 13043 6231 512 512
ReadX 13043 6743 512 512
ReadX 13043 7255 512 512
ReadX 13043 7767 512 512
ReadX 13043 8279 512 512
ReadX 13043 8791 512 512
ReadX 13043 9303 512 512
ReadX 13043 9815 512 512
ReadX 13043 10327 512 512
ReadX 13043 10839 512 512
ReadX 13043 11351 294 294
ReadX 13043 1091 512 512
ReadX 13043 970 512 512
ReadX 13043 1093 512 512
ReadX 13043 1434 512 512
ReadX 13043 2050 512 512
ReadX 13043 2158 512 512
ReadX 13043 2118 512 512
ReadX 13043 2630 512 512
ReadX 13043 3142 512 512
ReadX 13043 3654 512 512
ReadX 13043 4166 512 512
ReadX 13043 4678 512 512
ReadX 13043 5190 512 512
ReadX 13043 5702 382 382
ReadX 13043 2104 130 130
ReadX 13043 2234 512 512
ReadX 13043 2746 512 512
ReadX 13043 3258 512 512
ReadX 13043 3770 512 512
ReadX 13043 4282 512 512
ReadX 13043 4794 512 512
ReadX 13043 5306 382 382
ReadX 13043 2134 130 130
ReadX 13043 2264 512 512
ReadX 13043 2776 512 512
ReadX 13043 3288 512 512
ReadX 13043 3800 512 512
ReadX 13043 4312 512 512
ReadX 13043 4824 512 512
ReadX 13043 5336 512 512
ReadX 13043 2147 512 512
ReadX 13043 2149 512 512
ReadX 13043 2152 512 512
ReadX 13043 2664 512 512
ReadX 13043 3176 512 512
ReadX 13043 3688 512 512
ReadX 13043 2159 512 512
ReadX 13043 2671 512 512
ReadX 13043 3183 512 512
ReadX 13043 3695 512 512
ReadX 13043 4207 512 512
ReadX 13043 4719 512 512
ReadX 13043 5231 512 512
ReadX 13043 5743 512 512
ReadX 13043 6255 512 512
ReadX 13043 6767 512 512
ReadX 13043 7279 512 512
ReadX 13043 7791 512 512
ReadX 13043 8303 512 512
ReadX 13043 8815 512 512
ReadX 13043 9327 512 512
ReadX 13043 9839 512 512
ReadX 13043 10351 512 512
ReadX 13043 10863 512 512
ReadX 13043 11375 512 512
ReadX 13043 11887 512 512
ReadX 13043 12399 38 38
ReadX 13043 2149 512 512
ReadX 13043 1794 512 512
ReadX 13043 2016 512 512
ReadX 13043 2151 512 512
ReadX 13043 1918 512 512
ReadX 13043 1880 512 512
ReadX 13043 2392 512 512
ReadX 13043 2904 512 512
ReadX 13043 3416 512 512
ReadX 13043 3928 512 512
ReadX 13043 4440 512 512
ReadX 13043 4952 512 512
ReadX 13043 5464 416 416
ReadX 13043 1866 96 96
ReadX 13043 1962 512 512
ReadX 13043 2474 512 512
ReadX 13043 2986 512 512
ReadX 13043 3498 512 512
ReadX 13043 4010 512 512
ReadX 13043 4522 512 512
ReadX 13043 5034 416 416
ReadX 13043 1896 96 96
ReadX 13043 1992 512 512
ReadX 13043 2504 512 512
ReadX 13043 3016 512 512
ReadX 13043 3528 512 512
ReadX 13043 1903 512 512
ReadX 13043 1905 512 512
ReadX 13043 1908 512 512
ReadX 13043 2420 512 512
ReadX 13043 2932 512 512
ReadX 13043 3444 512 512
ReadX 13043 3956 512 512
ReadX 13043 1919 512 512
ReadX 13043 2431 512 512
ReadX 13043 2943 512 512
ReadX 13043 3455 512 512
ReadX 13043 3967 512 512
ReadX 13043 4479 512 512
ReadX 13043 4991 512 512
ReadX 13043 5503 512 512
ReadX 13043 6015 512 512
ReadX 13043 6527 512 512
ReadX 13043 7039 512 512
ReadX 13043 7551 512 512
ReadX 13043 8063 512 512
ReadX 13043 8575 512 512
ReadX 13043 9087 512 512
ReadX 13043 9599 512 512
ReadX 13043 10111 512 512
ReadX 13043 10623 512 512
ReadX 13043 11135 512 512
ReadX 13043 11647 512 512
ReadX 13043 12159 322 322
ReadX 13043 1905 512 512
ReadX 13043 1846 512 512
ReadX 13043 1907 512 512
ReadX 13043 1860 268 268
ReadX 13043 1832 244 244
ReadX 13043 1846 512 512
ReadX 13043 2358 512 512
ReadX 13043 2870 512 512
ReadX 13043 3382 512 512
ReadX 13043 3894 512 512
ReadX 13043 4406 512 512
ReadX 13043 4918 512 512
ReadX 13043 1858 512 512
ReadX 13043 1859 512 512
ReadX 13043 1860 488 488
ReadX 13043 1832 24 24
ReadX 13043 1861 228 228
ReadX 13043 1832 284 284
ReadX 13043 2116 512 512
ReadX 13043 2628 512 512
ReadX 13043 3140 512 512
ReadX 13043 3652 512 512
ReadX 13043 4164 512 512
ReadX 13043 4676 512 512
ReadX 13043 5188 228 228
ReadX 13043 1862 284 284
ReadX 13043 2146 512 512
ReadX 13043 2658 38 38
ReadX 13043 1859 512 512
ReadX 13043 2047 512 512
ReadX 13043 2016 512 512
ReadX 13043 2528 512 512
ReadX 13043 3040 512 512
ReadX 13043 3552 512 512
ReadX 13043 4064 512 512
ReadX 13043 4576 512 512
ReadX 13043 5088 512 512
ReadX 13043 5600 424 424
ReadX 13043 2002 88 88
ReadX 13043 2090 512 512
ReadX 13043 2602 512 512
ReadX 13043 3114 512 512
ReadX 13043 3626 512 512
ReadX 13043 4138 512 512
ReadX 13043 4650 512 512
ReadX 13043 5162 424 424
ReadX 13043 2032 88 88
ReadX 13043 2120 512 512
ReadX 13043 2632 512 512
ReadX 13043 3144 512 512
ReadX 13043 3656 512 512
ReadX 13043 4168 512 512
ReadX 13043 4680 512 512
ReadX 13043 5192 512 512
ReadX 13043 2044 512 512
ReadX 13043 2045 512 512
ReadX 13043 2046 512 512
ReadX 13043 2047 512 512
ReadX 13043 2559 110 110
ReadX 13043 2052 402 402
ReadX 13043 2454 512 512
ReadX 13043 2966 512 512
ReadX 13043 3478 512 512
ReadX 13043 3990 512 512
ReadX 13043 4502 512 512
ReadX 13043 5014 512 512
ReadX 13043 5526 512 512
ReadX 13043 6038 512 512
ReadX 13043 6550 512 512
ReadX 13043 7062 512 512
ReadX 13043 7574 512 512
ReadX 13043 8086 512 512
ReadX 13043 8598 512 512
ReadX 13043 9110 512 512
ReadX 13043 9622 512 512
ReadX 13043 10134 512 512
ReadX 13043 10646 512 512
ReadX 13043 11158 512 512
ReadX 13043 11670 512 512
ReadX 13043 12182 512 512
ReadX 13043 12694 118 118
ReadX 13043 2045 512 512
ReadX 13043 1282 512 512
ReadX 13043 1343 512 512
ReadX 13043 1286 512 512
ReadX 13043 1798 512 512
ReadX 13043 2310 512 512
ReadX 13043 2822 512 512
ReadX 13043 3334 512 512
ReadX 13043 3846 512 512
ReadX 13043 4358 512 512
ReadX 13043 4870 416 416
ReadX 13043 1270 96 96
ReadX 13043 1366 512 512
ReadX 13043 1878 512 512
ReadX 13043 2390 512 512
ReadX 13043 2902 512 512
ReadX 13043 3414 512 512
ReadX 13043 3926 416 416
ReadX 13043 1284 96 96
ReadX 13043 1380 416 416
ReadX 13043 1302 96 96
ReadX 13043 1398 512 512
ReadX 13043 1910 512 512
ReadX 13043 2422 512 512
ReadX 13043 2934 512 512
ReadX 13043 3446 512 512
ReadX 13043 3958 512 512
ReadX 13043 4470 512 512
ReadX 13043 4982 512 512
ReadX 13043 5494 512 512
ReadX 13043 6006 512 512
ReadX 13043 6518 512 512
ReadX 13043 7030 512 512
ReadX 13043 7542 512 512
ReadX 13043 1328 512 512
ReadX 13043 1330 512 512
ReadX 13043 1333 512 512
ReadX 13043 1845 512 512
ReadX 13043 2357 512 512
ReadX 13043 2869 512 512
ReadX 13043 3381 512 512
ReadX 13043 1344 512 512
ReadX 13043 1856 512 512
ReadX 13043 2368 512 512
ReadX 13043 2880 512 512
ReadX 13043 3392 512 512
ReadX 13043 3904 512 512
ReadX 13043 4416 512 512
ReadX 13043 4928 512 512
ReadX 13043 5440 512 512
ReadX 13043 5952 512 512
ReadX 13043 6464 512 512
ReadX 13043 6976 512 512
ReadX 13043 7488 512 512
ReadX 13043 8000 512 512
ReadX 13043 8512 512 512
ReadX 13043 9024 512 512
ReadX 13043 9536 512 512
ReadX 13043 10048 512 512
ReadX 13043 10560 512 512
ReadX 13043 11072 512 512
ReadX 13043 11584 426 426
ReadX 13043 1330 512 512
ReadX 13043 1842 512 512
ReadX 13043 1250 512 512
ReadX 13043 1264 268 268
ReadX 13043 1236 244 244
ReadX 13043 1250 512 512
ReadX 13043 1762 512 512
ReadX 13043 2274 512 512
ReadX 13043 2786 512 512
ReadX 13043 3298 512 512
ReadX 13043 3810 512 512
ReadX 13043 4322 512 512
ReadX 13043 1262 512 512
ReadX 13043 1263 512 512
ReadX 13043 1264 488 488
ReadX 13043 1236 24 24
ReadX 13043 1265 228 228
ReadX 13043 1236 284 284
ReadX 13043 1520 512 512
ReadX 13043 2032 512 512
ReadX 13043 2544 512 512
ReadX 13043 3056 512 512
ReadX 13043 3568 512 512
ReadX 13043 4080 512 512
ReadX 13043 4592 228 228
ReadX 13043 1266 284 284
ReadX 13043 1550 512 512
ReadX 13043 2062 42 42
ReadX 13043 1263 512 512
ReadX 13043 1538 512 512
ReadX 13043 1640 512 512
ReadX 13043 1510 512 512
ReadX 13043 2022 512 512
ReadX 13043 2534 512 512
ReadX 13043 3046 512 512
ReadX 13043 3558 512 512
ReadX 13043 4070 512 512
ReadX 13043 4582 512 512
ReadX 13043 5094 408 408
ReadX 13043 1496 104 104
ReadX 13043 1600 512 512
ReadX 13043 2112 512 512
ReadX 13043 2624 512 512
ReadX 13043 3136 512 512
ReadX 13043 3648 512 512
ReadX 13043 4160 512 512
ReadX 13043 4672 408 408
ReadX 13043 1526 104 104
ReadX 13043 1630 512 512
ReadX 13043 2142 512 512
ReadX 13043 2654 512 512
ReadX 13043 3166 512 512
ReadX 13043 3678 512 512
ReadX 13043 4190 408 408
ReadX 13043 1540 104 104
ReadX 13043 1644 512 512
ReadX 13043 2156 512 512
ReadX 13043 2668 512 512
ReadX 13043 3180 512 512
ReadX 13043 3692 512 512
ReadX 13043 4204 512 512
ReadX 13043 4716 512 512
ReadX 13043 5228 512 512
ReadX 13043 5740 512 512
ReadX 13043 6252 512 512
ReadX 13043 6764 512 512
ReadX 13043 7276 512 512
ReadX 13043 7788 512 512
ReadX 13043 8300 512 512
ReadX 13043 8812 512 512
ReadX 13043 9324 512 512
ReadX 13043 9836 512 512
ReadX 13043 10348 512 512
ReadX 13043 10860 512 512
ReadX 13043 11372 512 512
ReadX 13043 1615 512 512
ReadX 13043 2127 512 512
ReadX 13043 1617 512 512
ReadX 13043 1621 512 512
ReadX 13043 2133 512 512
ReadX 13043 2645 512 512
ReadX 13043 3157 512 512
ReadX 13043 3669 512 512
ReadX 13043 4181 512 512
ReadX 13043 4693 512 512
ReadX 13043 5205 512 512
ReadX 13043 5717 512 512
ReadX 13043 6229 512 512
ReadX 13043 1641 512 512
ReadX 13043 2153 512 512
ReadX 13043 2665 512 512
ReadX 13043 3177 512 512
ReadX 13043 3689 512 512
ReadX 13043 4201 512 512
ReadX 13043 4713 512 512
ReadX 13043 5225 512 512
ReadX 13043 5737 512 512
ReadX 13043 6249 512 512
ReadX 13043 6761 512 512
ReadX 13043 7273 512 512
ReadX 13043 7785 512 512
ReadX 13043 8297 512 512
ReadX 13043 8809 512 512
ReadX 13043 9321 512 512
ReadX 13043 9833 512 512
ReadX 13043 10345 512 512
ReadX 13043 10857 512 512
ReadX 13043 11369 512 512
ReadX 13043 11881 2 2
ReadX 13043 1796 510 510
ReadX 13043 2306 512 512
ReadX 13043 2818 512 512
ReadX 13043 3330 512 512
ReadX 13043 3842 512 512
ReadX 13043 4354 512 512
ReadX 13043 4866 512 512
ReadX 13043 5378 512 512
ReadX 13043 5890 512 512
ReadX 13043 6402 512 512
ReadX 13043 6914 512 512
ReadX 13043 7426 512 512
ReadX 13043 7938 512 512
ReadX 13043 8450 512 512
ReadX 13043 8962 512 512
ReadX 13043 9474 512 512
ReadX 13043 9986 512 512
ReadX 13043 10498 326 326
ReadX 13043 1617 512 512
ReadX 13043 2129 512 512
ReadX 13043 1450 512 512
ReadX 13043 1621 512 512
ReadX 13043 1446 512 512
ReadX 13043 1450 512 512
ReadX 13043 1962 512 512
ReadX 13043 2474 512 512
ReadX 13043 2986 512 512
ReadX 13043 3498 512 512
ReadX 13043 4010 512 512
ReadX 13043 4522 512 512
ReadX 13043 5034 424 424
ReadX 13043 1436 88 88
ReadX 13043 1524 512 512
ReadX 13043 2036 512 512
ReadX 13043 2548 512 512
ReadX 13043 3060 512 512
ReadX 13043 1442 512 512
ReadX 13043 1443 512 512
ReadX 13043 1444 512 512
ReadX 13043 1446 512 512
ReadX 13043 1958 386 386
ReadX 13043 1466 126 126
ReadX 13043 1592 512 512
ReadX 13043 2104 512 512
ReadX 13043 2616 512 512
ReadX 13043 3128 512 512
ReadX 13043 3640 512 512
ReadX 13043 4152 512 512
ReadX 13043 4664 512 512
ReadX 13043 5176 512 512
ReadX 13043 5688 512 512
ReadX 13043 6200 512 512
ReadX 13043 6712 512 512
ReadX 13043 7224 512 512
ReadX 13043 7736 512 512
ReadX 13043 8248 512 512
ReadX 13043 8760 294 294
ReadX 13043 1443 512 512
ReadX 13043 964 512 512
ReadX 13043 970 512 512
ReadX 13043 1482 512 512
ReadX 13043 1994 512 512
ReadX 13043 2506 512 512
ReadX 13043 3018 512 512
ReadX 13043 3530 512 512
ReadX 13043 4042 512 512
ReadX 13043 4554 424 424
ReadX 13043 956 88 88
ReadX 13043 1044 512 512
ReadX 13043 1556 512 512
ReadX 13043 2068 512 512
ReadX 13043 2580 512 512
ReadX 13043 962 512 512
ReadX 13043 963 512 512
ReadX 13043 964 512 512
ReadX 13043 965 512 512
ReadX 13043 1477 512 512
ReadX 13043 1989 228 228
ReadX 13043 986 284 284
ReadX 13043 1270 512 512
ReadX 13043 1782 512 512
ReadX 13043 2294 512 512
ReadX 13043 2806 512 512
ReadX 13043 3318 512 512
ReadX 13043 3830 512 512
ReadX 13043 4342 512 512
ReadX 13043 4854 512 512
ReadX 13043 5366 512 512
ReadX 13043 5878 512 512
ReadX 13043 6390 512 512
ReadX 13043 6902 512 512
ReadX 13043 7414 42 42
ReadX 13043 963 512 512
ReadX 13043 2610 512 512
ReadX 13043 3812 512 512
ReadX 13043 3828 512 512
ReadX 13043 3969 512 512
ReadX 13043 3918 512 512
ReadX 13043 4430 512 512
ReadX 13043 4942 512 512
ReadX 13043 5454 512 512
ReadX 13043 5966 512 512
ReadX 13043 6478 512 512
ReadX 13043 6990 512 512
ReadX 13043 7502 424 424
ReadX 13043 3904 88 88
ReadX 13043 3992 512 512
ReadX 13043 4504 512 512
ReadX 13043 5016 512 512
ReadX 13043 5528 512 512
ReadX 13043 6040 512 512
ReadX 13043 6552 512 512
ReadX 13043 7064 424 424
ReadX 13043 3934 88 88
ReadX 13043 4022 512 512
ReadX 13043 4534 512 512
ReadX 13043 5046 512 512
ReadX 13043 5558 512 512
ReadX 13043 6070 512 512
ReadX 13043 6582 512 512
ReadX 13043 7094 512 512
ReadX 13043 7606 512 512
ReadX 13043 8118 512 512
ReadX 13043 8630 512 512
ReadX 13043 3953 512 512
ReadX 13043 4465 512 512
ReadX 13043 3956 512 512
ReadX 13043 3964 512 512
ReadX 13043 4476 512 512
ReadX 13043 4988 512 512
ReadX 13043 3970 512 512
ReadX 13043 4482 512 512
ReadX 13043 4994 512 512
ReadX 13043 5506 512 512
ReadX 13043 6018 512 512
ReadX 13043 6530 512 512
ReadX 13043 7042 512 512
ReadX 13043 7554 512 512
ReadX 13043 8066 512 512
ReadX 13043 8578 512 512
ReadX 13043 9090 512 512
ReadX 13043 9602 512 512
ReadX 13043 10114 512 512
ReadX 13043 10626 512 512
ReadX 13043 11138 512 512
ReadX 13043 11650 512 512
ReadX 13043 12162 512 512
ReadX 13043 12674 512 512
ReadX 13043 13186 512 512
ReadX 13043 13698 512 512
ReadX 13043 14210 134 134
ReadX 13043 3956 512 512
ReadX 13043 4468 512 512
ReadX 13043 4980 512 512
ReadX 13043 5492 512 512
ReadX 13043 3074 512 512
ReadX 13043 3246 512 512
ReadX 13043 3964 512 512
ReadX 13043 3330 512 512
ReadX 13043 3465 512 512
ReadX 13043 3246 512 512
ReadX 13043 3758 512 512
ReadX 13043 4270 512 512
ReadX 13043 4782 512 512
ReadX 13043 5294 512 512
ReadX 13043 5806 512 512
ReadX 13043 6318 512 512
ReadX 13043 6830 368 368
ReadX 13043 3232 144 144
ReadX 13043 3376 512 512
ReadX 13043 3888 512 512
ReadX 13043 4400 512 512
ReadX 13043 4912 512 512
ReadX 13043 5424 512 512
ReadX 13043 5936 512 512
ReadX 13043 6448 368 368
ReadX 13043 3262 144 144
ReadX 13043 3406 512 512
ReadX 13043 3918 512 512
ReadX 13043 4430 512 512
ReadX 13043 4942 512 512
ReadX 13043 5454 512 512
ReadX 13043 5966 512 512
ReadX 13043 6478 512 512
ReadX 13043 6990 512 512
ReadX 13043 7502 512 512
ReadX 13043 8014 512 512
ReadX 13043 8526 512 512
ReadX 13043 9038 512 512
ReadX 13043 9550 512 512
ReadX 13043 10062 512 512
ReadX 13043 10574 512 512
ReadX 13043 11086 512 512
ReadX 13043 11598 512 512
ReadX 13043 12110 512 512
ReadX 13043 12622 512 512
ReadX 13043 13134 512 512
ReadX 13043 13646 368 368
ReadX 13043 3332 144 144
ReadX 13043 3476 512 512
ReadX 13043 3988 512 512
ReadX 13043 4500 512 512
ReadX 13043 5012 512 512
ReadX 13043 5524 512 512
ReadX 13043 6036 512 512
ReadX 13043 6548 512 512
ReadX 13043 7060 512 512
ReadX 13043 7572 512 512
ReadX 13043 8084 512 512
ReadX 13043 8596 512 512
ReadX 13043 9108 512 512
ReadX 13043 9620 512 512
ReadX 13043 10132 512 512
ReadX 13043 10644 512 512
ReadX 13043 11156 512 512
ReadX 13043 11668 512 512
ReadX 13043 12180 512 512
ReadX 13043 12692 512 512
ReadX 13043 13204 512 512
ReadX 13043 3430 512 512
ReadX 13043 3942 512 512
ReadX 13043 3434 512 512
ReadX 13043 3435 512 512
ReadX 13043 3947 512 512
ReadX 13043 4459 512 512
ReadX 13043 4971 512 512
ReadX 13043 5483 512 512
ReadX 13043 5995 512 512
ReadX 13043 6507 512 512
ReadX 13043 7019 512 512
ReadX 13043 7531 512 512
ReadX 13043 8043 512 512
ReadX 13043 8555 512 512
ReadX 13043 9067 512 512
ReadX 13043 9579 512 512
ReadX 13043 10091 512 512
ReadX 13043 10603 512 512
ReadX 13043 11115 512 512
ReadX 13043 3467 512 512
ReadX 13043 3979 512 512
ReadX 13043 4491 512 512
ReadX 13043 5003 512 512
ReadX 13043 5515 512 512
ReadX 13043 6027 512 512
ReadX 13043 6539 512 512
ReadX 13043 7051 512 512
ReadX 13043 7563 512 512
ReadX 13043 8075 512 512
ReadX 13043 8587 512 512
ReadX 13043 9099 512 512
ReadX 13043 9611 512 512
ReadX 13043 10123 512 512
ReadX 13043 10635 512 512
ReadX 13043 11147 512 512
ReadX 13043 11659 512 512
ReadX 13043 12171 512 512
ReadX 13043 12683 512 512
ReadX 13043 13195 512 512
ReadX 13043 13707 56 56
ReadX 13043 13763 512 512
ReadX 13043 14275 456 456
ReadX 13043 14731 512 512
ReadX 13043 15243 512 512
ReadX 13043 15755 512 512
ReadX 13043 16267 512 512
ReadX 13043 16779 512 512
ReadX 13043 17291 512 512
ReadX 13043 17803 512 512
ReadX 13043 18315 512 512
ReadX 13043 18827 512 512
ReadX 13043 19339 512 512
ReadX 13043 19851 512 512
ReadX 13043 20363 512 512
ReadX 13043 20875 512 512
ReadX 13043 21387 512 512
ReadX 13043 21899 512 512
ReadX 13043 22411 512 512
ReadX 13043 22923 512 512
ReadX 13043 23435 512 512
ReadX 13043 23947 512 512
ReadX 13043 24459 512 512
ReadX 13043 24971 282 282
ReadX 13043 3434 512 512
ReadX 13043 2818 512 512
ReadX 13043 2870 512 512
ReadX 13043 3026 512 512
ReadX 13043 3538 512 512
ReadX 13043 2870 512 512
ReadX 13043 3382 512 512
ReadX 13043 3894 512 512
ReadX 13043 4406 512 512
ReadX 13043 4918 512 512
ReadX 13043 5430 512 512
ReadX 13043 5942 512 512
ReadX 13043 6454 374 374
ReadX 13043 2856 138 138
ReadX 13043 2994 512 512
ReadX 13043 3506 512 512
ReadX 13043 4018 512 512
ReadX 13043 4530 512 512
ReadX 13043 5042 512 512
ReadX 13043 5554 512 512
ReadX 13043 6066 374 374
ReadX 13043 2886 138 138
ReadX 13043 3024 512 512
ReadX 13043 3536 512 512
ReadX 13043 4048 512 512
ReadX 13043 4560 512 512
ReadX 13043 5072 512 512
ReadX 13043 5584 512 512
ReadX 13043 6096 512 512
ReadX 13043 6608 512 512
ReadX 13043 7120 512 512
ReadX 13043 7632 512 512
ReadX 13043 8144 512 512
ReadX 13043 8656 512 512
ReadX 13043 9168 512 512
ReadX 13043 9680 512 512
ReadX 13043 10192 512 512
ReadX 13043 10704 512 512
ReadX 13043 11216 512 512
ReadX 13043 11728 512 512
ReadX 13043 12240 512 512
ReadX 13043 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 13043 13264 512 512
ReadX 13043 13776 512 512
ReadX 13043 14288 512 512
ReadX 13043 14800 512 512
ReadX 13043 15312 512 512
ReadX 13043 15824 512 512
ReadX 13043 16336 512 512
ReadX 13043 16848 512 512
ReadX 13043 17360 512 512
ReadX 13043 17872 512 512
ReadX 13043 18384 512 512
ReadX 13043 18896 512 512
ReadX 13043 19408 512 512
ReadX 13043 19920 512 512
ReadX 13043 20432 512 512
ReadX 13043 20944 512 512
ReadX 13043 21456 512 512
ReadX 13043 21968 512 512
ReadX 13043 22480 512 512
ReadX 13043 22992 512 512
ReadX 13043 2998 512 512
ReadX 13043 3510 512 512
ReadX 13043 3001 512 512
ReadX 13043 3003 512 512
ReadX 13043 3515 512 512
ReadX 13043 4027 512 512
ReadX 13043 4539 512 512
ReadX 13043 5051 512 512
ReadX 13043 5563 512 512
ReadX 13043 6075 512 512
ReadX 13043 6587 512 512
ReadX 13043 7099 512 512
ReadX 13043 7611 512 512
ReadX 13043 8123 512 512
ReadX 13043 8635 512 512
ReadX 13043 3029 512 512
ReadX 13043 3541 512 512
ReadX 13043 4053 512 512
ReadX 13043 4565 512 512
ReadX 13043 5077 512 512
ReadX 13043 5589 512 512
ReadX 13043 6101 512 512
ReadX 13043 6613 512 512
ReadX 13043 7125 512 512
ReadX 13043 7637 512 512
ReadX 13043 8149 512 512
ReadX 13043 8661 512 512
ReadX 13043 9173 512 512
ReadX 13043 9685 512 512
ReadX 13043 10197 512 512
ReadX 13043 10709 512 512
ReadX 13043 11221 512 512
ReadX 13043 11733 512 512
ReadX 13043 12245 512 512
ReadX 13043 12757 512 512
ReadX 13043 13269 40 40
ReadX 13043 3076 472 472
ReadX 13043 3548 512 512
ReadX 13043 4060 512 512
ReadX 13043 4572 512 512
ReadX 13043 5084 512 512
ReadX 13043 5596 512 512
ReadX 13043 6108 512 512
ReadX 13043 6620 512 512
ReadX 13043 7132 512 512
ReadX 13043 7644 512 512
ReadX 13043 8156 512 512
ReadX 13043 8668 512 512
ReadX 13043 9180 512 512
ReadX 13043 9692 512 512
ReadX 13043 10204 512 512
ReadX 13043 10716 512 512
ReadX 13043 11228 512 512
ReadX 13043 11740 512 512
ReadX 13043 12252 512 512
ReadX 13043 12764 512 512
ReadX 13043 13276 310 310
ReadX 13043 3001 512 512
ReadX 13043 2562 512 512
ReadX 13043 2626 512 512
ReadX 13043 3003 512 512
ReadX 13043 2721 512 512
ReadX 13043 2626 512 512
ReadX 13043 3138 512 512
ReadX 13043 3650 512 512
ReadX 13043 4162 512 512
ReadX 13043 4674 512 512
ReadX 13043 5186 512 512
ReadX 13043 5698 512 512
ReadX 13043 6210 424 424
ReadX 13043 2612 88 88
ReadX 13043 2700 512 512
ReadX 13043 3212 512 512
ReadX 13043 3724 512 512
ReadX 13043 4236 512 512
ReadX 13043 4748 512 512
ReadX 13043 5260 512 512
ReadX 13043 5772 424 424
ReadX 13043 2642 88 88
ReadX 13043 2730 512 512
ReadX 13043 3242 512 512
ReadX 13043 3754 512 512
ReadX 13043 4266 512 512
ReadX 13043 4778 512 512
ReadX 13043 5290 512 512
ReadX 13043 5802 512 512
ReadX 13043 6314 512 512
ReadX 13043 6826 512 512
ReadX 13043 7338 512 512
ReadX 13043 7850 512 512
ReadX 13043 8362 512 512
ReadX 13043 8874 512 512
ReadX 13043 9386 512 512
ReadX 13043 9898 512 512
ReadX 13043 10410 512 512
ReadX 13043 10922 512 512
ReadX 13043 11434 512 512
ReadX 13043 11946 512 512
ReadX 13043 12458 512 512
ReadX 13043 2716 512 512
ReadX 13043 2717 512 512
ReadX 13043 2718 512 512
ReadX 13043 3230 512 512
ReadX 13043 2721 512 512
ReadX 13043 3233 512 512
ReadX 13043 3745 512 512
ReadX 13043 4257 512 512
ReadX 13043 4769 512 512
ReadX 13043 5281 512 512
ReadX 13043 5793 512 512
ReadX 13043 6305 512 512
ReadX 13043 6817 512 512
ReadX 13043 7329 512 512
ReadX 13043 7841 512 512
ReadX 13043 8353 512 512
ReadX 13043 8865 512 512
ReadX 13043 9377 512 512
ReadX 13043 9889 512 512
ReadX 13043 10401 512 512
ReadX 13043 10913 512 512
ReadX 13043 11425 512 512
ReadX 13043 11937 512 512
ReadX 13043 12449 512 512
ReadX 13043 12961 512 512
ReadX 13043 13473 512 512
ReadX 13043 13985 106 106
ReadX 13043 2820 406 406
ReadX 13043 3226 512 512
ReadX 13043 3738 512 512
ReadX 13043 4250 512 512
ReadX 13043 4762 512 512
ReadX 13043 5274 512 512
ReadX 13043 5786 512 512
ReadX 13043 6298 512 512
ReadX 13043 6810 512 512
ReadX 13043 7322 512 512
ReadX 13043 7834 512 512
ReadX 13043 8346 512 512
ReadX 13043 8858 512 512
ReadX 13043 9370 512 512
ReadX 13043 9882 512 512
ReadX 13043 10394 512 512
ReadX 13043 10906 512 512
ReadX 13043 11418 182 182
ReadX 13043 2717 512 512
ReadX 13043 258 512 512
ReadX 13043 470 512 512
ReadX 13043 376 512 512
ReadX 13043 888 512 512
ReadX 13043 1400 512 512
ReadX 13043 1912 512 512
ReadX 13043 2424 512 512
ReadX 13043 2936 512 512
ReadX 13043 3448 512 512
ReadX 13043 3960 424 424
ReadX 13043 362 88 88
ReadX 13043 450 512 512
ReadX 13043 962 512 512
ReadX 13043 1474 512 512
ReadX 13043 1986 512 512
ReadX 13043 2498 512 512
ReadX 13043 3010 512 512
ReadX 13043 3522 424 424
ReadX 13043 392 88 88
ReadX 13043 480 512 512
ReadX 13043 992 512 512
ReadX 13043 1504 512 512
ReadX 13043 2016 512 512
ReadX 13043 2528 512 512
ReadX 13043 3040 512 512
ReadX 13043 3552 512 512
ReadX 13043 4064 512 512
ReadX 13043 4576 512 512
ReadX 13043 5088 512 512
ReadX 13043 5600 512 512
ReadX 13043 6112 512 512
ReadX 13043 6624 512 512
ReadX 13043 7136 512 512
ReadX 13043 7648 512 512
ReadX 13043 8160 512 512
ReadX 13043 8672 512 512
ReadX 13043 9184 512 512
ReadX 13043 9696 512 512
ReadX 13043 10208 512 512
ReadX 13043 464 512 512
ReadX 13043 465 512 512
ReadX 13043 466 512 512
ReadX 13043 978 512 512
ReadX 13043 470 512 512
ReadX 13043 982 512 512
ReadX 13043 1494 512 512
ReadX 13043 2006 512 512
ReadX 13043 2518 512 512
ReadX 13043 3030 512 512
ReadX 13043 3542 512 512
ReadX 13043 4054 512 512
ReadX 13043 4566 512 512
ReadX 13043 5078 512 512
ReadX 13043 5590 512 512
ReadX 13043 6102 512 512
ReadX 13043 6614 512 512
ReadX 13043 7126 512 512
ReadX 13043 7638 512 512
ReadX 13043 8150 512 512
ReadX 13043 8662 512 512
ReadX 13043 9174 512 512
ReadX 13043 9686 512 512
ReadX 13043 10198 512 512
ReadX 13043 10710 333 333
ReadX 13043 11043 512 512
ReadX 13043 11555 179 179
ReadX 13043 11734 512 512
ReadX 13043 12246 512 512
ReadX 13043 12758 512 512
ReadX 13043 13270 512 512
ReadX 13043 13782 512 512
ReadX 13043 14294 512 512
ReadX 13043 14806 512 512
ReadX 13043 15318 512 512
ReadX 13043 15830 512 512
ReadX 13043 16342 512 512
ReadX 13043 16854 512 512
ReadX 13043 17366 512 512
ReadX 13043 17878 512 512
ReadX 13043 18390 512 512
ReadX 13043 18902 512 512
ReadX 13043 19414 512 512
ReadX 13043 19926 512 512
ReadX 13043 20438 512 512
ReadX 13043 20950 512 512
ReadX 13043 21462 512 512
ReadX 13043 21974 350 350
ReadX 13043 465 512 512
ReadX 13043 3812 512 512
ReadX 13043 4046 512 512
ReadX 13043 3828 512 512
ReadX 13043 256 512 512
ReadX 13043 260 512 512
ReadX 13043 4066 512 512
ReadX 13043 4578 512 512
ReadX 13043 5090 512 512
ReadX 13043 5602 512 512
ReadX 13043 6114 512 512
ReadX 13043 6626 512 512
ReadX 13043 7138 512 512
ReadX 13043 7650 394 394
ReadX 13043 4052 118 118
ReadX 13043 4170 512 512
ReadX 13043 4682 512 512
ReadX 13043 5194 512 512
ReadX 13043 5706 512 512
ReadX 13043 6218 512 512
ReadX 13043 6730 512 512
ReadX 13043 7242 394 394
ReadX 13043 4082 118 118
ReadX 13043 4200 512 512
ReadX 13043 4712 512 512
ReadX 13043 5224 512 512
ReadX 13043 5736 512 512
ReadX 13043 6248 512 512
ReadX 13043 6760 512 512
ReadX 13043 7272 512 512
ReadX 13043 7784 394 394
ReadX 13043 256 118 118
ReadX 13043 374 512 512
ReadX 13043 886 512 512
ReadX 13043 1398 512 512
ReadX 13043 1910 512 512
ReadX 13043 2422 512 512
ReadX 13043 2934 512 512
ReadX 13043 3446 512 512
ReadX 13043 3958 512 512
ReadX 13043 4470 512 512
ReadX 13043 4982 512 512
ReadX 13043 5494 512 512
ReadX 13043 6006 512 512
ReadX 13043 6518 512 512
ReadX 13043 7030 512 512
ReadX 13043 7542 512 512
ReadX 13043 8054 512 512
ReadX 13043 8566 512 512
ReadX 13043 9078 512 512
ReadX 13043 9590 512 512
ReadX 13043 10102 512 512
ReadX 13043 259 512 512
ReadX 13043 771 512 512
ReadX 13043 259 512 512
ReadX 13043 259 512 512
ReadX 13043 771 512 512
ReadX 13043 1283 512 512
ReadX 13043 1795 512 512
ReadX 13043 2307 512 512
ReadX 13043 2819 512 512
ReadX 13043 3331 512 512
ReadX 13043 3843 512 512
ReadX 13043 4355 512 512
ReadX 13043 4867 512 512
ReadX 13043 260 512 512
ReadX 13043 772 512 512
ReadX 13043 1284 512 512
ReadX 13043 1796 512 512
ReadX 13043 2308 512 512
ReadX 13043 2820 512 512
ReadX 13043 3332 512 512
ReadX 13043 3844 512 512
ReadX 13043 4356 512 512
ReadX 13043 4868 512 512
ReadX 13043 5380 512 512
ReadX 13043 5892 512 512
ReadX 13043 6404 512 512
ReadX 13043 6916 512 512
ReadX 13043 7428 512 512
ReadX 13043 7940 512 512
ReadX 13043 8452 512 512
ReadX 13043 8964 512 512
ReadX 13043 9476 512 512
ReadX 13043 9988 512 512
ReadX 13043 10500 378 378
ReadX 13043 10878 512 512
ReadX 13043 11390 134 134
ReadX 13043 11524 512 512
ReadX 13043 12036 512 512
ReadX 13043 12548 512 512
ReadX 13043 13060 512 512
ReadX 13043 13572 138 138
ReadX 13043 259 512 512
ReadX 13043 273 512 512
ReadX 13043 276 512 512
ReadX 13043 295 512 512
ReadX 13043 288 512 512
ReadX 13043 296 512 512
ReadX 13043 259 512 512
ReadX 13043 273 512 512
ReadX 13043 273 512 512
ReadX 13043 785 512 512
ReadX 13043 1297 512 512
ReadX 13043 1809 512 512
ReadX 13043 2321 512 512
ReadX 13043 274 512 512
ReadX 13043 274 512 512
ReadX 13043 274 497 497
ReadX 13043 272 15 15
ReadX 13043 287 512 512
ReadX 13043 799 512 512
ReadX 13043 273 512 512
ReadX 13043 785 512 512
ReadX 13043 1297 512 512
ReadX 13043 1809 512 512
ReadX 13043 2321 512 512
ReadX 13043 2833 317 317
ReadX 13043 274 195 195
ReadX 13043 469 512 512
ReadX 13043 981 512 512
ReadX 13043 1493 512 512
ReadX 13043 2005 512 512
ReadX 13043 2517 512 512
ReadX 13043 3029 512 512
ReadX 13043 3541 512 512
ReadX 13043 4053 512 512
ReadX 13043 4565 250 250
ReadX 13043 274 512 512
ReadX 13043 283 512 512
ReadX 13043 795 512 512
ReadX 13043 276 512 512
ReadX 13043 788 512 512
ReadX 13043 1300 512 512
ReadX 13043 1812 512 512
ReadX 13043 2324 512 512
ReadX 13043 2836 512 512
ReadX 13043 3348 512 512
ReadX 13043 3860 420 420
ReadX 13043 275 92 92
ReadX 13043 367 512 512
ReadX 13043 879 512 512
ReadX 13043 1391 512 512
ReadX 13043 1903 512 512
ReadX 13043 2415 512 512
ReadX 13043 2927 512 512
ReadX 13043 3439 420 420
ReadX 13043 277 92 92
ReadX 13043 369 512 512
ReadX 13043 881 512 512
ReadX 13043 1393 512 512
ReadX 13043 1905 512 512
ReadX 13043 2417 512 512
ReadX 13043 2929 512 512
ReadX 13043 3441 512 512
ReadX 13043 3953 512 512
ReadX 13043 4465 512 512
ReadX 13043 4977 512 512
ReadX 13043 5489 512 512
ReadX 13043 6001 512 512
ReadX 13043 6513 512 512
ReadX 13043 7025 512 512
ReadX 13043 7537 512 512
ReadX 13043 8049 512 512
ReadX 13043 8561 512 512
ReadX 13043 9073 512 512
ReadX 13043 9585 512 512
ReadX 13043 10097 512 512
ReadX 13043 282 512 512
ReadX 13043 794 512 512
ReadX 13043 1306 512 512
ReadX 13043 1818 512 512
ReadX 13043 2330 512 512
ReadX 13043 2842 512 512
ReadX 13043 3354 512 512
ReadX 13043 3866 512 512
ReadX 13043 4378 512 512
ReadX 13043 284 512 512
ReadX 13043 796 512 512
ReadX 13043 1308 512 512
ReadX 13043 1820 512 512
ReadX 13043 2332 512 512
ReadX 13043 2844 512 512
ReadX 13043 3356 512 512
ReadX 13043 3868 512 512
ReadX 13043 4380 512 512
ReadX 13043 4892 512 512
ReadX 13043 5404 512 512
ReadX 13043 5916 512 512
ReadX 13043 6428 512 512
ReadX 13043 6940 512 512
ReadX 13043 7452 512 512
ReadX 13043 7964 512 512
ReadX 13043 8476 512 512
ReadX 13043 8988 512 512
ReadX 13043 9500 512 512
ReadX 13043 10012 512 512
ReadX 13043 10524 472 472
ReadX 13043 288 40 40
ReadX 13043 328 512 512
ReadX 13043 840 512 512
ReadX 13043 1352 512 512
ReadX 13043 1864 512 512
ReadX 13043 2376 512 512
ReadX 13043 2888 512 512
ReadX 13043 3400 512 512
ReadX 13043 3912 512 512
ReadX 13043 4424 512 512
ReadX 13043 4936 512 512
ReadX 13043 5448 512 512
ReadX 13043 5960 512 512
ReadX 13043 6472 512 512
ReadX 13043 6984 512 512
ReadX 13043 7496 512 512
ReadX 13043 8008 512 512
ReadX 13043 8520 512 512
ReadX 13043 9032 512 512
ReadX 13043 9544 512 512
ReadX 13043 10056 512 512
ReadX 13043 10568 506 506
ReadX 13043 282 512 512
ReadX 13043 794 512 512
ReadX 13043 301 512 512
ReadX 13043 296 512 512
ReadX 13043 808 512 512
ReadX 13043 1320 512 512
ReadX 13043 1832 512 512
ReadX 13043 2344 512 512
ReadX 13043 2856 512 512
ReadX 13043 3368 512 512
ReadX 13043 3880 424 424
ReadX 13043 295 88 88
ReadX 13043 383 512 512
ReadX 13043 895 512 512
ReadX 13043 1407 512 512
ReadX 13043 1919 512 512
ReadX 13043 2431 512 512
ReadX 13043 2943 512 512
ReadX 13043 3455 424 424
ReadX 13043 297 88 88
ReadX 13043 385 512 512
ReadX 13043 897 512 512
ReadX 13043 1409 512 512
ReadX 13043 1921 512 512
ReadX 13043 2433 512 512
ReadX 13043 2945 512 512
ReadX 13043 3457 512 512
ReadX 13043 3969 512 512
ReadX 13043 4481 512 512
ReadX 13043 4993 512 512
ReadX 13043 5505 512 512
ReadX 13043 6017 512 512
ReadX 13043 6529 512 512
ReadX 13043 7041 512 512
ReadX 13043 7553 512 512
ReadX 13043 8065 512 512
ReadX 13043 8577 512 512
ReadX 13043 9089 512 512
ReadX 13043 9601 512 512
ReadX 13043 10113 512 512
ReadX 13043 301 512 512
ReadX 13043 301 512 512
ReadX 13043 301 512 512
ReadX 13043 813 512 512
ReadX 13043 301 512 512
ReadX 13043 813 512 512
ReadX 13043 1325 512 512
ReadX 13043 1837 512 512
ReadX 13043 2349 512 512
ReadX 13043 2861 512 512
ReadX 13043 3373 512 512
ReadX 13043 3885 512 512
ReadX 13043 4397 512 512
ReadX 13043 4909 512 512
ReadX 13043 5421 512 512
ReadX 13043 5933 512 512
ReadX 13043 6445 512 512
ReadX 13043 6957 512 512
ReadX 13043 7469 512 512
ReadX 13043 7981 512 512
ReadX 13043 8493 512 512
ReadX 13043 9005 512 512
ReadX 13043 9517 463 463
ReadX 13043 9980 512 512
ReadX 13043 10492 49 49
ReadX 13043 10541 512 512
ReadX 13043 11053 512 512
ReadX 13043 11565 512 512
ReadX 13043 12077 512 512
ReadX 13043 12589 512 512
ReadX 13043 13101 512 512
ReadX 13043 13613 512 512
ReadX 13043 14125 512 512
ReadX 13043 14637 512 512
ReadX 13043 15149 512 512
ReadX 13043 15661 512 512
ReadX 13043 16173 512 512
ReadX 13043 16685 512 512
ReadX 13043 17197 512 512
ReadX 13043 17709 512 512
ReadX 13043 18221 512 512
ReadX 13043 18733 512 512
ReadX 13043 19245 512 512
ReadX 13043 19757 512 512
ReadX 13043 20269 512 512
ReadX 13043 20781 326 326
ReadX 13043 301 512 512
QUERY_FS_INFORMATION 259
Close 13041
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13044
Close 13044
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13045
ReadX 13045 0 24 24
Close 13045
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13046
QUERY_FILE_INFORMATION 13046
ReadX 13046 0 512 512
ReadX 13046 476 512 512
ReadX 13046 510 512 512
ReadX 13046 484 512 512
ReadX 13046 474 512 512
ReadX 13046 478 512 512
ReadX 13046 990 512 512
ReadX 13046 509 57 57
Close 13046
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13047
QUERY_FILE_INFORMATION 13047
ReadX 13047 0 512 512
ReadX 13047 476 512 512
ReadX 13047 510 512 512
ReadX 13047 484 512 512
ReadX 13047 480 512 512
ReadX 13047 474 512 512
ReadX 13047 478 512 512
QUERY_FILE_INFORMATION 13047
WriteX 13047 494 60 60
WriteX 13047 494 4 4
QUERY_FILE_INFORMATION 13047
WriteX 13047 494 11 11
WriteX 13047 510 512 512
WriteX 13047 484 512 512
WriteX 13047 474 512 512
WriteX 13047 478 512 512
WriteX 13047 990 512 512
Close 13047
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13048
Close 13048
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13049
Close 13049
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13051
WriteX 13051 4607 1 1
QUERY_FILE_INFORMATION 13051
WriteX 13051 0 65471 65471
WriteX 13051 65471 65 65
WriteX 13051 65536 19490 19490
Close 13051
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13052
QUERY_FILE_INFORMATION 13052
ReadX 13052 0 512 512
ReadX 13052 482 512 512
ReadX 13052 994 512 512
ReadX 13052 1506 512 512
ReadX 13052 480 512 512
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 490 448 448
QUERY_FILE_INFORMATION 13052
WriteX 13052 490 60 60
WriteX 13052 490 4 4
QUERY_FILE_INFORMATION 13052
WriteX 13052 490 11 11
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 484 512 512
WriteX 13052 996 512 512
WriteX 13052 1508 512 512
WriteX 13052 482 512 512
WriteX 13052 0 512 512
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
ReadX 13052 490 512 512
WriteX 13052 502 512 512
WriteX 13052 502 292 292
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 503 20 20
WriteX 13052 503 108 108
QUERY_FILE_INFORMATION 13052
WriteX 13052 504 448 448
QUERY_FILE_INFORMATION 13052
WriteX 13052 504 44 44
WriteX 13052 504 20 20
WriteX 13052 500 512 512
WriteX 13052 492 512 512
WriteX 13052 496 512 512
WriteX 13052 1008 512 512
WriteX 13052 494 512 512
Flush 13052
WriteX 13052 0 512 512
Flush 13052
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 500 512 512
WriteX 13052 492 512 512
WriteX 13052 496 512 512
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 518 320 320
QUERY_FILE_INFORMATION 13052
WriteX 13052 518 60 60
ReadX 13052 504 512 512
WriteX 13052 522 512 512
WriteX 13052 506 3204 3204
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 519 25 25
WriteX 13052 518 103 103
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 519 44 44
WriteX 13052 519 20 20
WriteX 13052 520 512 512
WriteX 13052 482 512 512
WriteX 13052 486 512 512
WriteX 13052 998 512 512
WriteX 13052 484 512 512
WriteX 13052 490 512 512
Flush 13052
WriteX 13052 0 512 512
Flush 13052
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
QUERY_FILE_INFORMATION 13052
WriteX 13052 519 7 7
WriteX 13052 519 57 57
WriteX 13052 520 512 512
WriteX 13052 492 512 512
WriteX 13052 482 512 512
WriteX 13052 486 512 512
WriteX 13052 998 512 512
Flush 13052
WriteX 13052 520 512 512
Flush 13052
Close 13052
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13053
Close 13053
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13054
QUERY_FILE_INFORMATION 13054
ReadX 13054 0 512 512
ReadX 13054 490 512 512
ReadX 13054 484 512 512
ReadX 13054 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13055
Close 13055
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13054
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13056
Close 13056
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13057
ReadX 13057 0 24 24
Close 13057
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13058
QUERY_FILE_INFORMATION 13058
ReadX 13058 0 512 512
ReadX 13058 366 512 512
ReadX 13058 878 512 512
ReadX 13058 1390 512 512
ReadX 13058 1902 512 512
ReadX 13058 374 57 57
Close 13058
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13059
QUERY_FILE_INFORMATION 13059
ReadX 13059 0 512 512
ReadX 13059 366 512 512
ReadX 13059 878 512 512
ReadX 13059 1390 512 512
ReadX 13059 1902 512 512
QUERY_FILE_INFORMATION 13059
WriteX 13059 374 60 60
WriteX 13059 374 4 4
QUERY_FILE_INFORMATION 13059
WriteX 13059 374 11 11
ReadX 13059 374 57 57
ReadX 13059 374 57 57
ReadX 13059 292 4096 4096
ReadX 13059 364 512 512
ReadX 13059 512 4096 4096
ReadX 13059 4608 4096 4096
ReadX 13059 8704 4096 4096
ReadX 13059 12800 4096 4096
ReadX 13059 16896 4096 4096
ReadX 13059 20992 4096 4096
ReadX 13059 25088 4096 4096
ReadX 13059 29184 4096 4096
ReadX 13059 33280 4096 4096
ReadX 13059 37376 4096 4096
ReadX 13059 41472 4096 4096
ReadX 13059 45568 4096 4096
ReadX 13059 49664 4096 4096
ReadX 13059 53760 4096 4096
ReadX 13059 57856 4096 4096
ReadX 13059 61952 4096 4096
ReadX 13059 66048 4096 4096
ReadX 13059 70144 4096 4096
ReadX 13059 74240 162 162
ReadX 13059 308 4096 4096
ReadX 13059 4404 4096 4096
WriteX 13059 368 512 512
WriteX 13059 880 512 512
WriteX 13059 1392 512 512
Close 13059
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13060
Close 13060
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13061
QUERY_FILE_INFORMATION 13061
ReadX 13061 0 512 512
ReadX 13061 366 512 512
ReadX 13061 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13062
Close 13062
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13061
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13064
WriteX 13064 4607 1 1
QUERY_FILE_INFORMATION 13064
WriteX 13064 0 65471 65471
WriteX 13064 65471 65 65
WriteX 13064 65536 8866 8866
Close 13064
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13065
QUERY_FILE_INFORMATION 13065
ReadX 13065 0 512 512
ReadX 13065 366 512 512
ReadX 13065 878 512 512
ReadX 13065 1390 512 512
ReadX 13065 364 512 512
QUERY_FILE_INFORMATION 13065
QUERY_FILE_INFORMATION 13065
QUERY_FILE_INFORMATION 13065
WriteX 13065 374 448 448
QUERY_FILE_INFORMATION 13065
WriteX 13065 374 60 60
WriteX 13065 374 4 4
QUERY_FILE_INFORMATION 13065
WriteX 13065 374 11 11
QUERY_FILE_INFORMATION 13065
QUERY_FILE_INFORMATION 13065
WriteX 13065 374 7 7
WriteX 13065 374 57 57
WriteX 13065 368 512 512
WriteX 13065 880 512 512
WriteX 13065 1392 512 512
WriteX 13065 366 512 512
WriteX 13065 0 512 512
Flush 13065
WriteX 13065 368 512 512
Flush 13065
Close 13065
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13066
QUERY_FILE_INFORMATION 13066
ReadX 13066 0 512 512
ReadX 13066 366 512 512
ReadX 13066 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13066
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13067
Close 13067
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13068
ReadX 13068 0 24 24
Close 13068
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13069
QUERY_FILE_INFORMATION 13069
ReadX 13069 0 512 512
ReadX 13069 366 512 512
ReadX 13069 878 512 512
ReadX 13069 1390 512 512
ReadX 13069 1902 512 512
ReadX 13069 374 57 57
Close 13069
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13070
QUERY_FILE_INFORMATION 13070
ReadX 13070 0 512 512
ReadX 13070 366 512 512
ReadX 13070 878 512 512
ReadX 13070 1390 512 512
ReadX 13070 1902 512 512
QUERY_FILE_INFORMATION 13070
WriteX 13070 374 60 60
WriteX 13070 374 4 4
QUERY_FILE_INFORMATION 13070
WriteX 13070 374 11 11
WriteX 13070 368 512 512
WriteX 13070 880 512 512
WriteX 13070 1392 512 512
Close 13070
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13071
Close 13071
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13072
Close 13072
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13074
WriteX 13074 4607 1 1
QUERY_FILE_INFORMATION 13074
WriteX 13074 0 65471 65471
WriteX 13074 65471 65 65
WriteX 13074 65536 9298 9298
Close 13074
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13075
QUERY_FILE_INFORMATION 13075
ReadX 13075 0 512 512
ReadX 13075 368 512 512
ReadX 13075 880 512 512
ReadX 13075 1392 512 512
ReadX 13075 366 512 512
QUERY_FILE_INFORMATION 13075
QUERY_FILE_INFORMATION 13075
QUERY_FILE_INFORMATION 13075
WriteX 13075 376 448 448
QUERY_FILE_INFORMATION 13075
WriteX 13075 376 60 60
WriteX 13075 376 4 4
QUERY_FILE_INFORMATION 13075
WriteX 13075 376 11 11
QUERY_FILE_INFORMATION 13075
QUERY_FILE_INFORMATION 13075
WriteX 13075 376 7 7
WriteX 13075 376 57 57
WriteX 13075 370 512 512
WriteX 13075 882 512 512
WriteX 13075 1394 512 512
WriteX 13075 368 512 512
WriteX 13075 0 512 512
Flush 13075
WriteX 13075 370 512 512
Flush 13075
Close 13075
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13076
Close 13076
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13077
QUERY_FILE_INFORMATION 13077
ReadX 13077 0 512 512
ReadX 13077 368 512 512
ReadX 13077 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13078
Close 13078
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13080
Close 13080
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13081
ReadX 13081 0 24 24
Close 13081
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13082
QUERY_FILE_INFORMATION 13082
ReadX 13082 0 512 512
ReadX 13082 512 512 512
ReadX 13082 1024 512 512
ReadX 13082 2016 512 512
ReadX 13082 1056 512 512
ReadX 13082 1096 57 57
Close 13082
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13083
QUERY_FILE_INFORMATION 13083
ReadX 13083 0 512 512
ReadX 13083 512 512 512
ReadX 13083 1024 512 512
ReadX 13083 2016 512 512
ReadX 13083 1056 512 512
ReadX 13083 1096 57 57
ReadX 13083 1096 57 57
ReadX 13083 1088 62 62
ReadX 13083 1536 4096 4096
ReadX 13083 5632 4096 4096
ReadX 13083 9728 4096 4096
ReadX 13083 13824 2859 2859
ReadX 13083 1120 28 28
ReadX 13083 1148 20 20
ReadX 13083 1168 8 8
ReadX 13083 1176 88 88
ReadX 13083 1264 8 8
ReadX 13083 1272 4 4
ReadX 13083 1276 4 4
ReadX 13083 1280 1 1
ReadX 13083 1130 4 4
ReadX 13083 1134 4 4
ReadX 13083 1138 1 1
ReadX 13083 1131 4 4
ReadX 13083 1135 4 4
ReadX 13083 1139 1 1
ReadX 13083 1131 4 4
ReadX 13083 1135 4 4
ReadX 13083 1139 2 2
ReadX 13083 1132 4 4
ReadX 13083 1136 4 4
ReadX 13083 1140 25 25
ReadX 13083 1134 4 4
ReadX 13083 1138 8 8
ReadX 13083 1146 4 4
ReadX 13083 1150 8 8
ReadX 13083 1158 4 4
ReadX 13083 1162 8 8
ReadX 13083 1170 4 4
ReadX 13083 1174 4 4
ReadX 13083 1178 4 4
ReadX 13083 1182 4 4
ReadX 13083 1186 4 4
ReadX 13083 1190 4 4
ReadX 13083 1194 13900 13900
ReadX 13083 2048 4096 4096
Close 13083
QUERY_FS_INFORMATION 259
Close 13077
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13084
Close 13084
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13085
ReadX 13085 0 24 24
Close 13085
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13086
QUERY_FILE_INFORMATION 13086
ReadX 13086 0 512 512
ReadX 13086 368 512 512
ReadX 13086 880 512 512
ReadX 13086 1392 512 512
ReadX 13086 1904 512 512
ReadX 13086 376 57 57
Close 13086
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13087
QUERY_FILE_INFORMATION 13087
ReadX 13087 0 512 512
ReadX 13087 368 512 512
ReadX 13087 880 512 512
ReadX 13087 1392 512 512
ReadX 13087 1904 512 512
QUERY_FILE_INFORMATION 13087
WriteX 13087 376 60 60
WriteX 13087 376 4 4
QUERY_FILE_INFORMATION 13087
WriteX 13087 376 11 11
WriteX 13087 370 512 512
WriteX 13087 882 512 512
WriteX 13087 1394 512 512
Close 13087
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13088
Close 13088
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13089
Close 13089
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13091
WriteX 13091 4607 1 1
QUERY_FILE_INFORMATION 13091
WriteX 13091 0 65471 65471
WriteX 13091 65471 65 65
WriteX 13091 65536 11540 11540
Close 13091
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13092
QUERY_FILE_INFORMATION 13092
ReadX 13092 0 512 512
ReadX 13092 398 512 512
ReadX 13092 910 512 512
ReadX 13092 1422 512 512
ReadX 13092 396 512 512
QUERY_FILE_INFORMATION 13092
QUERY_FILE_INFORMATION 13092
QUERY_FILE_INFORMATION 13092
WriteX 13092 406 448 448
QUERY_FILE_INFORMATION 13092
WriteX 13092 406 60 60
WriteX 13092 406 4 4
QUERY_FILE_INFORMATION 13092
WriteX 13092 406 11 11
QUERY_FILE_INFORMATION 13092
QUERY_FILE_INFORMATION 13092
WriteX 13092 406 7 7
WriteX 13092 406 57 57
WriteX 13092 400 512 512
WriteX 13092 912 512 512
WriteX 13092 1424 512 512
WriteX 13092 398 512 512
WriteX 13092 0 512 512
Flush 13092
WriteX 13092 400 512 512
Flush 13092
Close 13092
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13093
Close 13093
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13094
QUERY_FILE_INFORMATION 13094
ReadX 13094 0 512 512
ReadX 13094 398 512 512
ReadX 13094 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13095
Close 13095
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13094
ReadX 13043 1434 512 512
Close 13043
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13096
WriteX 13096 0 65471 65471
WriteX 13096 65471 63 63
WriteX 13096 65534 65471 65471
WriteX 13096 131005 63 63
Close 13096
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13097
WriteX 13097 0 65471 65471
WriteX 13097 65471 63 63
WriteX 13097 65534 65471 65471
WriteX 13097 131005 63 63
WriteX 13097 131068 65471 65471
WriteX 13097 196539 63 63
WriteX 13097 196602 65471 65471
WriteX 13097 262073 63 63
Close 13097
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13098
WriteX 13098 0 65471 65471
WriteX 13098 65471 63 63
WriteX 13098 65534 65471 65471
WriteX 13098 131005 63 63
WriteX 13098 131068 65471 65471
WriteX 13098 196539 63 63
WriteX 13098 196602 65471 65471
WriteX 13098 262073 63 63
WriteX 13098 262136 65471 65471
WriteX 13098 327607 63 63
WriteX 13098 327670 65471 65471
WriteX 13098 393141 63 63
WriteX 13098 393204 65471 65471
WriteX 13098 458675 63 63
WriteX 13098 458738 65471 65471
WriteX 13098 524209 63 63
Close 13098
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13099
Close 13099
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13100
ReadX 13100 0 512 512
ReadX 13100 512 511 511
ReadX 13100 1023 512 512
ReadX 13100 1535 512 512
Close 13100
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13101
ReadX 13101 0 512 512
ReadX 13101 512 510 510
ReadX 13101 1022 512 512
ReadX 13101 1534 510 510
ReadX 13101 2044 510 510
Close 13101
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13102
ReadX 13102 0 512 512
ReadX 13102 512 512 512
ReadX 13102 1024 512 512
ReadX 13102 1536 512 512
ReadX 13102 2048 512 512
ReadX 13102 2560 512 512
ReadX 13102 3072 512 512
ReadX 13102 3584 512 512
ReadX 13102 4096 512 512
ReadX 13102 4608 512 512
ReadX 13102 5120 512 512
ReadX 13102 5632 512 512
ReadX 13102 6144 512 512
ReadX 13102 6656 512 512
ReadX 13102 7168 512 512
ReadX 13102 7680 512 512
ReadX 13102 8192 512 512
ReadX 13102 8704 512 512
Close 13102
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13103
Close 13103
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13104
QUERY_FILE_INFORMATION 13104
Close 13104
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13105
ReadX 13105 0 8192 8192
Close 13105
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13106
Close 13106
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13107
QUERY_FILE_INFORMATION 13107
Close 13107
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13108
ReadX 13108 0 8192 8192
Close 13108
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13109
Close 13109
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13110
QUERY_FILE_INFORMATION 13110
Close 13110
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13111
ReadX 13111 0 8192 8192
Close 13111
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13112
ReadX 13112 0 8192 8192
ReadX 13112 8192 8192 8192
ReadX 13112 16384 8192 8192
ReadX 13112 24576 8192 8192
Close 13112
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13114
Close 13114
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13116
WriteX 13116 8191 1 1
QUERY_FILE_INFORMATION 13116
WriteX 13116 0 10438 10438
Close 13116
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13117
Close 13117
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13118
QUERY_FILE_INFORMATION 13118
QUERY_FILE_INFORMATION 13118
Close 13118
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 13119
QUERY_FILE_INFORMATION 13119
QUERY_FILE_INFORMATION 13119
Close 13119
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13120
Close 13120
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13121
QUERY_FILE_INFORMATION 13121
QUERY_FILE_INFORMATION 13121
Close 13121
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 13122
QUERY_FILE_INFORMATION 13122
QUERY_FILE_INFORMATION 13122
Close 13122
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13123
Close 13123
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13124
QUERY_FILE_INFORMATION 13124
QUERY_FILE_INFORMATION 13124
Close 13124
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 13125
QUERY_FILE_INFORMATION 13125
QUERY_FILE_INFORMATION 13125
Close 13125
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13126
Close 13126
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13127
QUERY_FILE_INFORMATION 13127
QUERY_FILE_INFORMATION 13127
Close 13127
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13128
ReadX 13128 0 8 8
ReadX 13128 8 4 4
ReadX 13128 12 8 8
ReadX 13128 22 8 8
ReadX 13128 520 8 8
ReadX 13128 525 8 8
ReadX 13128 533 4 4
ReadX 13128 543 8 8
ReadX 13128 551 4 4
ReadX 13128 1058 8 8
ReadX 13128 1066 4 4
ReadX 13128 1081 8 8
ReadX 13128 1089 4 4
ReadX 13128 660 8 8
Close 13128
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13129
ReadX 13129 0 8192 8192
Close 13129
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 13130
ReadX 13130 0 8192 8192
ReadX 13130 520 8192 8192
ReadX 13130 8712 8192 8192
ReadX 13130 16904 8192 8192
ReadX 13130 25096 8192 8192
ReadX 13130 33288 8192 8192
ReadX 13130 41480 8192 8192
ReadX 13130 49672 8192 8192
ReadX 13130 57864 8192 8192
ReadX 13130 66056 8192 8192
ReadX 13130 74248 8192 8192
ReadX 13130 82440 8192 8192
ReadX 13130 90632 8192 8192
ReadX 13130 98824 8192 8192
ReadX 13130 107016 8192 8192
ReadX 13130 115208 8192 8192
ReadX 13130 123400 8192 8192
ReadX 13130 131592 8192 8192
ReadX 13130 139784 8192 8192
ReadX 13130 147976 8192 8192
ReadX 13130 156168 8192 8192
Close 13130
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13131
QUERY_FILE_INFORMATION 13131
Close 13131
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13132
Close 13132
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13134
WriteX 13134 8191 1 1
QUERY_FILE_INFORMATION 13134
WriteX 13134 0 28489 28489
Close 13134
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13135
Close 13135
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13136
Close 13136
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13137
QUERY_FILE_INFORMATION 13137
Close 13137
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13138
ReadX 13138 0 8192 8192
Close 13138
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13139
Close 13139
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13140
QUERY_FILE_INFORMATION 13140
Close 13140
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13141
ReadX 13141 0 8192 8192
Close 13141
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13142
ReadX 13142 0 8192 8192
ReadX 13142 8192 8192 8192
ReadX 13142 16384 8192 8192
ReadX 13142 24576 8192 8192
ReadX 13142 32768 16384 16384
ReadX 13142 49152 8192 8192
ReadX 13142 57344 8192 8192
ReadX 13142 65536 8192 8192
Close 13142
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13144
Close 13144
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13146
WriteX 13146 8191 1 1
QUERY_FILE_INFORMATION 13146
WriteX 13146 0 29253 29253
Close 13146
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13147
Close 13147
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13148
QUERY_FILE_INFORMATION 13148
QUERY_FILE_INFORMATION 13148
Close 13148
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 13149
QUERY_FILE_INFORMATION 13149
QUERY_FILE_INFORMATION 13149
Close 13149
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13150
QUERY_FILE_INFORMATION 13150
Close 13150
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13151
Close 13151
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13153
WriteX 13153 8191 1 1
QUERY_FILE_INFORMATION 13153
WriteX 13153 0 30183 30183
Close 13153
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13154
Close 13154
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13155
WriteX 13155 0 510 510
WriteX 13155 510 512 512
WriteX 13155 1022 510 510
WriteX 13155 1532 510 510
WriteX 13155 2042 168 168
Close 13155
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13156
Close 13156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13157
WriteX 13157 0 511 511
WriteX 13157 511 512 512
WriteX 13157 1023 512 512
WriteX 13157 1535 488 488
Close 13157
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13158
ReadX 13158 0 65471 65471
ReadX 13158 65471 63 63
ReadX 13158 65534 65471 65471
ReadX 13158 131005 63 63
ReadX 13158 131068 65471 65471
ReadX 13158 196539 63 63
ReadX 13158 196602 65471 65471
ReadX 13158 262073 63 63
ReadX 13158 262136 65471 65471
ReadX 13158 327607 63 63
ReadX 13158 327670 10 10
Close 13158
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13159
ReadX 13159 0 65471 65471
ReadX 13159 65471 63 63
ReadX 13159 65534 65471 65471
ReadX 13159 131005 63 63
ReadX 13159 131068 65471 65471
ReadX 13159 196539 63 63
ReadX 13159 196602 65471 65471
ReadX 13159 262073 63 63
ReadX 13159 262136 65471 65471
ReadX 13159 327607 63 63
ReadX 13159 327670 65471 65471
ReadX 13159 393141 63 63
ReadX 13159 393204 65471 65471
ReadX 13159 458675 63 63
ReadX 13159 458738 65471 65471
ReadX 13159 524209 63 63
ReadX 13159 524272 65471 65471
ReadX 13159 589743 63 63
ReadX 13159 589806 65471 65471
ReadX 13159 655277 63 63
ReadX 13159 655340 32 32
Close 13159
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13160
ReadX 13160 0 65471 65471
ReadX 13160 65471 63 63
ReadX 13160 65534 65471 65471
ReadX 13160 131005 63 63
ReadX 13160 131068 65471 65471
ReadX 13160 196539 63 63
ReadX 13160 196602 65471 65471
ReadX 13160 262073 63 63
ReadX 13160 262136 65471 65471
ReadX 13160 327607 63 63
ReadX 13160 327670 65471 65471
ReadX 13160 393141 63 63
ReadX 13160 393204 65471 65471
ReadX 13160 458675 63 63
ReadX 13160 458738 65471 65471
ReadX 13160 524209 63 63
ReadX 13160 524272 65471 65471
ReadX 13160 589743 63 63
ReadX 13160 589806 65471 65471
ReadX 13160 655277 63 63
ReadX 13160 655340 65471 65471
ReadX 13160 720811 63 63
ReadX 13160 720874 65471 65471
ReadX 13160 786345 63 63
ReadX 13160 786408 65471 65471
ReadX 13160 851879 63 63
ReadX 13160 851942 65471 65471
ReadX 13160 917413 63 63
ReadX 13160 917476 65471 65471
ReadX 13160 982947 63 63
ReadX 13160 983010 65471 65471
ReadX 13160 1048481 63 63
ReadX 13160 1048544 65471 65471
ReadX 13160 1114015 63 63
ReadX 13160 1114078 65471 65471
ReadX 13160 1179549 63 63
ReadX 13160 1179612 65471 65471
ReadX 13160 1245083 63 63
ReadX 13160 1245146 65471 65471
ReadX 13160 1310617 63 63
ReadX 13160 1310680 65471 65471
ReadX 13160 1376151 63 63
ReadX 13160 1376214 65471 65471
ReadX 13160 1441685 63 63
ReadX 13160 1441748 65471 65471
ReadX 13160 1507219 63 63
ReadX 13160 1507282 65471 65471
ReadX 13160 1572753 63 63
ReadX 13160 1572816 65471 65471
ReadX 13160 1638287 63 63
ReadX 13160 1638350 65471 65471
ReadX 13160 1703821 63 63
ReadX 13160 1703884 65471 65471
ReadX 13160 1769355 63 63
ReadX 13160 1769418 65471 65471
ReadX 13160 1834889 63 63
ReadX 13160 1834952 32824 32824
Close 13160
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13161
QUERY_FILE_INFORMATION 13161
ReadX 13161 0 512 512
ReadX 13161 512 512 512
ReadX 13161 1024 512 512
QUERY_FILE_INFORMATION 13161
QUERY_FILE_INFORMATION 13161
ReadX 13161 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13161
QUERY_FILE_INFORMATION 13161
ReadX 13161 512 4096 4096
QUERY_FILE_INFORMATION 13161
QUERY_FILE_INFORMATION 13161
QUERY_FILE_INFORMATION 13161
WriteX 13161 512 4096 4096
WriteX 13161 1024 512 512
ReadX 13161 502 512 512
QUERY_FILE_INFORMATION 13161
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13161 2560 512 512
ReadX 13161 1536 512 512
ReadX 13161 2176 384 384
ReadX 13161 3072 128 128
ReadX 13161 3107 512 512
ReadX 13161 3619 512 512
ReadX 13161 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13161 286 123 123
ReadX 13161 292 24 24
ReadX 13161 512 2048 2048
ReadX 13161 512 2048 2048
ReadX 13161 2560 2048 2048
ReadX 13161 416 1536 1536
ReadX 13161 768 512 512
ReadX 13161 1280 2048 2048
ReadX 13161 3328 2048 2048
ReadX 13161 5376 2048 2048
ReadX 13161 7424 2048 2048
ReadX 13161 9472 2048 2048
ReadX 13161 11520 2048 2048
ReadX 13161 13568 2048 2048
ReadX 13161 15616 2048 2048
ReadX 13161 17664 2048 2048
ReadX 13161 19712 2048 2048
ReadX 13161 21760 2048 2048
ReadX 13161 23808 2048 2048
ReadX 13161 25856 2048 2048
ReadX 13161 27904 2048 2048
ReadX 13161 29952 2048 2048
ReadX 13161 32000 2048 2048
ReadX 13161 34048 2048 2048
ReadX 13161 36096 2048 2048
ReadX 13161 38144 2048 2048
ReadX 13161 40192 2048 2048
ReadX 13161 42240 512 512
ReadX 13161 42752 2048 2048
ReadX 13161 44800 2048 2048
ReadX 13161 46848 2048 2048
ReadX 13161 48896 2048 2048
ReadX 13161 50944 2048 2048
ReadX 13161 52992 2048 2048
ReadX 13161 55040 2048 2048
ReadX 13161 57088 2048 2048
ReadX 13161 316 2048 2048
ReadX 13161 2364 2048 2048
ReadX 13161 4412 2048 2048
ReadX 13161 6460 2048 2048
ReadX 13161 8508 2048 2048
ReadX 13161 10556 2048 2048
ReadX 13161 12604 2048 2048
ReadX 13161 14652 2048 2048
ReadX 13161 16700 2048 2048
ReadX 13161 18748 2048 2048
ReadX 13161 20796 2048 2048
ReadX 13161 22844 2048 2048
ReadX 13161 24892 2048 2048
ReadX 13161 26940 2048 2048
ReadX 13161 28988 2048 2048
ReadX 13161 31036 2048 2048
ReadX 13161 436 2048 2048
ReadX 13161 2484 2048 2048
ReadX 13161 4532 2048 2048
ReadX 13161 6580 2048 2048
ReadX 13161 8628 2048 2048
ReadX 13161 10676 2048 2048
ReadX 13161 476 2048 2048
ReadX 13161 476 2048 2048
ReadX 13161 476 2048 2048
ReadX 13161 2524 2048 2048
ReadX 13161 484 2048 2048
ReadX 13161 484 2048 2048
ReadX 13161 484 2048 2048
ReadX 13161 2532 665 665
ReadX 13161 492 665 665
ReadX 13161 492 665 665
ReadX 13161 492 665 665
ReadX 13161 296 512 512
ReadX 13161 318 512 512
ReadX 13161 300 512 512
ReadX 13161 312 512 512
ReadX 13161 320 512 512
ReadX 13161 832 354 354
ReadX 13161 504 4096 4096
ReadX 13161 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13162
Close 13162
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13163
WriteX 13163 1535 1 1
QUERY_FILE_INFORMATION 13163
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13161 296 1251 1251
ReadX 13161 2176 384 384
ReadX 13161 3072 1634 1634
QUERY_FILE_INFORMATION 13163
WriteX 13163 0 57088 57088
WriteX 13163 0 4096 4096
Flush 13163
Close 13161
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13164
Close 13164
WriteX 13163 0 4096 4096
Close 13163
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13165
Close 13165
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13166
QUERY_FILE_INFORMATION 13166
ReadX 13166 0 512 512
ReadX 13166 512 512 512
ReadX 13166 1024 512 512
QUERY_FILE_INFORMATION 13166
QUERY_FILE_INFORMATION 13166
ReadX 13166 512 2048 2048
QUERY_FILE_INFORMATION 13166
QUERY_FILE_INFORMATION 13166
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13166 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13167
WriteX 13167 1535 1 1
QUERY_FILE_INFORMATION 13167
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13166 1536 512 512
ReadX 13166 288 1251 1251
ReadX 13166 2048 2018 2018
QUERY_FILE_INFORMATION 13167
WriteX 13167 0 51456 51456
WriteX 13167 0 4096 4096
Flush 13167
QUERY_FILE_INFORMATION 13166
QUERY_FILE_INFORMATION 13166
Close 13166
WriteX 13167 0 4096 4096
Close 13167
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 13168
Close 13168
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13169
QUERY_FILE_INFORMATION 13169
ReadX 13169 0 512 512
ReadX 13169 512 512 512
ReadX 13169 1024 512 512
QUERY_FILE_INFORMATION 13169
QUERY_FILE_INFORMATION 13169
ReadX 13169 512 2048 2048
QUERY_FILE_INFORMATION 13169
QUERY_FILE_INFORMATION 13169
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13169 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13171
Close 13171
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13173
WriteX 13173 4045 1 1
QUERY_FILE_INFORMATION 13173
WriteX 13173 0 53077 53077
Close 13173
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13174
WriteX 13174 1535 1 1
QUERY_FILE_INFORMATION 13174
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13169 1536 512 512
ReadX 13169 288 1251 1251
ReadX 13169 2048 2018 2018
QUERY_FILE_INFORMATION 13174
WriteX 13174 0 65471 65471
WriteX 13174 65471 65 65
WriteX 13174 65536 1856 1856
WriteX 13174 0 4096 4096
Flush 13174
QUERY_FILE_INFORMATION 13169
QUERY_FILE_INFORMATION 13169
Close 13169
WriteX 13174 0 4096 4096
Close 13174
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 13175
Close 13175
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13176
QUERY_FILE_INFORMATION 13176
ReadX 13176 0 512 512
ReadX 13176 512 512 512
ReadX 13176 1024 512 512
QUERY_FILE_INFORMATION 13176
QUERY_FILE_INFORMATION 13176
ReadX 13176 576 2048 2048
QUERY_FILE_INFORMATION 13176
QUERY_FILE_INFORMATION 13176
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13178
Close 13178
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13180
WriteX 13180 4076 1 1
QUERY_FILE_INFORMATION 13180
WriteX 13180 0 7983 7983
Close 13180
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13182
Close 13182
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13184
WriteX 13184 4095 1 1
QUERY_FILE_INFORMATION 13184
WriteX 13184 0 65471 65471
WriteX 13184 65471 65 65
WriteX 13184 65536 65471 65471
WriteX 13184 131007 65 65
WriteX 13184 131072 65471 65471
WriteX 13184 196543 65 65
WriteX 13184 196608 65471 65471
WriteX 13184 262079 65 65
WriteX 13184 262144 65471 65471
WriteX 13184 327615 65 65
WriteX 13184 327680 65471 65471
WriteX 13184 393151 65 65
WriteX 13184 393216 65471 65471
WriteX 13184 458687 65 65
WriteX 13184 458752 46731 46731
Close 13184
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13185
WriteX 13185 1535 1 1
QUERY_FILE_INFORMATION 13185
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13176 1536 512 512
ReadX 13176 2048 2018 2018
ReadX 13176 4096 512 512
ReadX 13176 4608 2197 2197
QUERY_FILE_INFORMATION 13185
WriteX 13185 0 65471 65471
WriteX 13185 65471 65 65
WriteX 13185 65536 22848 22848
WriteX 13185 0 4096 4096
Flush 13185
QUERY_FILE_INFORMATION 13176
QUERY_FILE_INFORMATION 13176
Close 13176
WriteX 13185 0 4096 4096
Close 13185
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 13186
Close 13186
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 13187
QUERY_FILE_INFORMATION 13187
ReadX 13187 0 512 512
ReadX 13187 512 512 512
ReadX 13187 1024 512 512
QUERY_FILE_INFORMATION 13187
QUERY_FILE_INFORMATION 13187
ReadX 13187 576 2048 2048
QUERY_FILE_INFORMATION 13187
QUERY_FILE_INFORMATION 13187
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13187 4096 512 512
Close 13187
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13188
QUERY_FILE_INFORMATION 13188
ReadX 13188 0 512 512
ReadX 13188 512 512 512
ReadX 13188 1024 512 512
QUERY_FILE_INFORMATION 13188
QUERY_FILE_INFORMATION 13188
ReadX 13188 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 13188
QUERY_FILE_INFORMATION 13188
ReadX 13188 288 4096 4096
QUERY_FILE_INFORMATION 13188
QUERY_FILE_INFORMATION 13188
QUERY_FILE_INFORMATION 13188
WriteX 13188 288 4096 4096
WriteX 13188 1024 512 512
ReadX 13188 1536 512 512
QUERY_FILE_INFORMATION 13188
ReadX 13188 288 2048 2048
ReadX 13188 2336 2048 2048
ReadX 13188 3072 1536 1536
ReadX 13188 544 512 512
ReadX 13188 1056 2048 2048
ReadX 13188 3104 2048 2048
ReadX 13188 5152 2048 2048
ReadX 13188 7200 2048 2048
ReadX 13188 9248 2048 2048
ReadX 13188 11296 2048 2048
ReadX 13188 13344 2048 2048
ReadX 13188 15392 2048 2048
ReadX 13188 17440 2048 2048
ReadX 13188 19488 2048 2048
ReadX 13188 21536 2048 2048
ReadX 13188 23584 2048 2048
ReadX 13188 25632 2048 2048
ReadX 13188 27680 2048 2048
ReadX 13188 29728 2048 2048
ReadX 13188 31776 2048 2048
ReadX 13188 33824 2048 2048
ReadX 13188 35872 2048 2048
ReadX 13188 37920 2048 2048
ReadX 13188 39968 2048 2048
ReadX 13188 42016 512 512
ReadX 13188 42528 512 512
ReadX 13188 43040 1536 1536
ReadX 13188 44576 2048 2048
ReadX 13188 46624 2048 2048
ReadX 13188 48672 2048 2048
ReadX 13188 50720 2048 2048
ReadX 13188 52768 2048 2048
ReadX 13188 54816 2048 2048
ReadX 13188 56864 2048 2048
ReadX 13188 58912 2048 2048
ReadX 13188 60960 2048 2048
ReadX 13188 63008 2048 2048
ReadX 13188 65056 2048 2048
ReadX 13188 67104 2048 2048
ReadX 13188 69152 2048 2048
ReadX 13188 71200 2048 2048
ReadX 13188 73248 2048 2048
ReadX 13188 75296 2048 2048
ReadX 13188 77344 2048 2048
ReadX 13188 79392 2048 2048
ReadX 13188 81440 2048 2048
ReadX 13188 83488 2048 2048
ReadX 13188 85536 512 512
ReadX 13188 86048 512 512
ReadX 13188 86560 1536 1536
ReadX 13188 88096 2048 2048
ReadX 13188 90144 2048 2048
ReadX 13188 92192 2048 2048
ReadX 13188 94240 2048 2048
ReadX 13188 96288 2048 2048
ReadX 13188 552 2048 2048
ReadX 13188 2600 2048 2048
ReadX 13188 4648 2048 2048
ReadX 13188 6696 2048 2048
ReadX 13188 8744 2048 2048
ReadX 13188 10792 2048 2048
ReadX 13188 12840 2048 2048
ReadX 13188 14888 2048 2048
ReadX 13188 16936 2048 2048
ReadX 13188 18984 2048 2048
ReadX 13188 21032 2048 2048
ReadX 13188 23080 2048 2048
ReadX 13188 25128 2048 2048
ReadX 13188 27176 2048 2048
ReadX 13188 29224 2048 2048
ReadX 13188 31272 2048 2048
ReadX 13188 33320 2048 2048
ReadX 13188 35368 2048 2048
ReadX 13188 37416 2048 2048
ReadX 13188 39464 2048 2048
ReadX 13188 41512 512 512
ReadX 13188 42024 512 512
ReadX 13188 42536 1536 1536
ReadX 13188 44072 2048 2048
ReadX 13188 46120 2048 2048
ReadX 13188 48168 2048 2048
ReadX 13188 50216 2048 2048
ReadX 13188 52264 2048 2048
ReadX 13188 54312 2048 2048
ReadX 13188 56360 2048 2048
ReadX 13188 58408 2048 2048
ReadX 13188 60456 2048 2048
ReadX 13188 62504 2048 2048
ReadX 13188 64552 2048 2048
ReadX 13188 66600 2048 2048
ReadX 13188 68648 2048 2048
ReadX 13188 70696 2048 2048
ReadX 13188 72744 2048 2048
ReadX 13188 74792 2048 2048
ReadX 13188 76840 2048 2048
ReadX 13188 78888 2048 2048
ReadX 13188 80936 2048 2048
ReadX 13188 82984 2048 2048
ReadX 13188 85032 512 512
ReadX 13188 85544 2048 2048
ReadX 13188 87592 2048 2048
ReadX 13188 89640 2048 2048
ReadX 13188 91688 2048 2048
ReadX 13188 93736 2048 2048
ReadX 13188 95784 2048 2048
ReadX 13188 97832 2048 2048
ReadX 13188 99880 2048 2048
ReadX 13188 101928 2048 2048
ReadX 13188 103976 2048 2048
ReadX 13188 106024 2048 2048
ReadX 13188 108072 2048 2048
ReadX 13188 110120 2048 2048
ReadX 13188 112168 2048 2048
ReadX 13188 114216 2048 2048
ReadX 13188 116264 2048 2048
ReadX 13188 118312 2048 2048
ReadX 13188 120360 2048 2048
ReadX 13188 122408 2048 2048
ReadX 13188 124456 512 512
ReadX 13188 124968 512 512
ReadX 13188 125480 1536 1536
ReadX 13188 127016 2048 2048
ReadX 13188 129064 2048 2048
ReadX 13188 131112 2048 2048
ReadX 13188 133160 2048 2048
ReadX 13188 135208 2048 2048
ReadX 13188 137256 2048 2048
ReadX 13188 139304 2048 2048
ReadX 13188 141352 2048 2048
ReadX 13188 143400 2048 2048
ReadX 13188 145448 2048 2048
ReadX 13188 147496 2048 2048
ReadX 13188 149544 2048 2048
ReadX 13188 151592 2048 2048
ReadX 13188 153640 2048 2048
ReadX 13188 155688 2048 2048
ReadX 13188 157736 2048 2048
ReadX 13188 159784 2048 2048
ReadX 13188 161832 2048 2048
ReadX 13188 163880 2048 2048
ReadX 13188 165928 2048 2048
ReadX 13188 167976 2048 2048
ReadX 13188 170024 512 512
ReadX 13188 1538 1536 1536
ReadX 13188 3074 2048 2048
ReadX 13188 5122 2048 2048
ReadX 13188 7170 2048 2048
ReadX 13188 9218 2048 2048
ReadX 13188 11266 2048 2048
ReadX 13188 13314 2048 2048
ReadX 13188 15362 2048 2048
ReadX 13188 17410 2048 2048
ReadX 13188 19458 2048 2048
ReadX 13188 21506 2048 2048
ReadX 13188 23554 2048 2048
ReadX 13188 25602 2048 2048
ReadX 13188 27650 2048 2048
ReadX 13188 29698 2048 2048
ReadX 13188 31746 2048 2048
ReadX 13188 33794 2048 2048
ReadX 13188 35842 2048 2048
ReadX 13188 37890 2048 2048
ReadX 13188 39938 2048 2048
ReadX 13188 41986 2048 2048
ReadX 13188 44034 875 875
ReadX 13188 1730 4096 4096
ReadX 13188 1724 1536 1536
ReadX 13188 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13189
Close 13189
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13190
WriteX 13190 2047 1 1
QUERY_FILE_INFORMATION 13190
Close 13188
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13191
Close 13191
WriteX 13190 0 42388 42388
Close 13190
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13192
Close 13192
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13193
QUERY_FILE_INFORMATION 13193
ReadX 13193 0 512 512
ReadX 13193 1756 512 512
ReadX 13193 2268 512 512
QUERY_FILE_INFORMATION 13193
QUERY_FILE_INFORMATION 13193
ReadX 13193 1744 512 512
ReadX 13193 2256 512 512
ReadX 13193 2768 512 512
ReadX 13193 3280 512 512
ReadX 13193 3792 512 512
ReadX 13193 4304 512 512
ReadX 13193 512 2048 2048
QUERY_FILE_INFORMATION 13193
QUERY_FILE_INFORMATION 13193
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13194
WriteX 13194 2047 1 1
QUERY_FILE_INFORMATION 13194
QUERY_FILE_INFORMATION 13193
QUERY_FILE_INFORMATION 13193
Close 13193
WriteX 13194 0 42652 42652
Close 13194
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 13195
Close 13195
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 13196
QUERY_FILE_INFORMATION 13196
ReadX 13196 0 512 512
ReadX 13196 1762 512 512
ReadX 13196 2274 512 512
QUERY_FILE_INFORMATION 13196
QUERY_FILE_INFORMATION 13196
ReadX 13196 1750 512 512
ReadX 13196 2262 512 512
ReadX 13196 2774 512 512
ReadX 13196 3286 512 512
ReadX 13196 3798 512 512
ReadX 13196 4310 512 512
ReadX 13196 512 2048 2048
QUERY_FILE_INFORMATION 13196
QUERY_FILE_INFORMATION 13196
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13198
Close 13198
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13200
WriteX 13200 4080 1 1
QUERY_FILE_INFORMATION 13200
WriteX 13200 0 65471 65471
WriteX 13200 65471 65 65
WriteX 13200 65536 49 49
Close 13200
Close 13196
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13201
WriteX 13201 0 65471 65471
WriteX 13201 65471 63 63
WriteX 13201 65534 65471 65471
WriteX 13201 131005 63 63
Close 13201
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13202
WriteX 13202 0 65471 65471
WriteX 13202 65471 63 63
WriteX 13202 65534 65471 65471
WriteX 13202 131005 63 63
WriteX 13202 131068 65471 65471
WriteX 13202 196539 63 63
WriteX 13202 196602 65471 65471
WriteX 13202 262073 63 63
Close 13202
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13203
WriteX 13203 0 65471 65471
WriteX 13203 65471 63 63
WriteX 13203 65534 65471 65471
WriteX 13203 131005 63 63
WriteX 13203 131068 65471 65471
WriteX 13203 196539 63 63
WriteX 13203 196602 65471 65471
WriteX 13203 262073 63 63
WriteX 13203 262136 65471 65471
WriteX 13203 327607 63 63
WriteX 13203 327670 65471 65471
WriteX 13203 393141 63 63
WriteX 13203 393204 65471 65471
WriteX 13203 458675 63 63
WriteX 13203 458738 65471 65471
WriteX 13203 524209 63 63
Close 13203
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13204
Close 13204
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 13205
Close 13205
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13208
Close 13208
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 13210
Close 13210
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 13211
Close 13211
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13214
Close 13214
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13216
Close 13216
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13217
Close 13217
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13220
Close 13220
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13224
Close 13224
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13228
Close 13228
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13232
Close 13232
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13236
Close 13236
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13240
Close 13240
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13244
Close 13244
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13248
Close 13248
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13250
Close 13250
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13252
Close 13252
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13254
WriteX 13254 4095 1 1
QUERY_FILE_INFORMATION 13254
QUERY_FS_INFORMATION 259
WriteX 13254 0 65471 65471
WriteX 13254 65471 65 65
WriteX 13254 65536 65471 65471
WriteX 13254 131007 65 65
WriteX 13254 131072 65471 65471
WriteX 13254 196543 65 65
WriteX 13254 196608 65471 65471
WriteX 13254 262079 65 65
WriteX 13254 262144 26634 26634
Close 13254
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13259
QUERY_FILE_INFORMATION 13259
QUERY_FILE_INFORMATION 13259
Close 13259
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13260
Close 13260
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13261
Close 13261
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13262
QUERY_FILE_INFORMATION 13262
ReadX 13262 0 512 512
ReadX 13262 288 512 512
ReadX 13262 800 512 512
Close 13262
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13263
ReadX 13263 0 24 24
Close 13263
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13264
ReadX 13264 0 24 24
Close 13264
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 13265
QUERY_FILE_INFORMATION 13265
ReadX 13265 0 512 512
ReadX 13265 288 512 512
ReadX 13265 800 512 512
ReadX 13265 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13265 1759 2849 2849
Close 13265
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13266
Close 13266
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13269
Close 13269
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13271
Close 13271
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13272
Close 13272
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13275
Close 13275
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13277
Close 13277
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13278
Close 13278
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13281
Close 13281
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13285
Close 13285
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13289
Close 13289
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13293
Close 13293
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13297
Close 13297
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13301
Close 13301
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13304
Close 13304
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13308
Close 13308
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13312
Close 13312
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 13314
Close 13314
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 13315
Close 13315
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13324
QUERY_FILE_INFORMATION 13324
QUERY_FILE_INFORMATION 13324
Close 13324
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13325
Close 13325
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13326
Close 13326
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13327
QUERY_FILE_INFORMATION 13327
ReadX 13327 0 512 512
ReadX 13327 288 512 512
ReadX 13327 800 512 512
Close 13327
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13328
ReadX 13328 0 24 24
Close 13328
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13329
QUERY_FILE_INFORMATION 13329
ReadX 13329 0 512 512
ReadX 13329 288 512 512
ReadX 13329 800 512 512
ReadX 13329 512 36 36
Close 13329
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 13330
QUERY_FILE_INFORMATION 13330
ReadX 13330 0 512 512
ReadX 13330 288 512 512
ReadX 13330 800 512 512
ReadX 13330 512 682 682
ReadX 13330 3584 106 106
ReadX 13330 3712 10 10
ReadX 13330 3722 10 10
ReadX 13330 512 2048 2048
ReadX 13330 3072 512 512
ReadX 13330 276 84 84
ReadX 13330 273 49 49
ReadX 13330 2560 512 512
Close 13330
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13340
QUERY_FILE_INFORMATION 13340
QUERY_FILE_INFORMATION 13340
Close 13340
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13341
Close 13341
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13342
Close 13342
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13343
QUERY_FILE_INFORMATION 13343
ReadX 13343 0 512 512
ReadX 13343 288 512 512
ReadX 13343 800 512 512
Close 13343
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13344
ReadX 13344 0 24 24
Close 13344
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13345
QUERY_FILE_INFORMATION 13345
ReadX 13345 0 512 512
ReadX 13345 288 512 512
ReadX 13345 800 512 512
ReadX 13345 512 36 36
Close 13345
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 13346
QUERY_FILE_INFORMATION 13346
ReadX 13346 0 512 512
ReadX 13346 288 512 512
ReadX 13346 800 512 512
ReadX 13346 512 682 682
ReadX 13346 3072 106 106
ReadX 13346 3200 10 10
ReadX 13346 3210 10 10
ReadX 13346 512 2048 2048
ReadX 13346 2560 512 512
ReadX 13346 3887 84 84
ReadX 13346 3838 49 49
ReadX 13346 2048 512 512
Close 13346
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13347
Close 13347
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13348
QUERY_FILE_INFORMATION 13348
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 13348
QUERY_FILE_INFORMATION 13348
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 13349
QUERY_FILE_INFORMATION 13349
QUERY_FILE_INFORMATION 13349
QUERY_FILE_INFORMATION 13349
ReadX 13349 2156 24 24
ReadX 13349 2139 276 276
ReadX 13349 2136 14 14
ReadX 13349 2136 7 7
ReadX 13349 2138 12 12
ReadX 13349 2137 8 8
ReadX 13349 2135 15 15
ReadX 13349 0 16 16
ReadX 13349 16 2048 2048
ReadX 13349 2064 2048 2048
ReadX 13349 257 2048 2048
ReadX 13349 385 2048 2048
ReadX 13349 513 2048 2048
ReadX 13349 641 2048 2048
ReadX 13349 769 2048 2048
ReadX 13349 897 2048 2048
ReadX 13349 1025 2048 2048
ReadX 13349 1153 2048 2048
ReadX 13349 1281 2048 2048
ReadX 13349 1409 2048 2048
ReadX 13349 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13351
Close 13351
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13353
WriteX 13353 15 1 1
QUERY_FILE_INFORMATION 13353
WriteX 13353 0 10575 10575
Flush 13353
Close 13353
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13354
Close 13354
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13355
QUERY_FILE_INFORMATION 13355
QUERY_FILE_INFORMATION 13355
QUERY_FILE_INFORMATION 13355
ReadX 13355 2157 24 24
ReadX 13355 2139 276 276
ReadX 13355 2137 14 14
ReadX 13355 2137 7 7
ReadX 13355 2139 12 12
ReadX 13355 2138 8 8
ReadX 13355 2136 15 15
Close 13349
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13356
Close 13356
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13357
QUERY_FILE_INFORMATION 13357
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13358
QUERY_FILE_INFORMATION 13358
ReadX 13358 0 512 512
ReadX 13358 512 512 512
ReadX 13358 1024 512 512
QUERY_FILE_INFORMATION 13358
QUERY_FILE_INFORMATION 13358
Close 13358
QUERY_FILE_INFORMATION 13357
ReadX 13357 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 13359
QUERY_FILE_INFORMATION 13359
ReadX 13359 0 512 512
ReadX 13359 512 512 512
ReadX 13359 1024 512 512
ReadX 13359 288 20 20
ReadX 13359 308 2084 2084
ReadX 13359 388 2084 2084
ReadX 13359 388 2084 2084
ReadX 13348 2157 1386 1386
ReadX 13359 2472 399 399
ReadX 13359 3072 1536 1536
ReadX 13359 544 149 149
ReadX 13359 693 485 485
Close 13359
ReadX 13348 2157 4096 4096
ReadX 13348 6253 4096 4096
ReadX 13348 10349 4096 4096
ReadX 13348 14445 4096 4096
ReadX 13348 18541 4096 4096
ReadX 13348 22637 256 256
ReadX 13348 22893 4096 4096
ReadX 13348 26989 4096 4096
ReadX 13348 31085 4096 4096
ReadX 13348 35181 4096 4096
ReadX 13348 39277 4096 4096
ReadX 13348 43373 4096 4096
ReadX 13348 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13348 2157 1024 1024
ReadX 13348 1667 4688 4688
ReadX 13348 6355 3516 3516
ReadX 13348 9871 16384 16384
ReadX 13348 26255 3771 3771
ReadX 13348 30026 2048 2048
ReadX 13348 32074 1024 1024
ReadX 13348 33098 6652 6652
ReadX 13348 39750 16384 16384
ReadX 13348 56134 10496 10496
ReadX 13348 66630 1784 1784
ReadX 13348 68414 90 90
ReadX 13348 68504 273 273
ReadX 13348 68777 1600 1600
ReadX 13348 70377 640 640
ReadX 13348 71017 1280 1280
ReadX 13348 72297 8464 8464
ReadX 13348 80761 158 158
ReadX 13348 80919 912 912
ReadX 13348 81831 1980 1980
ReadX 13348 83811 2256 2256
ReadX 13348 86067 400 400
ReadX 13348 86467 252 252
ReadX 13348 86719 42 42
ReadX 13348 86761 725 725
ReadX 13348 2009 512 512
ReadX 13348 3895 9 9
ReadX 13348 3781 46 46
ReadX 13348 4059 92 92
ReadX 13348 3781 92 92
ReadX 13348 3986 184 184
ReadX 13348 3987 16384 16384
ReadX 13348 3902 16384 16384
ReadX 13348 3781 10240 10240
ReadX 13348 3821 16384 16384
ReadX 13348 3891 935 935
ReadX 13348 4060 10240 10240
ReadX 13348 4059 184 184
ReadX 13348 256 184 184
ReadX 13348 256 1026 1026
ReadX 13348 3901 326 326
ReadX 13348 3899 652 652
ReadX 13348 256 2 2
ReadX 13348 258 4948 4948
Close 13348
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13361
Close 13361
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13363
WriteX 13363 4055 1 1
QUERY_FILE_INFORMATION 13363
WriteX 13363 0 65471 65471
WriteX 13363 65471 65 65
WriteX 13363 65536 65471 65471
WriteX 13363 131007 65 65
WriteX 13363 131072 65471 65471
WriteX 13363 196543 65 65
WriteX 13363 196608 65471 65471
WriteX 13363 262079 65 65
WriteX 13363 262144 65471 65471
WriteX 13363 327615 65 65
WriteX 13363 327680 65471 65471
WriteX 13363 393151 65 65
WriteX 13363 393216 65471 65471
WriteX 13363 458687 65 65
WriteX 13363 458752 65471 65471
WriteX 13363 524223 65 65
WriteX 13363 524288 65471 65471
WriteX 13363 589759 65 65
WriteX 13363 589824 35257 35257
Close 13363
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13365
Close 13365
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13367
WriteX 13367 4055 1 1
QUERY_FILE_INFORMATION 13367
WriteX 13367 0 65471 65471
WriteX 13367 65471 65 65
WriteX 13367 65536 65471 65471
WriteX 13367 131007 65 65
WriteX 13367 131072 65471 65471
WriteX 13367 196543 65 65
WriteX 13367 196608 65471 65471
WriteX 13367 262079 65 65
WriteX 13367 262144 65471 65471
WriteX 13367 327615 65 65
WriteX 13367 327680 65471 65471
WriteX 13367 393151 65 65
WriteX 13367 393216 65471 65471
WriteX 13367 458687 65 65
WriteX 13367 458752 65471 65471
WriteX 13367 524223 65 65
WriteX 13367 524288 65471 65471
WriteX 13367 589759 65 65
WriteX 13367 589824 57598 57598
Close 13367
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13369
WriteX 13369 15 1 1
QUERY_FILE_INFORMATION 13369
WriteX 13369 0 12543 12543
Flush 13369
Close 13369
Close 13355
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13370
Close 13370
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 13371
QUERY_FILE_INFORMATION 13371
QUERY_FILE_INFORMATION 13371
QUERY_FILE_INFORMATION 13371
ReadX 13371 288 24 24
ReadX 13371 287 276 276
ReadX 13371 286 14 14
ReadX 13371 286 7 7
ReadX 13371 287 12 12
ReadX 13371 287 8 8
ReadX 13371 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13372
Close 13372
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13373
QUERY_FILE_INFORMATION 13373
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 13373
QUERY_FILE_INFORMATION 13373
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 13374
QUERY_FILE_INFORMATION 13374
QUERY_FILE_INFORMATION 13374
QUERY_FILE_INFORMATION 13374
ReadX 13374 1938 24 24
ReadX 13374 1920 276 276
ReadX 13374 1918 14 14
ReadX 13374 1918 7 7
ReadX 13374 1919 12 12
ReadX 13374 1919 8 8
ReadX 13374 1917 15 15
ReadX 13374 0 16 16
ReadX 13374 16 2048 2048
ReadX 13374 2064 2048 2048
ReadX 13374 257 2048 2048
ReadX 13374 385 2048 2048
ReadX 13374 513 2048 2048
ReadX 13374 641 2048 2048
ReadX 13374 769 2048 2048
ReadX 13374 897 2048 2048
ReadX 13374 1025 2048 2048
ReadX 13374 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13376
Close 13376
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13378
WriteX 13378 15 1 1
QUERY_FILE_INFORMATION 13378
WriteX 13378 0 11588 11588
Flush 13378
Close 13378
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13379
Close 13379
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13380
QUERY_FILE_INFORMATION 13380
QUERY_FILE_INFORMATION 13380
QUERY_FILE_INFORMATION 13380
ReadX 13380 1909 24 24
ReadX 13380 1892 276 276
ReadX 13380 1889 14 14
ReadX 13380 1889 7 7
ReadX 13380 1891 12 12
ReadX 13380 1890 8 8
ReadX 13380 1888 15 15
Close 13374
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13382
WriteX 13382 15 1 1
QUERY_FILE_INFORMATION 13382
WriteX 13382 0 11615 11615
Flush 13382
Close 13382
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13380
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13383
Close 13383
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13384
QUERY_FILE_INFORMATION 13384
QUERY_FILE_INFORMATION 13384
QUERY_FILE_INFORMATION 13384
ReadX 13384 1947 24 24
ReadX 13384 1929 276 276
ReadX 13384 1927 14 14
ReadX 13384 1927 7 7
ReadX 13384 1929 12 12
ReadX 13384 1928 8 8
ReadX 13384 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13386
Close 13386
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13388
WriteX 13388 4088 1 1
QUERY_FILE_INFORMATION 13388
WriteX 13388 0 65471 65471
WriteX 13388 65471 65 65
WriteX 13388 65536 16050 16050
Close 13388
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13373 1939 64 64
ReadX 13373 128 248 248
ReadX 13373 128 568 568
ReadX 13373 3872 1536 1536
ReadX 13373 3456 2560 2560
ReadX 13373 3136 512 512
ReadX 13373 2880 4096 4096
ReadX 13373 3264 3072 3072
ReadX 13373 320 4096 4096
ReadX 13373 1024 4096 4096
ReadX 13373 3616 4096 4096
ReadX 13373 1939 64 64
ReadX 13373 128 248 248
ReadX 13373 128 608 608
ReadX 13373 2858 1024 1024
ReadX 13373 2810 4096 4096
ReadX 13373 2826 4096 4096
ReadX 13373 2580 2048 2048
ReadX 13373 2800 2560 2560
ReadX 13373 2100 4096 4096
ReadX 13373 2084 4096 4096
ReadX 13373 868 4096 4096
ReadX 13373 2324 4096 4096
ReadX 13373 884 4096 4096
ReadX 13373 2604 1024 1024
ReadX 13373 580 4096 4096
ReadX 13373 596 4096 4096
ReadX 13373 2752 4096 4096
ReadX 13373 2842 1024 1024
ReadX 13373 660 4096 4096
ReadX 13373 2720 4096 4096
ReadX 13373 2736 4096 4096
ReadX 13373 628 4096 4096
ReadX 13373 2704 4096 4096
ReadX 13373 1556 4096 4096
ReadX 13373 576 4096 4096
ReadX 13373 3168 1536 1536
ReadX 13373 832 4096 4096
ReadX 13373 1088 4096 4096
ReadX 13373 1344 4096 4096
ReadX 13373 1600 4096 4096
ReadX 13373 1856 4096 4096
ReadX 13373 2112 4096 4096
ReadX 13373 1892 4096 4096
ReadX 13373 820 4096 4096
ReadX 13373 788 4096 4096
ReadX 13373 1604 4096 4096
ReadX 13373 3648 4096 4096
ReadX 13373 2608 4096 4096
ReadX 13373 548 4096 4096
ReadX 13373 740 4096 4096
ReadX 13373 1344 4096 4096
ReadX 13373 3392 4096 4096
ReadX 13373 3904 4096 4096
ReadX 13373 644 4096 4096
ReadX 13373 676 4096 4096
ReadX 13373 2688 4096 4096
ReadX 13373 320 4096 4096
ReadX 13373 900 4096 4096
ReadX 13373 1908 4096 4096
ReadX 13373 852 4096 4096
ReadX 13373 724 4096 4096
ReadX 13373 2292 4096 4096
ReadX 13373 612 4096 4096
ReadX 13373 388 4096 4096
ReadX 13373 2368 4096 4096
ReadX 13373 2624 4096 4096
ReadX 13373 500 4096 4096
ReadX 13373 356 4096 4096
ReadX 13373 1024 4096 4096
ReadX 13373 576 4096 4096
ReadX 13373 340 4096 4096
ReadX 13373 420 4096 4096
ReadX 13373 1600 4096 4096
ReadX 13373 404 4096 4096
ReadX 13373 1428 4096 4096
ReadX 13373 2656 4096 4096
ReadX 13373 2624 4096 4096
ReadX 13373 452 4096 4096
ReadX 13373 692 4096 4096
ReadX 13373 564 4096 4096
ReadX 13373 372 4096 4096
ReadX 13373 468 4096 4096
ReadX 13373 484 4096 4096
ReadX 13373 1088 4096 4096
ReadX 13373 1924 4096 4096
ReadX 13373 2768 4096 4096
ReadX 13373 832 4096 4096
ReadX 13373 836 4096 4096
ReadX 13373 1856 4096 4096
ReadX 13373 2640 4096 4096
ReadX 13373 436 4096 4096
ReadX 13373 1828 4096 4096
ReadX 13373 804 4096 4096
ReadX 13373 1860 4096 4096
ReadX 13373 1812 4096 4096
ReadX 13373 756 4096 4096
ReadX 13373 1636 4096 4096
ReadX 13373 772 4096 4096
ReadX 13373 2036 4096 4096
ReadX 13373 1220 4096 4096
ReadX 13373 1652 4096 4096
ReadX 13373 2588 4096 4096
ReadX 13373 916 4096 4096
ReadX 13373 260 4096 4096
ReadX 13373 932 4096 4096
ReadX 13373 2624 4096 4096
ReadX 13373 308 4096 4096
ReadX 13373 292 4096 4096
ReadX 13373 1140 4096 4096
ReadX 13373 276 4096 4096
ReadX 13373 2020 4096 4096
ReadX 13373 2880 4096 4096
ReadX 13373 516 4096 4096
ReadX 13373 1844 4096 4096
ReadX 13373 1124 4096 4096
ReadX 13373 3136 4096 4096
ReadX 13373 324 4096 4096
ReadX 13373 1156 4096 4096
ReadX 13373 1172 4096 4096
ReadX 13373 2112 4096 4096
ReadX 13373 2368 4096 4096
ReadX 13373 964 4096 4096
ReadX 13373 980 4096 4096
ReadX 13373 1012 4096 4096
ReadX 13373 532 4096 4096
ReadX 13373 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 13373 1620 4096 4096
ReadX 13373 1604 4096 4096
ReadX 13373 2116 4096 4096
ReadX 13373 2132 4096 4096
ReadX 13373 2148 4096 4096
ReadX 13373 2276 4096 4096
ReadX 13373 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13390
Close 13390
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13392
QUERY_FILE_INFORMATION 13357
WriteX 13392 4088 1 1
QUERY_FILE_INFORMATION 13392
QUERY_FILE_INFORMATION 13357
Close 13357
WriteX 13392 0 65471 65471
WriteX 13392 65471 65 65
WriteX 13392 65536 64850 64850
Close 13392
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13394
WriteX 13394 15 1 1
QUERY_FILE_INFORMATION 13394
ReadX 13373 2068 4096 4096
ReadX 13373 1588 4096 4096
ReadX 13373 1572 4096 4096
WriteX 13394 0 18630 18630
Flush 13394
Close 13394
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 13384
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13395
Close 13395
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 13396
QUERY_FILE_INFORMATION 13396
QUERY_FILE_INFORMATION 13396
QUERY_FILE_INFORMATION 13396
ReadX 13396 661 24 24
ReadX 13396 659 356 356
ReadX 13396 659 14 14
ReadX 13396 659 7 7
ReadX 13396 659 12 12
ReadX 13396 659 8 8
ReadX 13396 659 15 15
ReadX 13396 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 13373 612 4096 4096
ReadX 13373 564 4096 4096
ReadX 13373 1876 4096 4096
ReadX 13373 628 4096 4096
ReadX 13373 740 4096 4096
ReadX 13373 724 4096 4096
ReadX 13373 644 4096 4096
ReadX 13373 2324 4096 4096
ReadX 13373 660 4096 4096
ReadX 13373 852 4096 4096
ReadX 13373 868 4096 4096
Close 13396
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 13371
ReadX 13373 2368 4096 4096
ReadX 13373 1024 4096 4096
ReadX 13373 320 4096 4096
ReadX 13373 580 4096 4096
ReadX 13373 3136 512 512
ReadX 13373 2880 4096 4096
Close 13373
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13397
WriteX 13397 0 65471 65471
WriteX 13397 65471 63 63
WriteX 13397 65534 65471 65471
WriteX 13397 131005 63 63
Close 13397
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13398
WriteX 13398 0 65471 65471
WriteX 13398 65471 63 63
WriteX 13398 65534 65471 65471
WriteX 13398 131005 63 63
WriteX 13398 131068 65471 65471
WriteX 13398 196539 63 63
WriteX 13398 196602 65471 65471
WriteX 13398 262073 63 63
Close 13398
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13399
WriteX 13399 0 65471 65471
WriteX 13399 65471 63 63
WriteX 13399 65534 65471 65471
WriteX 13399 131005 63 63
WriteX 13399 131068 65471 65471
WriteX 13399 196539 63 63
WriteX 13399 196602 65471 65471
WriteX 13399 262073 63 63
WriteX 13399 262136 65471 65471
WriteX 13399 327607 63 63
WriteX 13399 327670 65471 65471
WriteX 13399 393141 63 63
WriteX 13399 393204 65471 65471
WriteX 13399 458675 63 63
WriteX 13399 458738 65471 65471
WriteX 13399 524209 63 63
Close 13399
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13400
Close 13400
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13401
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13401 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13402
ReadX 13402 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13403
ReadX 13403 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13404
ReadX 13404 0 511 511
ReadX 13401 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13401
Close 13402
Close 13403
Close 13404
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13405
ReadX 13405 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13406
ReadX 13406 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13407
ReadX 13407 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13408
ReadX 13408 0 511 511
ReadX 13405 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13409
FIND_FIRST \clients\client1\~dmtmp\*
Close 13409
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 13410
QUERY_FILE_INFORMATION 13410
WriteX 13410 2047 1 1
QUERY_FILE_INFORMATION 13410
WriteX 13410 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 13411
Close 13411
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13412
WriteX 13412 52 1 1
QUERY_FILE_INFORMATION 13412
WriteX 13412 0 53 53
WriteX 13412 53 28 28
WriteX 13412 81 4 4
WriteX 13412 85 28 28
WriteX 13412 113 38 38
WriteX 13412 151 28 28
WriteX 13412 179 2 2
WriteX 13412 181 28 28
WriteX 13412 209 3 3
WriteX 13412 212 279 279
WriteX 13412 9 4 4
Close 13412
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 13413
ReadX 13413 0 53 53
ReadX 13413 53 28 28
ReadX 13413 81 4 4
ReadX 13413 85 28 28
ReadX 13413 113 38 38
ReadX 13413 151 28 28
ReadX 13413 179 2 2
ReadX 13413 181 28 28
ReadX 13413 209 3 3
Close 13413
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 13405
Close 13406
Close 13407
Close 13408
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13414
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13414 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13415
ReadX 13415 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13416
ReadX 13416 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13417
ReadX 13417 0 511 511
ReadX 13414 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 13419
Close 13419
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13420
WriteX 13420 52 1 1
QUERY_FILE_INFORMATION 13420
WriteX 13420 0 53 53
WriteX 13420 53 28 28
WriteX 13420 81 28 28
WriteX 13420 109 28 28
WriteX 13420 137 28 28
WriteX 13420 165 28 28
WriteX 13420 193 28 28
WriteX 13420 221 28 28
WriteX 13420 249 4 4
WriteX 13420 253 4 4
WriteX 13420 257 4 4
WriteX 13420 261 28 28
WriteX 13420 289 2 2
WriteX 13420 291 2 2
WriteX 13420 293 2 2
WriteX 13420 295 248 248
WriteX 13420 9 4 4
Close 13420
Close 13414
Close 13415
Close 13416
Close 13417
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13421
ReadX 13421 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13422
ReadX 13422 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13423
ReadX 13423 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13424
ReadX 13424 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13425
ReadX 13425 0 53 53
ReadX 13425 53 28 28
ReadX 13425 81 28 28
ReadX 13425 109 28 28
ReadX 13425 137 28 28
ReadX 13425 165 28 28
ReadX 13425 193 28 28
ReadX 13425 221 28 28
ReadX 13425 249 4 4
ReadX 13425 253 4 4
ReadX 13425 257 4 4
ReadX 13425 261 28 28
ReadX 13425 289 2 2
ReadX 13425 291 2 2
ReadX 13425 293 2 2
Close 13425
ReadX 13421 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13421
Close 13422
Close 13423
Close 13424
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 13410
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13426
Close 13426
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13427
ReadX 13427 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13428
ReadX 13428 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13429
ReadX 13429 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13430
ReadX 13430 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13431
ReadX 13431 0 53 53
ReadX 13431 53 28 28
ReadX 13431 81 28 28
ReadX 13431 109 28 28
ReadX 13431 137 28 28
ReadX 13431 165 28 28
ReadX 13431 193 28 28
ReadX 13431 221 28 28
ReadX 13431 249 4 4
ReadX 13431 253 4 4
ReadX 13431 257 4 4
ReadX 13431 261 28 28
ReadX 13431 289 2 2
ReadX 13431 291 2 2
ReadX 13431 293 2 2
Close 13431
ReadX 13427 2048 2048 2048
Close 13427
Close 13428
Close 13429
Close 13430
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13432
ReadX 13432 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13433
ReadX 13433 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13434
ReadX 13434 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13435
ReadX 13435 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13436
ReadX 13436 0 53 53
ReadX 13436 53 28 28
ReadX 13436 81 28 28
ReadX 13436 109 28 28
ReadX 13436 137 28 28
ReadX 13436 165 28 28
ReadX 13436 193 28 28
ReadX 13436 221 28 28
ReadX 13436 249 4 4
ReadX 13436 253 4 4
ReadX 13436 257 4 4
ReadX 13436 261 28 28
ReadX 13436 289 2 2
ReadX 13436 291 2 2
ReadX 13436 293 2 2
Close 13436
ReadX 13432 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 13440
FIND_FIRST \clients\client1\~dmtmp\*
Close 13440
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13441
QUERY_FILE_INFORMATION 13441
WriteX 13441 2047 1 1
QUERY_FILE_INFORMATION 13441
WriteX 13441 0 2048 2048
Close 13441
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13442
ReadX 13442 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 13442
Close 13432
Close 13433
Close 13434
Close 13435
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13443
ReadX 13443 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 13443 4095 1 1
QUERY_FILE_INFORMATION 13443
WriteX 13443 2048 2048 2048
QUERY_FILE_INFORMATION 13443
Flush 13443
WriteX 13443 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13444
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13444 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13445
ReadX 13445 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13446
ReadX 13446 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13447
ReadX 13447 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13448
ReadX 13448 0 53 53
ReadX 13448 53 28 28
ReadX 13448 81 28 28
ReadX 13448 109 28 28
ReadX 13448 137 28 28
ReadX 13448 165 28 28
ReadX 13448 193 28 28
ReadX 13448 221 28 28
ReadX 13448 249 4 4
ReadX 13448 253 4 4
ReadX 13448 257 4 4
ReadX 13448 261 28 28
ReadX 13448 289 2 2
ReadX 13448 291 2 2
ReadX 13448 293 2 2
Close 13448
ReadX 13444 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 13452
FIND_FIRST \clients\client1\~dmtmp\*
Close 13452
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13453
QUERY_FILE_INFORMATION 13453
WriteX 13453 2047 1 1
QUERY_FILE_INFORMATION 13453
WriteX 13453 0 2048 2048
Close 13453
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13454
ReadX 13454 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 13458
Close 13458
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13459
QUERY_FILE_INFORMATION 13459
WriteX 13459 2047 1 1
QUERY_FILE_INFORMATION 13459
WriteX 13459 0 2048 2048
Close 13459
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13460
ReadX 13460 0 511 511
ReadX 13444 384 2048 2048
ReadX 13444 768 16384 16384
ReadX 13444 1792 14336 14336
Close 13460
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13461
ReadX 13461 0 511 511
Close 13461
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 13463
Close 13463
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 13454 4095 1 1
QUERY_FILE_INFORMATION 13454
WriteX 13454 2048 2048 2048
WriteX 13454 0 88 88
Close 13454
WriteX 13444 1152 2048 2048
WriteX 13444 1408 6144 6144
WriteX 13444 1920 2048 2048
WriteX 13444 0 88 88
Close 13444
WriteX 13445 0 88 88
Close 13445
WriteX 13446 0 88 88
Close 13446
Close 13447
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13464
ReadX 13464 0 511 511
ReadX 13464 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13465
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13465 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13466
ReadX 13466 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13467
ReadX 13467 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13468
ReadX 13468 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13469
ReadX 13469 0 53 53
ReadX 13469 53 28 28
ReadX 13469 81 28 28
ReadX 13469 109 28 28
ReadX 13469 137 28 28
ReadX 13469 165 28 28
ReadX 13469 193 28 28
ReadX 13469 221 28 28
ReadX 13469 249 4 4
ReadX 13469 253 4 4
ReadX 13469 257 4 4
ReadX 13469 261 28 28
ReadX 13469 289 2 2
ReadX 13469 291 2 2
ReadX 13469 293 2 2
Close 13469
ReadX 13465 2048 2048 2048
Close 13465
Close 13466
Close 13467
Close 13468
Close 13443
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 13470
QUERY_FILE_INFORMATION 13470
Close 13470
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13471
Close 13471
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13472
ReadX 13472 0 511 511
ReadX 13472 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13473
ReadX 13473 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13474
ReadX 13474 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13475
ReadX 13475 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13476
ReadX 13476 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13477
ReadX 13477 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13478
ReadX 13478 0 53 53
ReadX 13478 53 2 2
ReadX 13478 55 2 2
ReadX 13478 57 184 184
ReadX 13478 241 298 298
Close 13478
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13479
ReadX 13479 0 41 41
ReadX 13472 2048 2048 2048
Close 13479
Close 13472
Close 13473
Close 13476
Close 13477
Close 13474
Close 13475
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13480
ReadX 13480 0 511 511
ReadX 13480 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13481
ReadX 13481 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13482
ReadX 13482 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13483
ReadX 13483 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13484
ReadX 13484 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13485
ReadX 13485 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13486
ReadX 13486 0 53 53
ReadX 13486 53 2 2
ReadX 13486 55 2 2
ReadX 13486 57 184 184
ReadX 13486 241 298 298
Close 13486
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13487
ReadX 13487 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13488
ReadX 13488 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13489
ReadX 13489 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13490
ReadX 13490 0 511 511
ReadX 13489 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13491
ReadX 13491 0 53 53
ReadX 13491 53 2 2
ReadX 13491 55 480 480
ReadX 13491 535 2 2
Close 13491
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13492
ReadX 13492 0 41 41
ReadX 13480 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 13496
FIND_FIRST \clients\client1\~dmtmp\*
Close 13496
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13497
QUERY_FILE_INFORMATION 13497
WriteX 13497 2047 1 1
QUERY_FILE_INFORMATION 13497
WriteX 13497 0 2048 2048
Close 13497
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13498
ReadX 13498 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13498
Close 13487
Close 13488
Close 13489
Close 13490
Close 13492
Close 13480
Close 13481
Close 13484
Close 13485
Close 13482
Close 13483
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13499
ReadX 13499 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13500
Close 13500
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13501
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13501 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13502
ReadX 13502 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13503
ReadX 13503 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13504
ReadX 13504 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13505
ReadX 13505 0 53 53
ReadX 13505 53 2 2
ReadX 13505 55 480 480
ReadX 13505 535 2 2
Close 13505
ReadX 13501 2048 2048 2048
Close 13501
Close 13502
Close 13503
Close 13504
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13506
ReadX 13506 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13507
ReadX 13507 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13508
ReadX 13508 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13509
ReadX 13509 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13510
ReadX 13510 0 53 53
ReadX 13510 53 2 2
ReadX 13510 55 480 480
ReadX 13510 535 2 2
Close 13510
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13511
ReadX 13511 0 511 511
ReadX 13511 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13512
ReadX 13512 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13513
ReadX 13513 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13514
ReadX 13514 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13515
ReadX 13515 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13516
ReadX 13516 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13517
ReadX 13517 0 41 41
ReadX 13511 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13518
ReadX 13518 0 53 53
ReadX 13518 53 2 2
ReadX 13518 55 2 2
ReadX 13518 57 184 184
ReadX 13518 241 298 298
Close 13518
ReadX 13506 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 13522
FIND_FIRST \clients\client1\~dmtmp\*
Close 13522
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13523
QUERY_FILE_INFORMATION 13523
WriteX 13523 2047 1 1
QUERY_FILE_INFORMATION 13523
WriteX 13523 0 2048 2048
Close 13523
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13524
ReadX 13524 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 13524
Close 13517
Close 13511
Close 13512
Close 13515
Close 13516
Close 13513
Close 13514
Close 13506
Close 13507
Close 13508
Close 13509
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13525
ReadX 13525 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 13499 4095 1 1
QUERY_FILE_INFORMATION 13499
WriteX 13499 2048 2048 2048
QUERY_FILE_INFORMATION 13499
Flush 13499
WriteX 13499 0 88 88
WriteX 13525 4095 1 1
QUERY_FILE_INFORMATION 13525
WriteX 13525 2048 2048 2048
QUERY_FILE_INFORMATION 13525
Flush 13525
WriteX 13525 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13526
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13526 0 511 511
ReadX 13526 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13527
ReadX 13527 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13528
ReadX 13528 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13529
ReadX 13529 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13530
ReadX 13530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13531
ReadX 13531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13532
ReadX 13532 0 53 53
ReadX 13532 53 2 2
ReadX 13532 55 2 2
ReadX 13532 57 184 184
ReadX 13532 241 298 298
Close 13532
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13533
ReadX 13533 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13534
ReadX 13534 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13535
ReadX 13535 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13536
ReadX 13536 0 511 511
ReadX 13535 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13537
ReadX 13537 0 53 53
ReadX 13537 53 2 2
ReadX 13537 55 480 480
ReadX 13537 535 2 2
Close 13537
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13538
ReadX 13538 0 41 41
ReadX 13526 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13539
ReadX 13539 0 53 53
ReadX 13539 53 2 2
ReadX 13539 55 480 480
ReadX 13539 535 2 2
Close 13539
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13540
ReadX 13540 0 53 53
ReadX 13540 53 2 2
ReadX 13540 55 2 2
ReadX 13540 57 184 184
ReadX 13540 241 298 298
Close 13540
ReadX 13533 2048 2048 2048
ReadX 13534 2048 2048 2048
ReadX 13533 320 16384 16384
ReadX 13533 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 13541
FIND_FIRST \clients\client1\~dmtmp\*
Close 13541
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13542
QUERY_FILE_INFORMATION 13542
WriteX 13542 4095 1 1
QUERY_FILE_INFORMATION 13542
WriteX 13542 0 4096 4096
Close 13542
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 13543
ReadX 13543 0 41 41
Close 13533
Close 13534
Close 13535
Close 13536
Close 13538
Close 13526
Close 13527
Close 13530
Close 13531
Close 13528
Close 13529
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 13544
Close 13544
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13545
QUERY_FILE_INFORMATION 13545
WriteX 13545 4095 1 1
QUERY_FILE_INFORMATION 13545
WriteX 13545 0 4096 4096
Close 13545
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13546
ReadX 13546 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 13543
ReadX 13543 0 4096 4096
WriteX 13546 0 4096 4096
Close 13546
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 13548
ReadX 13548 0 41 41
Close 13543
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 13548
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 13549
Close 13549
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13550
ReadX 13550 0 41 41
Close 13550
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 13551
Close 13551
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13552
QUERY_FILE_INFORMATION 13552
WriteX 13552 2047 1 1
QUERY_FILE_INFORMATION 13552
WriteX 13552 0 2048 2048
Close 13552
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13553
ReadX 13553 0 511 511
ReadX 13553 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13554
ReadX 13554 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13554
Close 13553
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13555
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13555 0 511 511
ReadX 13555 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13556
ReadX 13556 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13557
ReadX 13557 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13558
ReadX 13558 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13559
ReadX 13559 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13560
ReadX 13560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13561
ReadX 13561 0 53 53
ReadX 13561 53 2 2
ReadX 13561 55 2 2
ReadX 13561 57 184 184
ReadX 13561 241 298 298
Close 13561
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13562
ReadX 13562 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13563
ReadX 13563 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13564
ReadX 13564 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13565
ReadX 13565 0 511 511
ReadX 13564 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13566
ReadX 13566 0 53 53
ReadX 13566 53 2 2
ReadX 13566 55 480 480
ReadX 13566 535 2 2
Close 13566
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13567
ReadX 13567 0 41 41
ReadX 13555 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13568
ReadX 13568 0 53 53
ReadX 13568 53 2 2
ReadX 13568 55 480 480
ReadX 13568 535 2 2
Close 13568
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13569
ReadX 13569 0 53 53
ReadX 13569 53 2 2
ReadX 13569 55 2 2
ReadX 13569 57 184 184
ReadX 13569 241 298 298
Close 13569
ReadX 13562 2048 2048 2048
Close 13562
Close 13563
Close 13564
Close 13565
Close 13567
Close 13555
Close 13556
Close 13559
Close 13560
Close 13557
Close 13558
Close 13499
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 13570
QUERY_FILE_INFORMATION 13570
Close 13570
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 13525
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 13571
QUERY_FILE_INFORMATION 13571
Close 13571
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13572
Close 13572
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13573
ReadX 13573 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13574
ReadX 13574 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13575
ReadX 13575 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13576
ReadX 13576 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13577
ReadX 13577 0 53 53
ReadX 13577 53 2 2
ReadX 13577 55 480 480
ReadX 13577 535 2 2
Close 13577
ReadX 13573 2048 2048 2048
Close 13573
Close 13574
Close 13575
Close 13576
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13578
ReadX 13578 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13579
ReadX 13579 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13580
ReadX 13580 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13581
ReadX 13581 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13582
ReadX 13582 0 53 53
ReadX 13582 53 2 2
ReadX 13582 55 480 480
ReadX 13582 535 2 2
Close 13582
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13583
ReadX 13583 0 511 511
ReadX 13583 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13584
ReadX 13584 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13585
ReadX 13585 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13586
ReadX 13586 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13587
ReadX 13587 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13588
ReadX 13588 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13589
ReadX 13589 0 41 41
ReadX 13583 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13590
ReadX 13590 0 53 53
ReadX 13590 53 2 2
ReadX 13590 55 2 2
ReadX 13590 57 184 184
ReadX 13590 241 298 298
Close 13590
ReadX 13578 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 13594
FIND_FIRST \clients\client1\~dmtmp\*
Close 13594
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13595
QUERY_FILE_INFORMATION 13595
WriteX 13595 2047 1 1
QUERY_FILE_INFORMATION 13595
WriteX 13595 0 2048 2048
Close 13595
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13596
ReadX 13596 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13596
Close 13589
Close 13583
Close 13584
Close 13587
Close 13588
Close 13585
Close 13586
Close 13578
Close 13579
Close 13580
Close 13581
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13597
ReadX 13597 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13598
Close 13598
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13599 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13600
ReadX 13600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13601
ReadX 13601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13602
ReadX 13602 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13603
ReadX 13603 0 53 53
ReadX 13603 53 28 28
ReadX 13603 81 28 28
ReadX 13603 109 28 28
ReadX 13603 137 28 28
ReadX 13603 165 28 28
ReadX 13603 193 28 28
ReadX 13603 221 28 28
ReadX 13603 249 4 4
ReadX 13603 253 4 4
ReadX 13603 257 4 4
ReadX 13603 261 28 28
ReadX 13603 289 2 2
ReadX 13603 291 2 2
ReadX 13603 293 2 2
Close 13603
ReadX 13599 2048 2048 2048
Close 13599
Close 13600
Close 13601
Close 13602
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13604
ReadX 13604 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13605
ReadX 13605 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13606
ReadX 13606 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13607
ReadX 13607 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13608
ReadX 13608 0 53 53
ReadX 13608 53 28 28
ReadX 13608 81 28 28
ReadX 13608 109 28 28
ReadX 13608 137 28 28
ReadX 13608 165 28 28
ReadX 13608 193 28 28
ReadX 13608 221 28 28
ReadX 13608 249 4 4
ReadX 13608 253 4 4
ReadX 13608 257 4 4
ReadX 13608 261 28 28
ReadX 13608 289 2 2
ReadX 13608 291 2 2
ReadX 13608 293 2 2
Close 13608
ReadX 13604 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 13612
FIND_FIRST \clients\client1\~dmtmp\*
Close 13612
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13613
QUERY_FILE_INFORMATION 13613
WriteX 13613 2047 1 1
QUERY_FILE_INFORMATION 13613
WriteX 13613 0 2048 2048
Close 13613
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13614
ReadX 13614 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13614
Close 13604
Close 13605
Close 13606
Close 13607
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13615
ReadX 13615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13616
Close 13616
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13617
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13617 0 511 511
ReadX 13617 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13618
ReadX 13618 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13619
ReadX 13619 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13620
ReadX 13620 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13621
ReadX 13621 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13622
ReadX 13622 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13623
ReadX 13623 0 53 53
ReadX 13623 53 2 2
ReadX 13623 55 2 2
ReadX 13623 57 184 184
ReadX 13623 241 298 298
Close 13623
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13624
ReadX 13624 0 41 41
ReadX 13617 2048 2048 2048
Close 13624
Close 13617
Close 13618
Close 13621
Close 13622
Close 13619
Close 13620
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13625
ReadX 13625 0 511 511
ReadX 13625 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13626
ReadX 13626 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13627
ReadX 13627 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13628
ReadX 13628 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13629
ReadX 13629 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13630
ReadX 13630 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13631
ReadX 13631 0 53 53
ReadX 13631 53 2 2
ReadX 13631 55 2 2
ReadX 13631 57 184 184
ReadX 13631 241 298 298
Close 13631
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13632
ReadX 13632 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13633
ReadX 13633 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13634
ReadX 13634 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13635
ReadX 13635 0 511 511
ReadX 13634 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13636
ReadX 13636 0 53 53
ReadX 13636 53 2 2
ReadX 13636 55 480 480
ReadX 13636 535 2 2
Close 13636
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13637
ReadX 13637 0 41 41
ReadX 13625 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 13641
FIND_FIRST \clients\client1\~dmtmp\*
Close 13641
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13642
QUERY_FILE_INFORMATION 13642
WriteX 13642 2047 1 1
QUERY_FILE_INFORMATION 13642
WriteX 13642 0 2048 2048
Close 13642
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13643
ReadX 13643 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 13643
Close 13632
Close 13633
Close 13634
Close 13635
Close 13637
Close 13625
Close 13626
Close 13629
Close 13630
Close 13627
Close 13628
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13644
ReadX 13644 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 13597 4095 1 1
QUERY_FILE_INFORMATION 13597
WriteX 13597 2048 2048 2048
QUERY_FILE_INFORMATION 13597
Flush 13597
WriteX 13597 0 88 88
WriteX 13615 4095 1 1
QUERY_FILE_INFORMATION 13615
WriteX 13615 2048 2048 2048
QUERY_FILE_INFORMATION 13615
Flush 13615
WriteX 13615 0 88 88
WriteX 13644 4095 1 1
QUERY_FILE_INFORMATION 13644
WriteX 13644 2048 2048 2048
QUERY_FILE_INFORMATION 13644
Flush 13644
WriteX 13644 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13645
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13645 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13646
ReadX 13646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13647
ReadX 13647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13648
ReadX 13648 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13649
ReadX 13649 0 53 53
ReadX 13649 53 2 2
ReadX 13649 55 480 480
ReadX 13649 535 2 2
Close 13649
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13650
ReadX 13650 0 511 511
ReadX 13650 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13651
ReadX 13651 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13652
ReadX 13652 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13653
ReadX 13653 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13654
ReadX 13654 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13655
ReadX 13655 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13656
ReadX 13656 0 41 41
ReadX 13650 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13657
ReadX 13657 0 53 53
ReadX 13657 53 2 2
ReadX 13657 55 2 2
ReadX 13657 57 184 184
ReadX 13657 241 298 298
Close 13657
ReadX 13645 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13658
ReadX 13658 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13659
ReadX 13659 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13660
ReadX 13660 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13661
ReadX 13661 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13662
ReadX 13662 0 53 53
ReadX 13662 53 28 28
ReadX 13662 81 28 28
ReadX 13662 109 28 28
ReadX 13662 137 28 28
ReadX 13662 165 28 28
ReadX 13662 193 28 28
ReadX 13662 221 28 28
ReadX 13662 249 4 4
ReadX 13662 253 4 4
ReadX 13662 257 4 4
ReadX 13662 261 28 28
ReadX 13662 289 2 2
ReadX 13662 291 2 2
ReadX 13662 293 2 2
Close 13662
ReadX 13658 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13663
ReadX 13663 0 53 53
ReadX 13663 53 2 2
ReadX 13663 55 2 2
ReadX 13663 57 184 184
ReadX 13663 241 298 298
Close 13663
ReadX 13647 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13664
ReadX 13664 0 53 53
ReadX 13664 53 2 2
ReadX 13664 55 480 480
ReadX 13664 535 2 2
Close 13664
ReadX 13658 4096 16384 16384
ReadX 13658 1280 16384 16384
ReadX 13658 2304 6144 6144
ReadX 13658 2688 2048 2048
ReadX 13645 4096 16384 16384
ReadX 13645 1280 16384 16384
ReadX 13645 2304 16384 16384
ReadX 13645 3328 16384 16384
ReadX 13645 272 16384 16384
ReadX 13645 336 16384 16384
ReadX 13645 400 16384 16384
ReadX 13645 464 16384 16384
ReadX 13645 528 16384 16384
ReadX 13645 592 16384 16384
ReadX 13645 656 16384 16384
ReadX 13645 720 16384 16384
ReadX 13645 784 16384 16384
ReadX 13645 848 16384 16384
ReadX 13645 912 16384 16384
ReadX 13651 2048 2048 2048
ReadX 13650 760 2048 2048
ReadX 13650 1144 2048 2048
ReadX 13650 408 2048 2048
ReadX 13650 912 2048 2048
ReadX 13650 1096 2048 2048
ReadX 13650 776 2048 2048
ReadX 13650 560 2048 2048
ReadX 13650 376 2048 2048
ReadX 13650 320 2048 2048
ReadX 13650 3072 2048 2048
ReadX 13650 784 2048 2048
ReadX 13650 2176 2048 2048
ReadX 13650 792 2048 2048
ReadX 13650 576 2048 2048
ReadX 13650 600 2048 2048
ReadX 13650 728 2048 2048
ReadX 13650 1112 2048 2048
ReadX 13650 664 2048 2048
ReadX 13650 976 2048 2048
ReadX 13650 3840 2048 2048
ReadX 13650 296 2048 2048
ReadX 13650 480 2048 2048
ReadX 13650 680 2048 2048
ReadX 13650 696 2048 2048
ReadX 13650 832 2048 2048
ReadX 13650 1016 2048 2048
ReadX 13650 1104 2048 2048
ReadX 13650 3200 2048 2048
ReadX 13650 264 2048 2048
ReadX 13650 448 2048 2048
ReadX 13650 648 2048 2048
ReadX 13650 1136 2048 2048
ReadX 13650 288 2048 2048
ReadX 13650 352 2048 2048
ReadX 13650 536 2048 2048
ReadX 13650 800 2048 2048
ReadX 13650 736 2048 2048
ReadX 13650 392 2048 2048
ReadX 13650 752 2048 2048
ReadX 13650 880 2048 2048
ReadX 13650 1064 2048 2048
ReadX 13650 1128 2048 2048
ReadX 13650 1536 2048 2048
ReadX 13650 2432 2048 2048
ReadX 13650 688 2048 2048
ReadX 13650 872 2048 2048
ReadX 13650 1072 2048 2048
ReadX 13650 984 2048 2048
ReadX 13650 704 2048 2048
ReadX 13650 3328 2048 2048
ReadX 13650 888 2048 2048
ReadX 13650 496 2048 2048
ReadX 13650 624 2048 2048
ReadX 13650 808 2048 2048
ReadX 13650 1008 2048 2048
ReadX 13650 1152 2048 2048
ReadX 13650 416 2048 2048
ReadX 13650 584 2048 2048
ReadX 13650 384 2048 2048
ReadX 13650 568 2048 2048
ReadX 13650 512 2048 2048
ReadX 13650 1408 2048 2048
ReadX 13650 472 2048 2048
ReadX 13650 672 2048 2048
ReadX 13650 2560 2048 2048
ReadX 13650 544 2048 2048
ReadX 13650 920 2048 2048
ReadX 13650 1120 2048 2048
ReadX 13650 2304 2048 2048
ReadX 13650 1080 2048 2048
ReadX 13650 1664 2048 2048
ReadX 13650 608 2048 2048
ReadX 13650 2688 2048 2048
ReadX 13650 3712 2048 2048
ReadX 13650 616 2048 2048
ReadX 13650 632 2048 2048
ReadX 13650 944 2048 2048
ReadX 13650 856 2048 2048
ReadX 13650 768 2048 2048
ReadX 13650 720 2048 2048
ReadX 13650 640 2048 2048
ReadX 13650 1048 2048 2048
ReadX 13650 1040 2048 2048
ReadX 13650 1032 2048 2048
ReadX 13650 1000 2048 2048
ReadX 13650 992 2048 2048
ReadX 13650 968 2048 2048
ReadX 13650 952 2048 2048
ReadX 13650 1056 2048 2048
ReadX 13650 816 2048 2048
ReadX 13650 864 2048 2048
ReadX 13650 2816 2048 2048
ReadX 13650 640 2048 2048
ReadX 13650 1024 2048 2048
ReadX 13650 504 2048 2048
ReadX 13650 424 2048 2048
ReadX 13650 840 2048 2048
ReadX 13650 896 2048 2048
ReadX 13650 520 2048 2048
ReadX 13650 960 2048 2048
ReadX 13650 552 2048 2048
ReadX 13650 488 2048 2048
ReadX 13650 824 2048 2048
ReadX 13650 304 2048 2048
ReadX 13650 768 2048 2048
ReadX 13650 712 2048 2048
ReadX 13650 512 2048 2048
ReadX 13650 432 2048 2048
ReadX 13650 384 2048 2048
ReadX 13650 2944 2048 2048
ReadX 13650 1088 2048 2048
ReadX 13650 928 2048 2048
ReadX 13650 280 2048 2048
ReadX 13650 744 2048 2048
ReadX 13650 3968 2048 2048
ReadX 13650 336 2048 2048
ReadX 13650 592 2048 2048
ReadX 13650 312 2048 2048
ReadX 13650 400 2048 2048
ReadX 13650 904 2048 2048
ReadX 13650 464 2048 2048
ReadX 13650 3456 2048 2048
ReadX 13650 848 2048 2048
ReadX 13650 936 2048 2048
ReadX 13650 656 2048 2048
ReadX 13650 344 2048 2048
ReadX 13650 440 2048 2048
ReadX 13650 4096 2048 2048
ReadX 13650 528 2048 2048
ReadX 13650 2048 2048 2048
ReadX 13650 1024 2048 2048
ReadX 13650 456 2048 2048
ReadX 13650 1792 2048 2048
ReadX 13650 1152 2048 2048
ReadX 13650 3584 2048 2048
ReadX 13650 1920 2048 2048
ReadX 13650 1280 2048 2048
ReadX 13650 896 2048 2048
ReadX 13650 328 2048 2048
Close 13658
Close 13659
Close 13660
Close 13661
Close 13656
Close 13650
Close 13651
Close 13654
Close 13655
Close 13652
Close 13653
Close 13645
Close 13646
Close 13647
Close 13648
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13665
FIND_FIRST \clients\client1\~dmtmp\*
Close 13665
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13666
QUERY_FILE_INFORMATION 13666
WriteX 13666 0 2048 2048
WriteX 13666 18431 1 1
QUERY_FILE_INFORMATION 13666
WriteX 13666 2048 16384 16384
WriteX 13666 1152 16384 16384
WriteX 13666 2176 16384 16384
WriteX 13666 3200 16384 16384
WriteX 13666 264 16384 16384
WriteX 13666 328 16384 16384
WriteX 13666 392 16384 16384
WriteX 13666 456 16384 16384
WriteX 13666 520 16384 16384
WriteX 13666 584 16384 16384
WriteX 13666 648 16384 16384
WriteX 13666 712 16384 16384
WriteX 13666 776 16384 16384
WriteX 13666 840 16384 16384
WriteX 13666 904 16384 16384
WriteX 13666 968 16384 16384
WriteX 13666 1032 16384 16384
WriteX 13666 1096 16384 16384
WriteX 13666 1160 16384 16384
WriteX 13666 1224 16384 16384
WriteX 13666 1288 16384 16384
WriteX 13666 1352 16384 16384
WriteX 13666 1416 16384 16384
WriteX 13666 1480 16384 16384
WriteX 13666 1544 16384 16384
WriteX 13666 1608 16384 16384
WriteX 13666 1672 16384 16384
WriteX 13666 1736 16384 16384
WriteX 13666 1800 16384 16384
WriteX 13666 1864 16384 16384
WriteX 13666 1928 16384 16384
WriteX 13666 1992 16384 16384
WriteX 13666 2056 16384 16384
WriteX 13666 2120 16384 16384
WriteX 13666 2184 16384 16384
WriteX 13666 2248 16384 16384
WriteX 13666 2312 16384 16384
WriteX 13666 2376 16384 16384
WriteX 13666 2440 16384 16384
WriteX 13666 0 88 88
Close 13666
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13667
ReadX 13667 0 511 511
ReadX 13667 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13667
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13668
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13668 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13669
ReadX 13669 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13670
ReadX 13670 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13671
ReadX 13671 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13672
ReadX 13672 0 53 53
ReadX 13672 53 2 2
ReadX 13672 55 480 480
ReadX 13672 535 2 2
Close 13672
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13673
ReadX 13673 0 511 511
ReadX 13673 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13674
ReadX 13674 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13675
ReadX 13675 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13676
ReadX 13676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13677
ReadX 13677 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13678
ReadX 13678 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13679
ReadX 13679 0 41 41
ReadX 13673 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13680
ReadX 13680 0 53 53
ReadX 13680 53 2 2
ReadX 13680 55 2 2
ReadX 13680 57 184 184
ReadX 13680 241 298 298
Close 13680
ReadX 13668 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13681
ReadX 13681 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13682
ReadX 13682 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13683
ReadX 13683 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13684
ReadX 13684 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13685
ReadX 13685 0 53 53
ReadX 13685 53 28 28
ReadX 13685 81 28 28
ReadX 13685 109 28 28
ReadX 13685 137 28 28
ReadX 13685 165 28 28
ReadX 13685 193 28 28
ReadX 13685 221 28 28
ReadX 13685 249 4 4
ReadX 13685 253 4 4
ReadX 13685 257 4 4
ReadX 13685 261 28 28
ReadX 13685 289 2 2
ReadX 13685 291 2 2
ReadX 13685 293 2 2
Close 13685
ReadX 13681 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13686
ReadX 13686 0 53 53
ReadX 13686 53 2 2
ReadX 13686 55 2 2
ReadX 13686 57 184 184
ReadX 13686 241 298 298
Close 13686
ReadX 13670 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13687
ReadX 13687 0 53 53
ReadX 13687 53 2 2
ReadX 13687 55 480 480
ReadX 13687 535 2 2
Close 13687
Close 13681
Close 13682
Close 13683
Close 13684
Close 13679
Close 13673
Close 13674
Close 13677
Close 13678
Close 13675
Close 13676
Close 13668
Close 13669
Close 13670
Close 13671
Close 13597
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 13688
QUERY_FILE_INFORMATION 13688
Close 13688
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 13615
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 13689
QUERY_FILE_INFORMATION 13689
Close 13689
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 13644
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 13690
QUERY_FILE_INFORMATION 13690
Close 13690
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13691
Close 13691
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13692
ReadX 13692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13693
ReadX 13693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13694
ReadX 13694 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13695
ReadX 13695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13696
ReadX 13696 0 53 53
ReadX 13696 53 28 28
ReadX 13696 81 28 28
ReadX 13696 109 28 28
ReadX 13696 137 28 28
ReadX 13696 165 28 28
ReadX 13696 193 28 28
ReadX 13696 221 28 28
ReadX 13696 249 4 4
ReadX 13696 253 4 4
ReadX 13696 257 4 4
ReadX 13696 261 28 28
ReadX 13696 289 2 2
ReadX 13696 291 2 2
ReadX 13696 293 2 2
Close 13696
ReadX 13692 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 13692 384 2048 2048
ReadX 13692 768 16384 16384
ReadX 13692 1792 14336 14336
ReadX 13695 2048 2048 2048
ReadX 13694 2048 2048 2048
WriteX 13692 1152 2048 2048
WriteX 13695 2048 2048 2048
WriteX 13694 2048 2048 2048
WriteX 13692 0 88 88
WriteX 13693 0 88 88
WriteX 13694 0 88 88
WriteX 13695 0 88 88
Close 13692
Close 13693
Close 13694
Close 13695
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13697
Close 13697
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13698
ReadX 13698 0 511 511
ReadX 13698 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13699
ReadX 13699 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13700
ReadX 13700 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13701
ReadX 13701 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13702
ReadX 13702 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13703
ReadX 13703 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13704
ReadX 13704 0 53 53
ReadX 13704 53 2 2
ReadX 13704 55 2 2
ReadX 13704 57 184 184
ReadX 13704 241 298 298
Close 13704
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13705
ReadX 13705 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13706
ReadX 13706 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13707
ReadX 13707 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13708
ReadX 13708 0 511 511
ReadX 13707 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13709
ReadX 13709 0 53 53
ReadX 13709 53 2 2
ReadX 13709 55 480 480
ReadX 13709 535 2 2
Close 13709
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13710
ReadX 13710 0 41 41
ReadX 13698 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 13711
QUERY_FILE_INFORMATION 13711
QUERY_FILE_INFORMATION 13711
ReadX 13711 0 8192 8192
Close 13711
ReadX 13698 1152 2048 2048
ReadX 13698 4096 16384 16384
Close 13705
Close 13706
Close 13707
Close 13708
Close 13710
Close 13698
Close 13699
Close 13702
Close 13703
Close 13700
Close 13701
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13712
Close 13712
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13713
QUERY_FILE_INFORMATION 13713
ReadX 13713 0 64 64
ReadX 13713 144 64 64
ReadX 13713 224 156 156
ReadX 13713 1193 128 128
ReadX 13713 1201 128 128
ReadX 13713 1072 4 4
ReadX 13713 1076 1925 1925
ReadX 13713 758 4 4
ReadX 13713 762 4557 4557
ReadX 13713 1052 4 4
ReadX 13713 1056 314 314
ReadX 13713 1056 11056 11056
Close 13713
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13714
ReadX 13714 0 511 511
ReadX 13714 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13715
ReadX 13715 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13716
ReadX 13716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13717
ReadX 13717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13718
ReadX 13718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13719
ReadX 13719 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13720
ReadX 13720 0 53 53
ReadX 13720 53 2 2
ReadX 13720 55 2 2
ReadX 13720 57 184 184
ReadX 13720 241 298 298
Close 13720
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13721
ReadX 13721 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13722
ReadX 13722 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13723
ReadX 13723 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13724
ReadX 13724 0 511 511
ReadX 13723 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13725
ReadX 13725 0 53 53
ReadX 13725 53 2 2
ReadX 13725 55 480 480
ReadX 13725 535 2 2
Close 13725
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13726
ReadX 13726 0 41 41
ReadX 13714 2048 2048 2048
ReadX 13715 2048 2048 2048
ReadX 13714 1144 2048 2048
ReadX 13714 1152 2048 2048
ReadX 13714 4096 16384 16384
WriteX 13714 2048 2048 2048
WriteX 13715 2048 2048 2048
WriteX 13714 0 88 88
WriteX 13715 0 88 88
Close 13721
Close 13722
Close 13723
Close 13724
Close 13726
Close 13714
Close 13715
Close 13718
Close 13719
Close 13716
Close 13717
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13727
Close 13727
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 13728
QUERY_FILE_INFORMATION 13728
ReadX 13728 0 64 64
ReadX 13728 144 64 64
ReadX 13728 224 84 84
ReadX 13728 478 16 16
ReadX 13728 1056 6176 6176
Close 13728
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13729
ReadX 13729 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13730
ReadX 13730 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 13731
ReadX 13731 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13732
ReadX 13732 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 13733
ReadX 13733 0 53 53
ReadX 13733 53 28 28
ReadX 13733 81 28 28
ReadX 13733 109 28 28
ReadX 13733 137 28 28
ReadX 13733 165 28 28
ReadX 13733 193 28 28
ReadX 13733 221 28 28
ReadX 13733 249 4 4
ReadX 13733 253 4 4
ReadX 13733 257 4 4
ReadX 13733 261 28 28
ReadX 13733 289 2 2
ReadX 13733 291 2 2
ReadX 13733 293 2 2
Close 13733
ReadX 13729 2048 2048 2048
ReadX 13730 2048 2048 2048
ReadX 13729 1280 2048 2048
ReadX 13732 2048 2048 2048
ReadX 13731 2048 2048 2048
WriteX 13729 1280 2048 2048
WriteX 13732 2048 2048 2048
WriteX 13731 2048 2048 2048
WriteX 13730 2048 2048 2048
WriteX 13729 0 88 88
WriteX 13730 0 88 88
WriteX 13731 0 88 88
WriteX 13732 0 88 88
WriteX 13729 1280 2048 2048
WriteX 13732 2048 2048 2048
WriteX 13731 2048 2048 2048
WriteX 13730 2048 2048 2048
WriteX 13729 0 88 88
WriteX 13730 0 88 88
WriteX 13731 0 88 88
WriteX 13732 0 88 88
WriteX 13729 1280 2048 2048
WriteX 13732 2048 2048 2048
WriteX 13731 2048 2048 2048
WriteX 13730 2048 2048 2048
WriteX 13729 0 88 88
WriteX 13730 0 88 88
WriteX 13731 0 88 88
WriteX 13732 0 88 88
Close 13729
Close 13730
Close 13731
Close 13732
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13734
ReadX 13734 0 511 511
ReadX 13734 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13735
ReadX 13735 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13736
ReadX 13736 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13737
ReadX 13737 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13738
ReadX 13738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13739
ReadX 13739 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13740
ReadX 13740 0 53 53
ReadX 13740 53 2 2
ReadX 13740 55 2 2
ReadX 13740 57 184 184
ReadX 13740 241 298 298
Close 13740
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13741
ReadX 13741 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13742
ReadX 13742 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13743
ReadX 13743 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13744
ReadX 13744 0 511 511
ReadX 13743 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13745
ReadX 13745 0 53 53
ReadX 13745 53 2 2
ReadX 13745 55 480 480
ReadX 13745 535 2 2
Close 13745
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13746
ReadX 13746 0 41 41
ReadX 13734 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 13750
FIND_FIRST \clients\client1\~dmtmp\*
Close 13750
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13751
QUERY_FILE_INFORMATION 13751
WriteX 13751 2047 1 1
QUERY_FILE_INFORMATION 13751
WriteX 13751 0 2048 2048
Close 13751
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13752
ReadX 13752 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 13752 4095 1 1
QUERY_FILE_INFORMATION 13752
WriteX 13752 2048 2048 2048
WriteX 13752 0 88 88
Close 13752
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13753
ReadX 13753 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 13753 2048 2048 2048
Close 13741
Close 13742
Close 13743
Close 13744
Close 13746
Close 13734
Close 13735
Close 13738
Close 13739
Close 13736
Close 13737
WriteX 13753 2048 2048 2048
WriteX 13753 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13754
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13754 0 511 511
ReadX 13754 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13755
ReadX 13755 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13756
ReadX 13756 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13757
ReadX 13757 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13758
ReadX 13758 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13759
ReadX 13759 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13760
ReadX 13760 0 53 53
ReadX 13760 53 2 2
ReadX 13760 55 2 2
ReadX 13760 57 184 184
ReadX 13760 241 298 298
Close 13760
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13761
ReadX 13761 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13762
ReadX 13762 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13763
ReadX 13763 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13764
ReadX 13764 0 511 511
ReadX 13763 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13765
ReadX 13765 0 53 53
ReadX 13765 53 2 2
ReadX 13765 55 480 480
ReadX 13765 535 2 2
Close 13765
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13766
ReadX 13766 0 41 41
ReadX 13754 2048 2048 2048
ReadX 13754 1152 2048 2048
ReadX 13754 4096 16384 16384
ReadX 13754 1280 16384 16384
ReadX 13754 2304 16384 16384
ReadX 13754 3328 16384 16384
ReadX 13754 272 16384 16384
ReadX 13754 336 16384 16384
ReadX 13754 400 16384 16384
ReadX 13754 464 16384 16384
ReadX 13754 528 16384 16384
ReadX 13754 592 16384 16384
ReadX 13754 656 16384 16384
ReadX 13754 720 16384 16384
ReadX 13754 784 16384 16384
ReadX 13754 848 16384 16384
ReadX 13754 912 16384 16384
ReadX 13754 976 16384 16384
ReadX 13754 1040 16384 16384
ReadX 13754 1104 12288 12288
Close 13761
Close 13762
Close 13763
Close 13764
Close 13766
Close 13754
Close 13755
Close 13758
Close 13759
Close 13756
Close 13757
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13767
FIND_FIRST \clients\client1\~dmtmp\*
Close 13767
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13768
QUERY_FILE_INFORMATION 13768
WriteX 13768 0 2048 2048
WriteX 13768 2048 4096 4096
WriteX 13768 0 88 88
Close 13768
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13769
ReadX 13769 0 511 511
ReadX 13769 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13769
WriteX 13753 2048 2048 2048
WriteX 13753 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13770
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13770 0 511 511
ReadX 13770 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13771
ReadX 13771 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13772
ReadX 13772 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13773
ReadX 13773 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13774
ReadX 13774 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13775
ReadX 13775 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13776
ReadX 13776 0 53 53
ReadX 13776 53 2 2
ReadX 13776 55 2 2
ReadX 13776 57 184 184
ReadX 13776 241 298 298
Close 13776
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13777
ReadX 13777 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13778
ReadX 13778 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13779
ReadX 13779 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13780
ReadX 13780 0 511 511
ReadX 13779 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13781
ReadX 13781 0 53 53
ReadX 13781 53 2 2
ReadX 13781 55 480 480
ReadX 13781 535 2 2
Close 13781
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13782
ReadX 13782 0 41 41
ReadX 13770 2048 2048 2048
ReadX 13770 1152 2048 2048
ReadX 13770 4096 16384 16384
ReadX 13770 1280 16384 16384
ReadX 13770 2304 16384 16384
ReadX 13770 3328 16384 16384
ReadX 13770 272 16384 16384
ReadX 13770 336 16384 16384
ReadX 13770 400 16384 16384
ReadX 13770 464 16384 16384
ReadX 13770 528 16384 16384
ReadX 13770 592 16384 16384
ReadX 13770 656 16384 16384
ReadX 13770 720 16384 16384
ReadX 13770 784 16384 16384
ReadX 13770 848 16384 16384
ReadX 13770 912 16384 16384
ReadX 13770 976 16384 16384
ReadX 13770 1040 16384 16384
ReadX 13770 1104 12288 12288
Close 13777
Close 13778
Close 13779
Close 13780
Close 13782
Close 13770
Close 13771
Close 13774
Close 13775
Close 13772
Close 13773
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13783
FIND_FIRST \clients\client1\~dmtmp\*
Close 13783
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13784
QUERY_FILE_INFORMATION 13784
WriteX 13784 0 2048 2048
WriteX 13784 2048 4096 4096
WriteX 13784 0 88 88
Close 13784
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13785
ReadX 13785 0 511 511
ReadX 13785 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 13785
Close 13753
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 13786
QUERY_FILE_INFORMATION 13786
Close 13786
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13787
Close 13787
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13788
QUERY_FILE_INFORMATION 13788
ReadX 13788 0 64 64
ReadX 13788 144 64 64
ReadX 13788 224 156 156
ReadX 13788 1193 128 128
ReadX 13788 1201 128 128
ReadX 13788 1072 4 4
ReadX 13788 1076 1925 1925
ReadX 13788 758 4 4
ReadX 13788 762 4557 4557
ReadX 13788 1052 4 4
ReadX 13788 1056 314 314
ReadX 13788 1056 11056 11056
Close 13788
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13789
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13789 0 511 511
ReadX 13789 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13790
ReadX 13790 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13791
ReadX 13791 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13792
ReadX 13792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13793
ReadX 13793 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13794
ReadX 13794 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13795
ReadX 13795 0 53 53
ReadX 13795 53 2 2
ReadX 13795 55 2 2
ReadX 13795 57 184 184
ReadX 13795 241 298 298
Close 13795
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13796
ReadX 13796 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13797
ReadX 13797 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13798
ReadX 13798 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13799
ReadX 13799 0 511 511
ReadX 13798 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13800
ReadX 13800 0 53 53
ReadX 13800 53 2 2
ReadX 13800 55 480 480
ReadX 13800 535 2 2
Close 13800
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13801
ReadX 13801 0 41 41
ReadX 13789 2048 2048 2048
ReadX 13789 1152 2048 2048
ReadX 13789 4096 16384 16384
Close 13796
Close 13797
Close 13798
Close 13799
Close 13801
Close 13789
Close 13790
Close 13793
Close 13794
Close 13791
Close 13792
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13802
ReadX 13802 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13803
ReadX 13803 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13804
ReadX 13804 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13805
ReadX 13805 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13806
ReadX 13806 0 53 53
ReadX 13806 53 2 2
ReadX 13806 55 480 480
ReadX 13806 535 2 2
Close 13806
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13807
ReadX 13807 0 511 511
ReadX 13807 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13808
ReadX 13808 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13809
ReadX 13809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13810
ReadX 13810 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13811
ReadX 13811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13812
ReadX 13812 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13813
ReadX 13813 0 41 41
ReadX 13807 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13814
ReadX 13814 0 53 53
ReadX 13814 53 2 2
ReadX 13814 55 2 2
ReadX 13814 57 184 184
ReadX 13814 241 298 298
Close 13814
ReadX 13802 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 13818
FIND_FIRST \clients\client1\~dmtmp\*
Close 13818
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13819
QUERY_FILE_INFORMATION 13819
WriteX 13819 2047 1 1
QUERY_FILE_INFORMATION 13819
WriteX 13819 0 2048 2048
Close 13819
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13820
ReadX 13820 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 13820 4095 1 1
QUERY_FILE_INFORMATION 13820
WriteX 13820 2048 2048 2048
WriteX 13820 0 88 88
Close 13820
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13821
ReadX 13821 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13821 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 13825
Close 13825
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13826
QUERY_FILE_INFORMATION 13826
WriteX 13826 2047 1 1
QUERY_FILE_INFORMATION 13826
WriteX 13826 0 2048 2048
Close 13826
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13827
ReadX 13827 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 13827 4095 1 1
QUERY_FILE_INFORMATION 13827
WriteX 13827 2048 2048 2048
WriteX 13827 0 88 88
Close 13827
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13828
ReadX 13828 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 13828 2048 2048 2048
Close 13813
Close 13807
Close 13808
Close 13811
Close 13812
Close 13809
Close 13810
Close 13802
Close 13803
Close 13804
Close 13805
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13829
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13829 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13830
ReadX 13830 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 13831
ReadX 13831 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 13832
ReadX 13832 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 13833
ReadX 13833 0 53 53
ReadX 13833 53 2 2
ReadX 13833 55 480 480
ReadX 13833 535 2 2
Close 13833
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13834
ReadX 13834 0 511 511
ReadX 13834 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 13835
ReadX 13835 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 13836
ReadX 13836 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 13837
ReadX 13837 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 13838
ReadX 13838 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 13839
ReadX 13839 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13840
ReadX 13840 0 41 41
ReadX 13834 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 13841
ReadX 13841 0 53 53
ReadX 13841 53 2 2
ReadX 13841 55 2 2
ReadX 13841 57 184 184
ReadX 13841 241 298 298
Close 13841
ReadX 13829 2048 2048 2048
ReadX 13829 384 16384 16384
ReadX 13829 1408 16384 16384
ReadX 13829 2560 16384 16384
ReadX 13829 3584 16384 16384
ReadX 13829 288 16384 16384
ReadX 13829 352 16384 16384
ReadX 13829 416 16384 16384
ReadX 13829 480 16384 16384
ReadX 13829 552 16384 16384
ReadX 13829 616 16384 16384
ReadX 13829 680 16384 16384
ReadX 13829 744 16384 16384
ReadX 13829 808 16384 16384
ReadX 13829 872 16384 16384
ReadX 13829 936 10240 10240
Close 13840
Close 13834
Close 13835
Close 13838
Close 13839
Close 13836
Close 13837
Close 13829
Close 13830
Close 13831
Close 13832
Close 13821
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 13842
QUERY_FILE_INFORMATION 13842
Close 13842
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 13828
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 13843
QUERY_FILE_INFORMATION 13843
Close 13843
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13844
ReadX 13844 0 65471 65471
ReadX 13844 65471 63 63
ReadX 13844 65534 65471 65471
ReadX 13844 131005 63 63
ReadX 13844 131068 65471 65471
ReadX 13844 196539 63 63
ReadX 13844 196602 65471 65471
ReadX 13844 262073 63 63
ReadX 13844 262136 65471 65471
ReadX 13844 327607 63 63
ReadX 13844 327670 10 10
Close 13844
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13845
ReadX 13845 0 65471 65471
ReadX 13845 65471 63 63
ReadX 13845 65534 65471 65471
ReadX 13845 131005 63 63
ReadX 13845 131068 65471 65471
ReadX 13845 196539 63 63
ReadX 13845 196602 65471 65471
ReadX 13845 262073 63 63
ReadX 13845 262136 65471 65471
ReadX 13845 327607 63 63
ReadX 13845 327670 65471 65471
ReadX 13845 393141 63 63
ReadX 13845 393204 65471 65471
ReadX 13845 458675 63 63
ReadX 13845 458738 65471 65471
ReadX 13845 524209 63 63
ReadX 13845 524272 65471 65471
ReadX 13845 589743 63 63
ReadX 13845 589806 65471 65471
ReadX 13845 655277 63 63
ReadX 13845 655340 32 32
Close 13845
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13846
ReadX 13846 0 65471 65471
ReadX 13846 65471 63 63
ReadX 13846 65534 65471 65471
ReadX 13846 131005 63 63
ReadX 13846 131068 65471 65471
ReadX 13846 196539 63 63
ReadX 13846 196602 65471 65471
ReadX 13846 262073 63 63
ReadX 13846 262136 65471 65471
ReadX 13846 327607 63 63
ReadX 13846 327670 65471 65471
ReadX 13846 393141 63 63
ReadX 13846 393204 65471 65471
ReadX 13846 458675 63 63
ReadX 13846 458738 65471 65471
ReadX 13846 524209 63 63
ReadX 13846 524272 65471 65471
ReadX 13846 589743 63 63
ReadX 13846 589806 65471 65471
ReadX 13846 655277 63 63
ReadX 13846 655340 65471 65471
ReadX 13846 720811 63 63
ReadX 13846 720874 65471 65471
ReadX 13846 786345 63 63
ReadX 13846 786408 65471 65471
ReadX 13846 851879 63 63
ReadX 13846 851942 65471 65471
ReadX 13846 917413 63 63
ReadX 13846 917476 65471 65471
ReadX 13846 982947 63 63
ReadX 13846 983010 65471 65471
ReadX 13846 1048481 63 63
ReadX 13846 1048544 65471 65471
ReadX 13846 1114015 63 63
ReadX 13846 1114078 65471 65471
ReadX 13846 1179549 63 63
ReadX 13846 1179612 65471 65471
ReadX 13846 1245083 63 63
ReadX 13846 1245146 65471 65471
ReadX 13846 1310617 63 63
ReadX 13846 1310680 65471 65471
ReadX 13846 1376151 63 63
ReadX 13846 1376214 65471 65471
ReadX 13846 1441685 63 63
ReadX 13846 1441748 65471 65471
ReadX 13846 1507219 63 63
ReadX 13846 1507282 65471 65471
ReadX 13846 1572753 63 63
ReadX 13846 1572816 65471 65471
ReadX 13846 1638287 63 63
ReadX 13846 1638350 65471 65471
ReadX 13846 1703821 63 63
ReadX 13846 1703884 65471 65471
ReadX 13846 1769355 63 63
ReadX 13846 1769418 65471 65471
ReadX 13846 1834889 63 63
ReadX 13846 1834952 32824 32824
Close 13846
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13847
QUERY_FILE_INFORMATION 13847
ReadX 13847 0 512 512
ReadX 13847 512 512 512
ReadX 13847 1024 512 512
QUERY_FILE_INFORMATION 13847
QUERY_FILE_INFORMATION 13847
ReadX 13847 2560 2048 2048
ReadX 13847 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 13848
WriteX 13848 52 1 1
QUERY_FILE_INFORMATION 13848
WriteX 13848 0 53 53
Close 13848
ReadX 13847 2208 650 650
ReadX 13847 1920 2048 2048
ReadX 13847 2112 2048 2048
ReadX 13847 1856 2048 2048
ReadX 13847 1824 2048 2048
ReadX 13847 1536 512 512
ReadX 13847 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13849
Close 13849
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13847 1568 512 512
ReadX 13847 1536 512 512
ReadX 13847 2176 384 384
ReadX 13847 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13850
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 13847 288 2048 2048
ReadX 13847 2336 2048 2048
ReadX 13847 4384 2048 2048
ReadX 13847 6432 2048 2048
ReadX 13847 8480 2048 2048
ReadX 13847 10528 2048 2048
ReadX 13847 12576 2048 2048
WriteX 13850 15359 1 1
QUERY_FILE_INFORMATION 13850
ReadX 13847 14624 2048 2048
WriteX 13850 0 15360 15360
ReadX 13847 16672 2048 2048
ReadX 13847 18720 2048 2048
ReadX 13847 1728 2048 2048
WriteX 13850 0 12288 12288
Close 13850
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 13851
QUERY_FILE_INFORMATION 13851
ReadX 13851 0 512 512
ReadX 13851 2048 512 512
ReadX 13851 2560 512 512
QUERY_FILE_INFORMATION 13851
QUERY_FILE_INFORMATION 13851
QUERY_FILE_INFORMATION 13851
QUERY_FILE_INFORMATION 13851
QUERY_FILE_INFORMATION 13851
WriteX 13851 2152 384 384
QUERY_FILE_INFORMATION 13851
WriteX 13851 2150 22 22
WriteX 13851 2144 106 106
QUERY_FILE_INFORMATION 13851
WriteX 13851 2176 496 496
ReadX 13851 2176 496 496
QUERY_FILE_INFORMATION 13851
WriteX 13851 2440 384 384
QUERY_FILE_INFORMATION 13851
WriteX 13851 2152 384 384
WriteX 13851 2432 112 112
QUERY_FILE_INFORMATION 13851
WriteX 13851 2439 16 16
QUERY_FILE_INFORMATION 13851
WriteX 13851 2208 220 220
ReadX 13851 2208 220 220
QUERY_FILE_INFORMATION 13851
QUERY_FILE_INFORMATION 13851
WriteX 13851 2440 220 220
QUERY_FILE_INFORMATION 13851
WriteX 13851 2453 36 36
WriteX 13851 2080 512 512
WriteX 13851 2176 512 512
WriteX 13851 2112 512 512
WriteX 13851 2048 512 512
WriteX 13851 0 512 512
QUERY_FILE_INFORMATION 13847
QUERY_FILE_INFORMATION 13847
WriteX 13851 2080 512 512
Close 13851
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 13852
Close 13852
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13853
QUERY_FILE_INFORMATION 13853
ReadX 13853 0 512 512
ReadX 13853 2048 512 512
ReadX 13853 2560 512 512
QUERY_FILE_INFORMATION 13853
QUERY_FILE_INFORMATION 13853
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 13854
Close 13854
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 13847
ReadX 13853 1408 512 512
ReadX 13853 2048 512 512
ReadX 13853 1536 512 512
ReadX 13853 2560 512 512
ReadX 13853 3072 512 512
ReadX 13853 3584 512 512
ReadX 13853 4096 512 512
ReadX 13853 4608 512 512
ReadX 13853 5120 512 512
ReadX 13853 5632 512 512
ReadX 13853 6144 512 512
ReadX 13853 6656 512 512
ReadX 13853 7168 512 512
ReadX 13853 7680 512 512
ReadX 13853 8192 512 512
ReadX 13853 8704 512 512
ReadX 13853 9216 512 512
ReadX 13853 9728 512 512
ReadX 13853 10240 512 512
ReadX 13853 10752 512 512
ReadX 13853 11264 512 512
ReadX 13853 11776 512 512
ReadX 13853 12288 512 512
ReadX 13853 12800 512 512
ReadX 13853 13312 512 512
ReadX 13853 13824 512 512
ReadX 13853 14336 512 512
ReadX 13853 14848 512 512
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 15360 512 0
ReadX 13853 2560 2048 2048
ReadX 13853 4608 2048 2048
ReadX 13853 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13855
QUERY_FILE_INFORMATION 13855
ReadX 13855 0 512 512
ReadX 13855 512 512 512
ReadX 13855 1024 512 512
QUERY_FILE_INFORMATION 13855
QUERY_FILE_INFORMATION 13855
ReadX 13855 352 2048 2048
ReadX 13855 608 1097 1097
ReadX 13855 576 1609 1609
ReadX 13855 4096 512 512
ReadX 13855 1536 512 512
ReadX 13855 3840 256 256
ReadX 13855 288 576 576
ReadX 13855 512 512 512
ReadX 13855 480 512 512
ReadX 13855 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 13856
ReadX 13856 0 4096 4096
ReadX 13856 4096 4096 4096
ReadX 13856 8192 4096 4096
Close 13855
Close 13856
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13857
WriteX 13857 15359 1 1
QUERY_FILE_INFORMATION 13857
WriteX 13857 0 15360 15360
Close 13857
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 13858
QUERY_FILE_INFORMATION 13858
ReadX 13858 0 512 512
ReadX 13858 2048 512 512
ReadX 13858 2560 512 512
QUERY_FILE_INFORMATION 13858
QUERY_FILE_INFORMATION 13858
QUERY_FILE_INFORMATION 13858
QUERY_FILE_INFORMATION 13858
QUERY_FILE_INFORMATION 13858
WriteX 13858 2152 384 384
QUERY_FILE_INFORMATION 13858
WriteX 13858 2150 22 22
WriteX 13858 2144 106 106
QUERY_FILE_INFORMATION 13858
WriteX 13858 2176 476 476
ReadX 13858 2176 476 476
QUERY_FILE_INFORMATION 13858
WriteX 13858 2440 384 384
QUERY_FILE_INFORMATION 13858
WriteX 13858 2152 384 384
WriteX 13858 2432 92 92
QUERY_FILE_INFORMATION 13858
WriteX 13858 2437 36 36
QUERY_FILE_INFORMATION 13858
WriteX 13858 2208 220 220
ReadX 13858 2208 220 220
QUERY_FILE_INFORMATION 13858
QUERY_FILE_INFORMATION 13858
WriteX 13858 2440 220 220
QUERY_FILE_INFORMATION 13858
WriteX 13858 2453 36 36
WriteX 13858 2080 512 512
WriteX 13858 2176 512 512
WriteX 13858 2112 512 512
WriteX 13858 2048 512 512
WriteX 13858 0 512 512
QUERY_FILE_INFORMATION 13853
QUERY_FILE_INFORMATION 13853
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 13853
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13859
Close 13859
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13860
QUERY_FILE_INFORMATION 13860
ReadX 13860 0 512 512
ReadX 13860 2048 512 512
ReadX 13860 2560 512 512
QUERY_FILE_INFORMATION 13860
QUERY_FILE_INFORMATION 13860
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 13861
Close 13861
WriteX 13858 2080 512 512
Close 13858
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 13862
Close 13862
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 13863
QUERY_FILE_INFORMATION 13863
ReadX 13863 0 512 512
ReadX 13863 2048 512 512
ReadX 13863 2560 512 512
QUERY_FILE_INFORMATION 13863
QUERY_FILE_INFORMATION 13863
ReadX 13863 1312 512 512
ReadX 13863 1536 512 512
ReadX 13863 2048 512 512
ReadX 13863 576 512 512
ReadX 13863 1088 512 512
ReadX 13863 1056 512 512
ReadX 13863 1120 512 512
ReadX 13863 1184 512 512
ReadX 13863 2560 2048 2048
ReadX 13863 4608 2048 2048
ReadX 13863 6656 2048 2048
ReadX 13863 8704 2048 2048
ReadX 13863 10752 2048 2048
ReadX 13863 12800 2048 2048
ReadX 13863 14848 2048 512
ReadX 13863 15360 1536 0
ReadX 13863 1088 2048 2048
ReadX 13863 3136 2048 2048
ReadX 13863 1665 5835 5835
ReadX 13863 1856 2048 2048
ReadX 13863 2112 512 512
ReadX 13863 2152 384 384
ReadX 13863 2432 92 92
ReadX 13863 2176 512 512
ReadX 13863 2440 220 220
QUERY_FILE_INFORMATION 13863
QUERY_FILE_INFORMATION 13863
ReadX 13863 2432 512 512
WriteX 13863 2272 512 512
ReadX 13863 2144 512 512
WriteX 13863 2304 512 512
WriteX 13863 2272 92 92
WriteX 13863 2208 512 512
WriteX 13863 2720 512 512
WriteX 13863 0 512 512
QUERY_FILE_INFORMATION 13863
QUERY_FILE_INFORMATION 13863
ReadX 13863 1312 4096 4096
ReadX 13863 5408 4096 4096
ReadX 13863 9504 3305 3305
ReadX 13863 512 4096 4096
QUERY_FILE_INFORMATION 13863
QUERY_FILE_INFORMATION 13863
QUERY_FILE_INFORMATION 13863
WriteX 13863 3132 50 50
WriteX 13863 3182 4096 4096
WriteX 13863 7278 4096 4096
WriteX 13863 15469 1 1
QUERY_FILE_INFORMATION 13863
WriteX 13863 11374 4096 4096
WriteX 13863 15470 3584 3584
WriteX 13863 2144 512 512
WriteX 13863 2336 4096 4096
WriteX 13863 6432 4096 4096
WriteX 13863 10528 4096 4096
WriteX 13863 14624 462 462
WriteX 13863 2048 512 512
WriteX 13863 2560 512 512
WriteX 13863 0 512 512
QUERY_FILE_INFORMATION 13863
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13864
QUERY_FILE_INFORMATION 13864
ReadX 13864 0 512 512
ReadX 13864 1152 512 512
ReadX 13864 1664 512 512
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
ReadX 13864 512 2048 2048
ReadX 13864 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 13865
WriteX 13865 52 1 1
QUERY_FILE_INFORMATION 13865
WriteX 13865 0 53 53
Close 13865
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
ReadX 13864 1120 504 504
ReadX 13864 896 2048 2048
ReadX 13864 1056 1528 1528
ReadX 13864 864 2048 2048
ReadX 13864 832 2048 2048
ReadX 13864 736 2048 2048
ReadX 13864 1216 512 512
ReadX 13864 1256 384 384
ReadX 13864 1536 140 140
ReadX 13864 1280 512 512
ReadX 13864 1548 252 252
ReadX 13863 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13866
Close 13866
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13864 2560 2048 2048
ReadX 13864 4608 2048 2048
ReadX 13864 6656 2048 2048
ReadX 13864 8704 2048 2048
ReadX 13864 10752 2048 2048
WriteX 13867 12005 1 1
QUERY_FILE_INFORMATION 13867
WriteX 13867 0 12006 12006
Close 13867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 13868
QUERY_FILE_INFORMATION 13868
ReadX 13868 0 512 512
ReadX 13868 1152 512 512
ReadX 13868 1664 512 512
QUERY_FILE_INFORMATION 13868
QUERY_FILE_INFORMATION 13868
QUERY_FILE_INFORMATION 13868
QUERY_FILE_INFORMATION 13868
QUERY_FILE_INFORMATION 13868
QUERY_FILE_INFORMATION 13868
QUERY_FILE_INFORMATION 13868
WriteX 13868 1256 384 384
QUERY_FILE_INFORMATION 13868
WriteX 13868 1254 22 22
WriteX 13868 1248 106 106
QUERY_FILE_INFORMATION 13868
WriteX 13868 1280 508 508
ReadX 13868 1280 508 508
QUERY_FILE_INFORMATION 13868
WriteX 13868 1544 384 384
QUERY_FILE_INFORMATION 13868
WriteX 13868 1256 384 384
WriteX 13868 1536 124 124
QUERY_FILE_INFORMATION 13868
WriteX 13868 1543 4 4
QUERY_FILE_INFORMATION 13868
WriteX 13868 1312 252 252
ReadX 13868 1312 252 252
QUERY_FILE_INFORMATION 13868
QUERY_FILE_INFORMATION 13868
WriteX 13868 1544 252 252
QUERY_FILE_INFORMATION 13868
WriteX 13868 1559 4 4
WriteX 13868 1184 512 512
WriteX 13868 1280 512 512
WriteX 13868 1216 512 512
WriteX 13868 1152 512 512
WriteX 13868 0 512 512
QUERY_FILE_INFORMATION 13864
QUERY_FILE_INFORMATION 13864
WriteX 13868 1184 512 512
Close 13868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 13869
Close 13869
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13870
QUERY_FILE_INFORMATION 13870
ReadX 13870 0 512 512
ReadX 13870 1152 512 512
ReadX 13870 1664 512 512
QUERY_FILE_INFORMATION 13870
QUERY_FILE_INFORMATION 13870
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 13871
Close 13871
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 13864
ReadX 13870 736 512 512
ReadX 13870 1536 2048 2048
ReadX 13870 3584 2048 2048
ReadX 13870 5632 2048 2048
ReadX 13870 7680 2048 2048
ReadX 13870 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13872
WriteX 13872 11990 1 1
QUERY_FILE_INFORMATION 13872
WriteX 13872 0 11991 11991
Close 13872
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 13873
QUERY_FILE_INFORMATION 13873
ReadX 13873 0 512 512
ReadX 13873 1184 512 512
ReadX 13873 1696 512 512
QUERY_FILE_INFORMATION 13873
QUERY_FILE_INFORMATION 13873
QUERY_FILE_INFORMATION 13873
QUERY_FILE_INFORMATION 13873
QUERY_FILE_INFORMATION 13873
QUERY_FILE_INFORMATION 13873
QUERY_FILE_INFORMATION 13873
WriteX 13873 1288 384 384
QUERY_FILE_INFORMATION 13873
WriteX 13873 1286 22 22
WriteX 13873 1280 106 106
QUERY_FILE_INFORMATION 13873
WriteX 13873 1312 508 508
ReadX 13873 1312 508 508
QUERY_FILE_INFORMATION 13873
WriteX 13873 1576 384 384
QUERY_FILE_INFORMATION 13873
WriteX 13873 1288 384 384
WriteX 13873 1568 124 124
QUERY_FILE_INFORMATION 13873
WriteX 13873 1575 4 4
QUERY_FILE_INFORMATION 13873
WriteX 13873 1344 252 252
ReadX 13873 1344 252 252
QUERY_FILE_INFORMATION 13873
QUERY_FILE_INFORMATION 13873
WriteX 13873 1576 252 252
QUERY_FILE_INFORMATION 13873
WriteX 13873 1591 4 4
WriteX 13873 1216 512 512
WriteX 13873 1312 512 512
WriteX 13873 1248 512 512
WriteX 13873 1184 512 512
WriteX 13873 0 512 512
QUERY_FILE_INFORMATION 13870
QUERY_FILE_INFORMATION 13870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 13870
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13874
Close 13874
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13875
QUERY_FILE_INFORMATION 13875
ReadX 13875 0 512 512
ReadX 13875 1152 512 512
ReadX 13875 1664 512 512
QUERY_FILE_INFORMATION 13875
QUERY_FILE_INFORMATION 13875
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 13876
Close 13876
WriteX 13873 1216 512 512
Close 13873
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 13877
Close 13877
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 13878
QUERY_FILE_INFORMATION 13878
ReadX 13878 0 512 512
ReadX 13878 1184 512 512
ReadX 13878 1696 512 512
QUERY_FILE_INFORMATION 13878
QUERY_FILE_INFORMATION 13878
ReadX 13878 1536 512 512
ReadX 13878 736 512 512
ReadX 13878 2048 512 512
ReadX 13878 2560 512 512
ReadX 13878 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13879
Close 13879
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 13878 914 3899 3899
ReadX 13878 1248 512 512
ReadX 13878 1288 384 384
ReadX 13878 1568 124 124
ReadX 13878 1312 512 512
ReadX 13878 1576 252 252
QUERY_FILE_INFORMATION 13878
QUERY_FILE_INFORMATION 13878
ReadX 13878 1568 512 512
WriteX 13878 1408 512 512
ReadX 13878 1280 512 512
WriteX 13878 1440 512 512
WriteX 13878 1408 124 124
WriteX 13878 1344 512 512
WriteX 13878 1856 512 512
WriteX 13878 0 512 512
QUERY_FILE_INFORMATION 13878
QUERY_FILE_INFORMATION 13878
ReadX 13878 544 4096 4096
ReadX 13878 4640 4096 4096
ReadX 13878 8736 1637 1637
ReadX 13878 512 4096 4096
QUERY_FILE_INFORMATION 13878
QUERY_FILE_INFORMATION 13878
WriteX 13878 1280 512 512
WriteX 13878 1472 3584 3584
WriteX 13878 5056 4096 4096
WriteX 13878 13247 1 1
QUERY_FILE_INFORMATION 13878
WriteX 13878 9152 4096 4096
WriteX 13878 13248 1736 1736
WriteX 13878 1184 512 512
WriteX 13878 1696 512 512
WriteX 13878 0 512 512
QUERY_FILE_INFORMATION 13878
ReadX 13878 1632 1024 1024
ReadX 13878 288 1024 1024
ReadX 13878 1312 2048 2048
ReadX 13878 3360 1024 1024
ReadX 13878 1696 1024 1024
ReadX 13878 2720 512 512
ReadX 13878 3232 512 512
ReadX 13878 3744 512 512
ReadX 13878 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 13878 2066 3998 3998
ReadX 13878 1448 384 384
ReadX 13878 1408 124 124
ReadX 13878 1416 252 252
QUERY_FILE_INFORMATION 13878
QUERY_FILE_INFORMATION 13878
ReadX 13878 1408 512 512
WriteX 13878 1536 512 512
ReadX 13878 1440 512 512
WriteX 13878 2048 512 512
WriteX 13878 1536 124 124
WriteX 13878 512 512 512
WriteX 13878 1024 512 512
WriteX 13878 0 512 512
QUERY_FILE_INFORMATION 13878
ReadX 13878 1696 4096 4096
ReadX 13878 5792 4096 4096
ReadX 13878 9888 1736 1736
ReadX 13878 1280 512 512
ReadX 13878 1472 3584 3584
QUERY_FILE_INFORMATION 13878
QUERY_FILE_INFORMATION 13878
WriteX 13878 3940 156 156
WriteX 13878 4096 512 512
WriteX 13878 544 3584 3584
WriteX 13878 4128 4096 4096
WriteX 13878 8224 3584 3584
WriteX 13878 1344 512 512
WriteX 13878 1856 1536 1536
WriteX 13878 2336 512 512
WriteX 13878 3584 356 356
WriteX 13878 2560 512 512
WriteX 13878 3072 512 512
WriteX 13878 0 512 512
QUERY_FILE_INFORMATION 13878
Close 13860
Close 13863
Close 13878
Close 13875
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 13880
Close 13880
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 13881
Close 13881
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13882
WriteX 13882 0 65471 65471
WriteX 13882 65471 63 63
WriteX 13882 65534 65471 65471
WriteX 13882 131005 63 63
Close 13882
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13883
WriteX 13883 0 65471 65471
WriteX 13883 65471 63 63
WriteX 13883 65534 65471 65471
WriteX 13883 131005 63 63
WriteX 13883 131068 65471 65471
WriteX 13883 196539 63 63
WriteX 13883 196602 65471 65471
WriteX 13883 262073 63 63
Close 13883
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13884
WriteX 13884 0 65471 65471
WriteX 13884 65471 63 63
WriteX 13884 65534 65471 65471
WriteX 13884 131005 63 63
WriteX 13884 131068 65471 65471
WriteX 13884 196539 63 63
WriteX 13884 196602 65471 65471
WriteX 13884 262073 63 63
WriteX 13884 262136 65471 65471
WriteX 13884 327607 63 63
WriteX 13884 327670 65471 65471
WriteX 13884 393141 63 63
WriteX 13884 393204 65471 65471
WriteX 13884 458675 63 63
WriteX 13884 458738 65471 65471
WriteX 13884 524209 63 63
Close 13884
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13885
QUERY_FILE_INFORMATION 13885
QUERY_FILE_INFORMATION 13885
ReadX 13885 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 13886
Close 13886
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 13887
WriteX 13887 63 1 1
QUERY_FILE_INFORMATION 13887
WriteX 13887 0 64 64
ReadX 13885 992 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 344 2048 2048
ReadX 13885 1344 2048 2048
ReadX 13885 1352 2048 2048
ReadX 13885 1320 2048 2048
ReadX 13885 1360 2048 2048
ReadX 13885 1344 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2304 2048 2048
ReadX 13885 1472 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 1480 2048 2048
ReadX 13885 1488 2048 2048
ReadX 13885 1496 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 1504 2048 2048
ReadX 13885 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 1000 2048 2048
ReadX 13885 1416 2048 2048
ReadX 13885 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13885 360 2048 2048
ReadX 13885 368 2048 2048
ReadX 13885 360 2048 2048
ReadX 13885 376 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 1232 2048 2048
ReadX 13885 2432 6144 6144
ReadX 13885 2376 2048 2048
ReadX 13885 2360 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 2376 2048 2048
ReadX 13885 2384 2048 2048
ReadX 13885 2368 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 1296 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 13885 0 2048 2048
ReadX 13885 2688 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 2688 2048 2048
WriteX 13885 2688 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 2688 2048 2048
ReadX 13885 2688 2048 2048
ReadX 13885 2688 2048 2048
WriteX 13885 2688 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13885 2688 2048 2048
ReadX 13885 2688 2048 2048
WriteX 13885 2688 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 320 4096 4096
ReadX 13885 0 2048 2048
ReadX 13885 3584 2048 2048
ReadX 13885 3584 2048 2048
ReadX 13885 3584 2048 2048
ReadX 13885 0 2048 2048
WriteX 13885 3584 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2688 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 2688 2048 2048
ReadX 13885 2688 2048 2048
WriteX 13885 2688 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 3200 2048 2048
ReadX 13885 3200 2048 2048
ReadX 13885 3200 2048 2048
WriteX 13885 3200 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 3456 2048 2048
ReadX 13885 3456 2048 2048
ReadX 13885 3456 2048 2048
WriteX 13885 3456 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2496 2048 2048
ReadX 13885 2472 2048 2048
ReadX 13885 2456 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 2472 2048 2048
ReadX 13885 2480 2048 2048
ReadX 13885 2464 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 2488 2048 2048
ReadX 13885 2568 8192 8192
ReadX 13885 1000 2048 2048
ReadX 13885 328 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 2048 2048 2048
ReadX 13885 2560 2048 2048
ReadX 13885 920 2048 2048
WriteX 13885 2048 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 312 2048 2048
WriteX 13885 336 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 328 2048 2048
WriteX 13885 2560 2048 2048
WriteX 13885 3840 2048 2048
WriteX 13885 920 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2432 2048 2048
WriteX 13885 2432 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2456 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 328 2048 2048
ReadX 13885 2560 2048 2048
ReadX 13885 2048 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 336 2048 2048
ReadX 13885 920 2048 2048
WriteX 13885 1536 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 2048 2048 2048
WriteX 13885 2560 2048 2048
WriteX 13885 336 2048 2048
WriteX 13885 920 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2048 2048 2048
ReadX 13885 2432 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 2048 2048 2048
WriteX 13885 2432 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2456 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1536 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 336 2048 2048
ReadX 13885 920 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 1536 2048 2048
WriteX 13885 336 2048 2048
WriteX 13885 920 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2432 2048 2048
WriteX 13885 2432 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2456 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1536 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 336 2048 2048
ReadX 13885 920 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 1536 2048 2048
WriteX 13885 336 2048 2048
WriteX 13885 920 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2432 2048 2048
WriteX 13885 2432 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2456 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1536 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 336 2048 2048
ReadX 13885 920 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 1536 2048 2048
WriteX 13885 336 2048 2048
WriteX 13885 920 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2432 2048 2048
WriteX 13885 2432 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2456 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1536 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 336 2048 2048
ReadX 13885 920 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 1536 2048 2048
WriteX 13885 336 2048 2048
WriteX 13885 920 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2432 2048 2048
WriteX 13885 2432 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
Flush 13885
ReadX 13885 2456 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1536 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 336 2048 2048
ReadX 13885 920 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 1536 2048 2048
WriteX 13885 336 2048 2048
WriteX 13885 920 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2432 2048 2048
WriteX 13885 2432 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2624 6144 6144
ReadX 13885 2616 2048 2048
ReadX 13885 2688 2048 2048
ReadX 13885 2600 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 2616 2048 2048
ReadX 13885 2608 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 344 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 520 2048 2048
ReadX 13885 1392 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 400 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 536 2048 2048
ReadX 13885 824 2048 2048
ReadX 13885 832 2048 2048
ReadX 13885 384 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 408 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 552 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 824 2048 2048
ReadX 13885 840 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 768 2048 2048
ReadX 13885 2048 2048 2048
WriteX 13885 1415 1 1
WriteX 13885 352 2048 2048
WriteX 13885 1112 2048 2048
WriteX 13885 1400 2048 2048
WriteX 13885 1408 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 2048 2048 2048
WriteX 13885 768 2048 2048
WriteX 13885 344 2048 2048
WriteX 13885 1000 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 416 2048 2048
ReadX 13885 424 2048 2048
ReadX 13885 432 2048 2048
ReadX 13885 440 2048 2048
ReadX 13885 576 16384 16384
ReadX 13885 448 2048 2048
ReadX 13885 456 2048 2048
ReadX 13885 464 2048 2048
ReadX 13885 640 16384 16384
ReadX 13885 704 16384 16384
ReadX 13885 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 13885 848 2048 2048
ReadX 13885 560 2048 2048
ReadX 13885 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 2600 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 352 2048 2048
ReadX 13885 1928 8192 8192
ReadX 13885 528 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 824 2048 2048
ReadX 13885 0 2048 2048
Flush 13885
ReadX 13885 2600 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 352 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 824 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 856 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 392 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 472 2048 2048
ReadX 13885 480 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 488 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 928 2048 2048
ReadX 13885 936 2048 2048
ReadX 13885 976 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 392 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 952 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 528 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 528 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 816 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13885 1336 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 528 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 528 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1240 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2200 4096 4096
ReadX 13885 2152 2048 2048
ReadX 13885 2160 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1312 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 1928 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 824 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1416 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 352 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 824 2048 2048
ReadX 13885 384 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 13885 352 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 768 2048 2048
ReadX 13885 2048 2048 2048
ReadX 13885 352 2048 2048
WriteX 13885 1551 1 1
WriteX 13885 1512 2048 2048
WriteX 13885 1520 2048 2048
WriteX 13885 1528 2048 2048
WriteX 13885 1544 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 2048 2048 2048
WriteX 13885 768 2048 2048
WriteX 13885 344 2048 2048
WriteX 13885 1000 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2048 2048 2048
WriteX 13885 2048 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 1000 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1240 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 344 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 384 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 768 2048 2048
WriteX 13885 1567 1 1
WriteX 13885 1552 2048 2048
WriteX 13885 1560 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 768 2048 2048
WriteX 13885 344 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 1328 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1240 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2200 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1240 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 344 2048 2048
ReadX 13885 384 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 2048 2048 2048
ReadX 13885 768 2048 2048
WriteX 13885 1583 1 1
WriteX 13885 1568 2048 2048
WriteX 13885 1576 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 2048 2048 2048
WriteX 13885 768 2048 2048
WriteX 13885 344 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 864 2048 2048
ReadX 13885 872 2048 2048
ReadX 13885 912 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 2688 2048 2048
ReadX 13885 1000 2048 2048
WriteX 13885 2688 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 2944 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 0 2048 2048
Flush 13885
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 2688 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 2688 2048 2048
WriteX 13885 2688 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 392 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 416 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 416 2048 2048
ReadX 13885 864 2048 2048
ReadX 13885 872 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 312 2048 2048
ReadX 13885 888 2048 2048
ReadX 13885 400 2048 2048
ReadX 13885 896 2048 2048
WriteX 13885 1584 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 400 2048 2048
WriteX 13885 416 2048 2048
WriteX 13885 864 2048 2048
WriteX 13885 872 2048 2048
WriteX 13885 888 2048 2048
WriteX 13885 896 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 584 2048 2048
ReadX 13885 392 2048 2048
WriteX 13885 392 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 1328 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 0 2048 2048
ReadX 13885 408 2048 2048
ReadX 13885 1328 2048 2048
ReadX 13885 864 2048 2048
ReadX 13885 912 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 3840 2048 2048
ReadX 13885 312 2048 2048
ReadX 13885 1584 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 408 2048 2048
WriteX 13885 912 2048 2048
WriteX 13885 1584 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 408 2048 2048
ReadX 13885 392 2048 2048
WriteX 13885 392 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 528 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 528 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 552 2048 2048
ReadX 13885 1336 2048 2048
WriteX 13885 552 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 0 2048 2048
ReadX 13885 552 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 2664 2048 2048
ReadX 13885 2648 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 2672 2048 2048
ReadX 13885 2656 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 1000 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13885 528 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 1336 2048 2048
ReadX 13885 2680 2048 2048
ReadX 13885 2760 8192 8192
ReadX 13885 544 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 568 2048 2048
ReadX 13885 544 2048 2048
ReadX 13885 0 2048 2048
Flush 13885
ReadX 13885 2816 6144 6144
ReadX 13885 2760 2048 2048
ReadX 13885 2744 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 2752 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 528 2048 2048
ReadX 13885 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13889
Close 13889
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13891
WriteX 13891 4065 1 1
QUERY_FILE_INFORMATION 13891
WriteX 13891 0 62591 62591
Close 13891
ReadX 13885 0 2048 2048
ReadX 13885 2808 2048 2048
ReadX 13885 2792 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 2800 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 384 2048 2048
ReadX 13885 392 2048 2048
ReadX 13885 1384 2048 2048
ReadX 13885 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13893
Close 13893
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13895
WriteX 13895 4094 1 1
QUERY_FILE_INFORMATION 13895
WriteX 13895 0 10845 10845
Close 13895
ReadX 13885 1432 2048 2048
ReadX 13885 1304 2048 2048
ReadX 13885 1368 2048 2048
ReadX 13885 2304 2048 2048
ReadX 13885 1440 2048 2048
ReadX 13885 1424 2048 2048
ReadX 13885 1448 2048 2048
ReadX 13885 1456 2048 2048
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13897
Close 13897
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13899
ReadX 13885 0 2048 2048
WriteX 13899 4081 1 1
QUERY_FILE_INFORMATION 13899
WriteX 13899 0 30118 30118
Close 13899
ReadX 13885 1344 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1152 2048 2048
ReadX 13885 1152 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 1000 2048 2048
ReadX 13885 768 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 344 2048 2048
WriteX 13885 1000 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 1416 2048 2048
ReadX 13885 1416 2048 2048
ReadX 13885 344 2048 2048
ReadX 13885 896 2048 2048
WriteX 13885 1538 2 2
WriteX 13885 344 2048 2048
WriteX 13885 1416 2048 2048
WriteX 13885 1538 2 2
ReadX 13885 2048 2048 2048
WriteX 13885 2048 2048 2048
WriteX 13885 1538 2 2
Close 13885
Close 13887
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13900
ReadX 13900 0 65471 65471
ReadX 13900 65471 63 63
ReadX 13900 65534 65471 65471
ReadX 13900 131005 63 63
ReadX 13900 131068 65471 65471
ReadX 13900 196539 63 63
ReadX 13900 196602 65471 65471
ReadX 13900 262073 63 63
ReadX 13900 262136 65471 65471
ReadX 13900 327607 63 63
ReadX 13900 327670 10 10
Close 13900
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13901
ReadX 13901 0 65471 65471
ReadX 13901 65471 63 63
ReadX 13901 65534 65471 65471
ReadX 13901 131005 63 63
ReadX 13901 131068 65471 65471
ReadX 13901 196539 63 63
ReadX 13901 196602 65471 65471
ReadX 13901 262073 63 63
ReadX 13901 262136 65471 65471
ReadX 13901 327607 63 63
ReadX 13901 327670 65471 65471
ReadX 13901 393141 63 63
ReadX 13901 393204 65471 65471
ReadX 13901 458675 63 63
ReadX 13901 458738 65471 65471
ReadX 13901 524209 63 63
ReadX 13901 524272 65471 65471
ReadX 13901 589743 63 63
ReadX 13901 589806 65471 65471
ReadX 13901 655277 63 63
ReadX 13901 655340 32 32
Close 13901
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13902
ReadX 13902 0 65471 65471
ReadX 13902 65471 63 63
ReadX 13902 65534 65471 65471
ReadX 13902 131005 63 63
ReadX 13902 131068 65471 65471
ReadX 13902 196539 63 63
ReadX 13902 196602 65471 65471
ReadX 13902 262073 63 63
ReadX 13902 262136 65471 65471
ReadX 13902 327607 63 63
ReadX 13902 327670 65471 65471
ReadX 13902 393141 63 63
ReadX 13902 393204 65471 65471
ReadX 13902 458675 63 63
ReadX 13902 458738 65471 65471
ReadX 13902 524209 63 63
ReadX 13902 524272 65471 65471
ReadX 13902 589743 63 63
ReadX 13902 589806 65471 65471
ReadX 13902 655277 63 63
ReadX 13902 655340 65471 65471
ReadX 13902 720811 63 63
ReadX 13902 720874 65471 65471
ReadX 13902 786345 63 63
ReadX 13902 786408 65471 65471
ReadX 13902 851879 63 63
ReadX 13902 851942 65471 65471
ReadX 13902 917413 63 63
ReadX 13902 917476 65471 65471
ReadX 13902 982947 63 63
ReadX 13902 983010 65471 65471
ReadX 13902 1048481 63 63
ReadX 13902 1048544 65471 65471
ReadX 13902 1114015 63 63
ReadX 13902 1114078 65471 65471
ReadX 13902 1179549 63 63
ReadX 13902 1179612 65471 65471
ReadX 13902 1245083 63 63
ReadX 13902 1245146 65471 65471
ReadX 13902 1310617 63 63
ReadX 13902 1310680 65471 65471
ReadX 13902 1376151 63 63
ReadX 13902 1376214 65471 65471
ReadX 13902 1441685 63 63
ReadX 13902 1441748 65471 65471
ReadX 13902 1507219 63 63
ReadX 13902 1507282 65471 65471
ReadX 13902 1572753 63 63
ReadX 13902 1572816 65471 65471
ReadX 13902 1638287 63 63
ReadX 13902 1638350 65471 65471
ReadX 13902 1703821 63 63
ReadX 13902 1703884 65471 65471
ReadX 13902 1769355 63 63
ReadX 13902 1769418 65471 65471
ReadX 13902 1834889 63 63
ReadX 13902 1834952 32824 32824
Close 13902
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13903
Close 13903
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13904
ReadX 13904 0 24 24
Close 13904
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13905
QUERY_FILE_INFORMATION 13905
ReadX 13905 0 512 512
ReadX 13905 464 512 512
ReadX 13905 498 512 512
ReadX 13905 472 512 512
ReadX 13905 466 512 512
ReadX 13905 978 512 512
ReadX 13905 497 57 57
Close 13905
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13906
QUERY_FILE_INFORMATION 13906
ReadX 13906 0 512 512
ReadX 13906 464 512 512
ReadX 13906 498 512 512
ReadX 13906 472 512 512
ReadX 13906 462 512 512
ReadX 13906 468 512 512
ReadX 13906 466 512 512
QUERY_FILE_INFORMATION 13906
WriteX 13906 482 60 60
WriteX 13906 482 4 4
QUERY_FILE_INFORMATION 13906
WriteX 13906 482 11 11
ReadX 13906 497 57 57
ReadX 13906 497 57 57
ReadX 13906 368 4096 4096
ReadX 13906 460 512 512
ReadX 13906 512 4096 4096
ReadX 13906 4608 4096 4096
ReadX 13906 8704 4096 4096
ReadX 13906 12800 4096 4096
ReadX 13906 16896 4096 4096
ReadX 13906 20992 4096 4096
ReadX 13906 25088 4096 4096
ReadX 13906 29184 4096 4096
ReadX 13906 33280 4096 4096
ReadX 13906 37376 4096 4096
ReadX 13906 41472 4096 4096
ReadX 13906 45568 4096 4096
ReadX 13906 49664 4096 4096
ReadX 13906 53760 4096 4096
ReadX 13906 57856 4096 4096
ReadX 13906 61952 4096 4096
ReadX 13906 66048 4096 4096
ReadX 13906 70144 4096 4096
ReadX 13906 497 20 20
ReadX 13906 496 103 103
ReadX 13906 500 448 448
ReadX 13906 470 512 512
ReadX 13906 486 2692 2692
ReadX 13906 290 4096 4096
ReadX 13906 4386 4096 4096
ReadX 13906 8482 4096 4096
ReadX 13906 500 20 20
ReadX 13906 483 108 108
ReadX 13906 482 292 292
ReadX 13906 338 4096 4096
ReadX 13906 4434 3103 3103
ReadX 13906 384 28 28
ReadX 13906 412 20 20
ReadX 13906 432 8 8
ReadX 13906 440 136 136
ReadX 13906 576 8 8
ReadX 13906 584 4 4
ReadX 13906 588 4 4
ReadX 13906 592 39 39
ReadX 13906 384 4 4
ReadX 13906 388 4 4
ReadX 13906 392 23 23
ReadX 13906 385 4 4
ReadX 13906 389 4 4
ReadX 13906 393 12 12
ReadX 13906 405 4 4
ReadX 13906 409 4 4
ReadX 13906 413 1 1
ReadX 13906 385 4 4
ReadX 13906 389 4 4
ReadX 13906 393 1 1
ReadX 13906 385 4 4
ReadX 13906 389 4 4
ReadX 13906 393 12 12
ReadX 13906 405 4 4
ReadX 13906 409 4 4
ReadX 13906 413 2 2
ReadX 13906 385 4 4
ReadX 13906 389 4 4
ReadX 13906 393 25 25
ReadX 13906 385 4 4
ReadX 13906 389 8 8
ReadX 13906 397 4 4
ReadX 13906 401 8 8
ReadX 13906 409 4 4
ReadX 13906 413 8 8
ReadX 13906 421 4 4
ReadX 13906 425 8 8
ReadX 13906 433 4 4
ReadX 13906 437 4 4
ReadX 13906 441 4 4
ReadX 13906 445 4 4
ReadX 13906 449 4 4
ReadX 13906 453 4 4
ReadX 13906 457 4 4
ReadX 13906 461 4 4
ReadX 13906 465 10670 10670
ReadX 13906 428 4096 4096
WriteX 13906 498 512 512
WriteX 13906 472 512 512
WriteX 13906 462 512 512
WriteX 13906 468 512 512
Close 13906
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13907
Close 13907
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13908
QUERY_FILE_INFORMATION 13908
ReadX 13908 0 512 512
ReadX 13908 464 512 512
ReadX 13908 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13909
Close 13909
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13908
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13911
WriteX 13911 4607 1 1
QUERY_FILE_INFORMATION 13911
WriteX 13911 0 65471 65471
WriteX 13911 65471 65 65
WriteX 13911 65536 19979 19979
Close 13911
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13912
QUERY_FILE_INFORMATION 13912
ReadX 13912 0 512 512
ReadX 13912 462 512 512
ReadX 13912 974 512 512
ReadX 13912 1486 512 512
ReadX 13912 460 512 512
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
WriteX 13912 470 448 448
QUERY_FILE_INFORMATION 13912
WriteX 13912 470 60 60
WriteX 13912 470 4 4
QUERY_FILE_INFORMATION 13912
WriteX 13912 470 11 11
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
WriteX 13912 464 512 512
WriteX 13912 976 512 512
WriteX 13912 1488 512 512
WriteX 13912 462 512 512
WriteX 13912 0 512 512
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
ReadX 13912 470 512 512
WriteX 13912 482 512 512
WriteX 13912 482 292 292
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
WriteX 13912 483 20 20
WriteX 13912 483 108 108
QUERY_FILE_INFORMATION 13912
WriteX 13912 484 448 448
QUERY_FILE_INFORMATION 13912
WriteX 13912 484 44 44
WriteX 13912 484 20 20
WriteX 13912 480 512 512
WriteX 13912 472 512 512
WriteX 13912 476 512 512
WriteX 13912 988 512 512
WriteX 13912 474 512 512
Flush 13912
WriteX 13912 0 512 512
Flush 13912
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
WriteX 13912 480 512 512
WriteX 13912 472 512 512
WriteX 13912 476 512 512
QUERY_FILE_INFORMATION 13912
WriteX 13912 496 320 320
QUERY_FILE_INFORMATION 13912
WriteX 13912 496 60 60
ReadX 13912 484 512 512
WriteX 13912 500 512 512
WriteX 13912 470 512 512
WriteX 13912 486 2692 2692
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
WriteX 13912 497 25 25
WriteX 13912 496 103 103
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
WriteX 13912 497 44 44
WriteX 13912 497 20 20
WriteX 13912 498 512 512
WriteX 13912 462 512 512
WriteX 13912 466 512 512
WriteX 13912 978 512 512
WriteX 13912 464 512 512
Flush 13912
WriteX 13912 0 512 512
Flush 13912
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
QUERY_FILE_INFORMATION 13912
WriteX 13912 497 7 7
WriteX 13912 497 57 57
WriteX 13912 498 512 512
WriteX 13912 472 512 512
WriteX 13912 462 512 512
WriteX 13912 466 512 512
WriteX 13912 978 512 512
Flush 13912
WriteX 13912 498 512 512
Flush 13912
Close 13912
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13913
QUERY_FILE_INFORMATION 13913
ReadX 13913 0 512 512
ReadX 13913 464 512 512
ReadX 13913 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 13914
ReadX 13914 0 20 20
ReadX 13914 14 40 40
ReadX 13914 54 64 64
ReadX 13914 118 1152 1152
Close 13914
Close 13913
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13915
Close 13915
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13916
ReadX 13916 0 24 24
Close 13916
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13917
QUERY_FILE_INFORMATION 13917
ReadX 13917 0 512 512
ReadX 13917 464 512 512
ReadX 13917 498 512 512
ReadX 13917 472 512 512
ReadX 13917 462 512 512
ReadX 13917 466 512 512
ReadX 13917 978 512 512
ReadX 13917 497 57 57
Close 13917
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13918
QUERY_FILE_INFORMATION 13918
ReadX 13918 0 512 512
ReadX 13918 464 512 512
ReadX 13918 498 512 512
ReadX 13918 472 512 512
ReadX 13918 468 512 512
ReadX 13918 462 512 512
ReadX 13918 466 512 512
QUERY_FILE_INFORMATION 13918
WriteX 13918 482 60 60
WriteX 13918 482 4 4
QUERY_FILE_INFORMATION 13918
WriteX 13918 482 11 11
WriteX 13918 498 512 512
WriteX 13918 472 512 512
WriteX 13918 462 512 512
WriteX 13918 466 512 512
WriteX 13918 978 512 512
Close 13918
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 13919
Close 13919
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13920
Close 13920
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13922
WriteX 13922 4607 1 1
QUERY_FILE_INFORMATION 13922
WriteX 13922 0 65471 65471
WriteX 13922 65471 65 65
WriteX 13922 65536 17654 17654
Close 13922
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13923
QUERY_FILE_INFORMATION 13923
ReadX 13923 0 512 512
ReadX 13923 474 512 512
ReadX 13923 986 512 512
ReadX 13923 1498 512 512
ReadX 13923 472 512 512
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
WriteX 13923 482 448 448
QUERY_FILE_INFORMATION 13923
WriteX 13923 482 60 60
WriteX 13923 482 4 4
QUERY_FILE_INFORMATION 13923
WriteX 13923 482 11 11
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
WriteX 13923 476 512 512
WriteX 13923 988 512 512
WriteX 13923 1500 512 512
WriteX 13923 474 512 512
WriteX 13923 0 512 512
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
ReadX 13923 482 512 512
WriteX 13923 494 512 512
WriteX 13923 494 292 292
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
WriteX 13923 495 20 20
WriteX 13923 495 108 108
QUERY_FILE_INFORMATION 13923
WriteX 13923 496 448 448
QUERY_FILE_INFORMATION 13923
WriteX 13923 496 44 44
WriteX 13923 496 20 20
WriteX 13923 492 512 512
WriteX 13923 484 512 512
WriteX 13923 488 512 512
WriteX 13923 1000 512 512
WriteX 13923 486 512 512
Flush 13923
WriteX 13923 0 512 512
Flush 13923
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
WriteX 13923 492 512 512
WriteX 13923 484 512 512
WriteX 13923 488 512 512
QUERY_FILE_INFORMATION 13923
WriteX 13923 508 320 320
QUERY_FILE_INFORMATION 13923
WriteX 13923 508 60 60
ReadX 13923 496 512 512
WriteX 13923 512 512 512
WriteX 13923 482 512 512
WriteX 13923 498 2692 2692
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
WriteX 13923 509 25 25
WriteX 13923 508 103 103
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
WriteX 13923 509 44 44
WriteX 13923 509 20 20
WriteX 13923 510 512 512
WriteX 13923 474 512 512
WriteX 13923 478 512 512
WriteX 13923 990 512 512
WriteX 13923 476 512 512
Flush 13923
WriteX 13923 0 512 512
Flush 13923
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
QUERY_FILE_INFORMATION 13923
WriteX 13923 509 7 7
WriteX 13923 509 57 57
WriteX 13923 510 512 512
WriteX 13923 484 512 512
WriteX 13923 474 512 512
WriteX 13923 478 512 512
WriteX 13923 990 512 512
Flush 13923
WriteX 13923 510 512 512
Flush 13923
Close 13923
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13924
Close 13924
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13925
QUERY_FILE_INFORMATION 13925
ReadX 13925 0 512 512
ReadX 13925 476 512 512
ReadX 13925 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 13926
Close 13926
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 13927
QUERY_FILE_INFORMATION 13927
ReadX 13927 0 512 512
ReadX 13927 512 512 512
ReadX 13927 770 512 512
ReadX 13927 1282 512 512
ReadX 13927 1794 512 512
ReadX 13927 2562 512 512
ReadX 13927 3586 512 512
ReadX 13927 3828 512 512
ReadX 13927 288 512 512
ReadX 13927 1024 512 512
ReadX 13927 954 512 512
ReadX 13927 295 512 512
ReadX 13927 320 512 512
ReadX 13927 322 512 512
ReadX 13927 834 512 512
ReadX 13927 1346 512 512
ReadX 13927 1858 512 512
ReadX 13927 323 512 512
ReadX 13927 835 512 512
ReadX 13927 1347 512 512
ReadX 13927 1859 512 512
ReadX 13927 2371 345 345
ReadX 13927 322 167 167
ReadX 13927 489 512 512
ReadX 13927 1001 512 512
ReadX 13927 1513 512 512
ReadX 13927 2025 512 512
ReadX 13927 2537 512 512
ReadX 13927 3049 512 512
ReadX 13927 3561 345 345
ReadX 13927 323 167 167
ReadX 13927 490 512 512
ReadX 13927 1002 512 512
ReadX 13927 1514 512 512
ReadX 13927 2026 512 512
ReadX 13927 2538 512 512
ReadX 13927 3050 512 512
ReadX 13927 3562 512 512
ReadX 13927 4074 512 512
ReadX 13927 4586 512 512
ReadX 13927 5098 512 512
ReadX 13927 5610 512 512
ReadX 13927 6122 512 512
ReadX 13927 6634 512 512
ReadX 13927 7146 512 512
ReadX 13927 7658 512 512
ReadX 13927 8170 512 512
ReadX 13927 8682 512 512
ReadX 13927 9194 512 512
ReadX 13927 9706 512 512
ReadX 13927 10218 512 512
ReadX 13927 10730 345 345
ReadX 13927 11075 512 512
ReadX 13927 11587 167 167
ReadX 13927 11754 512 512
ReadX 13927 12266 512 512
ReadX 13927 12778 512 512
ReadX 13927 13290 512 512
ReadX 13927 13802 512 512
ReadX 13927 14314 512 512
ReadX 13927 14826 512 512
ReadX 13927 15338 512 512
ReadX 13927 337 512 512
ReadX 13927 337 512 512
ReadX 13927 849 34 34
ReadX 13927 352 512 512
ReadX 13927 864 512 512
ReadX 13927 1376 512 512
ReadX 13927 1888 512 512
ReadX 13927 2400 512 512
ReadX 13927 2912 512 512
ReadX 13927 3424 512 512
ReadX 13927 3936 512 512
ReadX 13927 1632 512 512
ReadX 13927 2144 512 512
ReadX 13927 1682 512 512
ReadX 13927 258 512 512
ReadX 13927 360 144 144
ReadX 13927 2517 512 512
ReadX 13927 3029 512 512
ReadX 13927 1751 512 512
ReadX 13927 2263 512 512
ReadX 13927 2775 512 512
ReadX 13927 3287 512 512
ReadX 13927 3799 512 512
ReadX 13927 4311 512 512
ReadX 13927 4823 512 512
ReadX 13927 5335 512 512
ReadX 13927 5847 512 512
ReadX 13927 6359 512 512
ReadX 13927 6871 512 512
ReadX 13927 7383 512 512
ReadX 13927 7895 512 512
ReadX 13927 8407 512 512
ReadX 13927 8919 512 512
ReadX 13927 9431 512 512
ReadX 13927 9943 512 512
ReadX 13927 10455 512 512
ReadX 13927 10967 512 512
ReadX 13927 11479 512 512
ReadX 13927 2556 512 512
ReadX 13927 3068 512 512
ReadX 13927 3580 512 512
ReadX 13927 4092 512 512
ReadX 13927 4604 512 512
ReadX 13927 5116 512 512
ReadX 13927 5628 512 512
ReadX 13927 6140 512 512
ReadX 13927 6652 512 512
ReadX 13927 7164 512 512
ReadX 13927 7676 512 512
ReadX 13927 8188 512 512
ReadX 13927 8700 512 512
ReadX 13927 9212 512 512
ReadX 13927 9724 512 512
ReadX 13927 10236 512 512
ReadX 13927 10748 512 512
ReadX 13927 11260 512 512
ReadX 13927 11772 512 512
ReadX 13927 12284 512 512
ReadX 13927 12796 49 49
ReadX 13927 260 463 463
ReadX 13927 723 512 512
ReadX 13927 1235 512 512
ReadX 13927 1747 512 512
ReadX 13927 2259 512 512
ReadX 13927 2771 512 512
ReadX 13927 3283 512 512
ReadX 13927 3795 512 512
ReadX 13927 4307 512 512
ReadX 13927 4819 512 512
ReadX 13927 5331 512 512
ReadX 13927 5843 512 512
ReadX 13927 6355 512 512
ReadX 13927 6867 512 512
ReadX 13927 7379 512 512
ReadX 13927 7891 512 512
ReadX 13927 8403 512 512
ReadX 13927 8915 512 512
ReadX 13927 9427 512 512
ReadX 13927 9939 512 512
ReadX 13927 10451 512 512
ReadX 13927 10963 402 402
ReadX 13927 593 240 240
ReadX 13927 2048 272 272
ReadX 13927 2320 512 512
ReadX 13927 2832 512 512
ReadX 13927 3344 512 512
ReadX 13927 3856 512 512
ReadX 13927 4368 512 512
ReadX 13927 4880 512 512
ReadX 13927 5392 240 240
ReadX 13927 608 272 272
ReadX 13927 880 512 512
ReadX 13927 1392 512 512
ReadX 13927 1904 512 512
ReadX 13927 2416 512 512
ReadX 13927 2928 512 512
ReadX 13927 3440 512 512
ReadX 13927 3952 512 512
ReadX 13927 4464 512 512
ReadX 13927 4976 512 512
ReadX 13927 5488 512 512
ReadX 13927 6000 512 512
ReadX 13927 6512 512 512
ReadX 13927 7024 512 512
ReadX 13927 7536 512 512
ReadX 13927 8048 512 512
ReadX 13927 8560 512 512
ReadX 13927 9072 512 512
ReadX 13927 9584 512 512
ReadX 13927 10096 512 512
ReadX 13927 1683 512 512
ReadX 13927 514 512 512
ReadX 13927 620 512 512
ReadX 13927 770 512 512
ReadX 13927 1282 512 512
ReadX 13927 1794 512 512
ReadX 13927 2000 512 512
ReadX 13927 1434 512 512
ReadX 13927 2050 512 512
ReadX 13927 2118 512 512
ReadX 13927 1715 512 512
ReadX 13927 1024 512 512
ReadX 13927 954 512 512
ReadX 13927 1880 512 512
ReadX 13927 1286 512 512
ReadX 13927 1510 512 512
ReadX 13927 2562 512 512
ReadX 13927 2610 512 512
ReadX 13927 3586 512 512
ReadX 13927 3812 512 512
ReadX 13927 3828 512 512
ReadX 13927 4046 512 512
ReadX 13927 4066 512 512
ReadX 13927 1747 512 512
ReadX 13927 1026 512 512
ReadX 13927 1538 512 512
ReadX 13927 514 512 512
ReadX 13927 751 512 512
ReadX 13927 1263 512 512
ReadX 13927 620 512 512
ReadX 13927 1132 512 512
ReadX 13927 1644 512 512
ReadX 13927 2156 512 512
ReadX 13927 2668 512 512
ReadX 13927 3180 512 512
ReadX 13927 3692 512 512
ReadX 13927 4204 394 394
ReadX 13927 606 118 118
ReadX 13927 724 512 512
ReadX 13927 1236 512 512
ReadX 13927 1748 512 512
ReadX 13927 2260 512 512
ReadX 13927 2772 512 512
ReadX 13927 3284 512 512
ReadX 13927 3796 394 394
ReadX 13927 636 118 118
ReadX 13927 754 512 512
ReadX 13927 1266 512 512
ReadX 13927 1778 512 512
ReadX 13927 2290 512 512
ReadX 13927 2802 512 512
ReadX 13927 3314 512 512
ReadX 13927 3826 512 512
ReadX 13927 4338 512 512
ReadX 13927 4850 512 512
ReadX 13927 5362 512 512
ReadX 13927 5874 512 512
ReadX 13927 6386 512 512
ReadX 13927 6898 512 512
ReadX 13927 7410 512 512
ReadX 13927 7922 512 512
ReadX 13927 8434 512 512
ReadX 13927 8946 512 512
ReadX 13927 9458 512 512
ReadX 13927 9970 512 512
ReadX 13927 10482 512 512
ReadX 13927 723 512 512
ReadX 13927 1235 512 512
ReadX 13927 725 512 512
ReadX 13927 729 512 512
ReadX 13927 1241 512 512
ReadX 13927 1753 512 512
ReadX 13927 2265 512 512
ReadX 13927 2777 512 512
ReadX 13927 3289 512 512
ReadX 13927 3801 512 512
ReadX 13927 4313 512 512
ReadX 13927 4825 512 512
ReadX 13927 5337 512 512
ReadX 13927 5849 512 512
ReadX 13927 6361 512 512
ReadX 13927 755 512 512
ReadX 13927 1267 512 512
ReadX 13927 1779 512 512
ReadX 13927 2291 512 512
ReadX 13927 2803 512 512
ReadX 13927 3315 512 512
ReadX 13927 3827 512 512
ReadX 13927 4339 244 244
ReadX 13927 4583 512 512
ReadX 13927 5095 268 268
ReadX 13927 5363 512 512
ReadX 13927 5875 512 512
ReadX 13927 6387 512 512
ReadX 13927 6899 512 512
ReadX 13927 7411 512 512
ReadX 13927 7923 512 512
ReadX 13927 8435 512 512
ReadX 13927 8947 512 512
ReadX 13927 9459 512 512
ReadX 13927 9971 512 512
ReadX 13927 10483 512 512
ReadX 13927 10995 512 512
ReadX 13927 11507 512 512
ReadX 13927 12019 512 512
ReadX 13927 12531 512 512
ReadX 13927 13043 512 512
ReadX 13927 13555 512 512
ReadX 13927 14067 512 512
ReadX 13927 14579 512 512
ReadX 13927 15091 512 512
ReadX 13927 15603 342 342
ReadX 13927 725 512 512
ReadX 13927 2000 512 512
ReadX 13927 3918 512 512
ReadX 13927 727 512 512
ReadX 13927 258 512 512
ReadX 13927 376 512 512
ReadX 13927 1109 512 512
ReadX 13927 1028 512 512
ReadX 13927 1540 512 512
ReadX 13927 2052 512 512
ReadX 13927 2564 512 512
ReadX 13927 3076 512 512
ReadX 13927 3588 512 512
ReadX 13927 4100 512 512
ReadX 13927 4612 412 412
ReadX 13927 1012 100 100
ReadX 13927 1112 512 512
ReadX 13927 1624 512 512
ReadX 13927 2136 512 512
ReadX 13927 2648 512 512
ReadX 13927 3160 512 512
ReadX 13927 3672 512 512
ReadX 13927 4184 412 412
ReadX 13927 1044 100 100
ReadX 13927 1144 512 512
ReadX 13927 1656 512 512
ReadX 13927 2168 512 512
ReadX 13927 2680 512 512
ReadX 13927 3192 512 512
ReadX 13927 3704 512 512
ReadX 13927 4216 512 512
ReadX 13927 4728 512 512
ReadX 13927 5240 512 512
ReadX 13927 5752 512 512
ReadX 13927 6264 512 512
ReadX 13927 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 13927 7288 512 512
ReadX 13927 7800 512 512
ReadX 13927 8312 512 512
ReadX 13927 8824 512 512
ReadX 13927 9336 512 512
ReadX 13927 9848 512 512
ReadX 13927 10360 512 512
ReadX 13927 10872 512 512
ReadX 13927 11384 512 512
ReadX 13927 11896 512 512
ReadX 13927 12408 512 512
ReadX 13927 1088 512 512
ReadX 13927 1600 512 512
ReadX 13927 1090 512 512
ReadX 13927 1094 512 512
ReadX 13927 1606 512 512
ReadX 13927 2118 512 512
ReadX 13927 2630 512 512
ReadX 13927 3142 512 512
ReadX 13927 3654 512 512
ReadX 13927 4166 512 512
ReadX 13927 4678 512 512
ReadX 13927 1111 512 512
ReadX 13927 1623 512 512
ReadX 13927 2135 512 512
ReadX 13927 2647 512 512
ReadX 13927 3159 512 512
ReadX 13927 3671 512 512
ReadX 13927 4183 512 512
ReadX 13927 4695 512 512
ReadX 13927 5207 512 512
ReadX 13927 5719 512 512
ReadX 13927 6231 512 512
ReadX 13927 6743 512 512
ReadX 13927 7255 512 512
ReadX 13927 7767 512 512
ReadX 13927 8279 512 512
ReadX 13927 8791 512 512
ReadX 13927 9303 512 512
ReadX 13927 9815 512 512
ReadX 13927 10327 512 512
ReadX 13927 10839 512 512
ReadX 13927 11351 294 294
ReadX 13927 1091 512 512
ReadX 13927 970 512 512
ReadX 13927 1093 512 512
ReadX 13927 1434 512 512
ReadX 13927 2050 512 512
ReadX 13927 2158 512 512
ReadX 13927 2118 512 512
ReadX 13927 2630 512 512
ReadX 13927 3142 512 512
ReadX 13927 3654 512 512
ReadX 13927 4166 512 512
ReadX 13927 4678 512 512
ReadX 13927 5190 512 512
ReadX 13927 5702 382 382
ReadX 13927 2104 130 130
ReadX 13927 2234 512 512
ReadX 13927 2746 512 512
ReadX 13927 3258 512 512
ReadX 13927 3770 512 512
ReadX 13927 4282 512 512
ReadX 13927 4794 512 512
ReadX 13927 5306 382 382
ReadX 13927 2134 130 130
ReadX 13927 2264 512 512
ReadX 13927 2776 512 512
ReadX 13927 3288 512 512
ReadX 13927 3800 512 512
ReadX 13927 4312 512 512
ReadX 13927 4824 512 512
ReadX 13927 5336 512 512
ReadX 13927 2147 512 512
ReadX 13927 2149 512 512
ReadX 13927 2152 512 512
ReadX 13927 2664 512 512
ReadX 13927 3176 512 512
ReadX 13927 3688 512 512
ReadX 13927 2159 512 512
ReadX 13927 2671 512 512
ReadX 13927 3183 512 512
ReadX 13927 3695 512 512
ReadX 13927 4207 512 512
ReadX 13927 4719 512 512
ReadX 13927 5231 512 512
ReadX 13927 5743 512 512
ReadX 13927 6255 512 512
ReadX 13927 6767 512 512
ReadX 13927 7279 512 512
ReadX 13927 7791 512 512
ReadX 13927 8303 512 512
ReadX 13927 8815 512 512
ReadX 13927 9327 512 512
ReadX 13927 9839 512 512
ReadX 13927 10351 512 512
ReadX 13927 10863 512 512
ReadX 13927 11375 512 512
ReadX 13927 11887 512 512
ReadX 13927 12399 38 38
ReadX 13927 2149 512 512
ReadX 13927 1794 512 512
ReadX 13927 2016 512 512
ReadX 13927 2151 512 512
ReadX 13927 1918 512 512
ReadX 13927 1880 512 512
ReadX 13927 2392 512 512
ReadX 13927 2904 512 512
ReadX 13927 3416 512 512
ReadX 13927 3928 512 512
ReadX 13927 4440 512 512
ReadX 13927 4952 512 512
ReadX 13927 5464 416 416
ReadX 13927 1866 96 96
ReadX 13927 1962 512 512
ReadX 13927 2474 512 512
ReadX 13927 2986 512 512
ReadX 13927 3498 512 512
ReadX 13927 4010 512 512
ReadX 13927 4522 512 512
ReadX 13927 5034 416 416
ReadX 13927 1896 96 96
ReadX 13927 1992 512 512
ReadX 13927 2504 512 512
ReadX 13927 3016 512 512
ReadX 13927 3528 512 512
ReadX 13927 1903 512 512
ReadX 13927 1905 512 512
ReadX 13927 1908 512 512
ReadX 13927 2420 512 512
ReadX 13927 2932 512 512
ReadX 13927 3444 512 512
ReadX 13927 3956 512 512
ReadX 13927 1919 512 512
ReadX 13927 2431 512 512
ReadX 13927 2943 512 512
ReadX 13927 3455 512 512
ReadX 13927 3967 512 512
ReadX 13927 4479 512 512
ReadX 13927 4991 512 512
ReadX 13927 5503 512 512
ReadX 13927 6015 512 512
ReadX 13927 6527 512 512
ReadX 13927 7039 512 512
ReadX 13927 7551 512 512
ReadX 13927 8063 512 512
ReadX 13927 8575 512 512
ReadX 13927 9087 512 512
ReadX 13927 9599 512 512
ReadX 13927 10111 512 512
ReadX 13927 10623 512 512
ReadX 13927 11135 512 512
ReadX 13927 11647 512 512
ReadX 13927 12159 322 322
ReadX 13927 1905 512 512
ReadX 13927 1846 512 512
ReadX 13927 1907 512 512
ReadX 13927 1860 268 268
ReadX 13927 1832 244 244
ReadX 13927 1846 512 512
ReadX 13927 2358 512 512
ReadX 13927 2870 512 512
ReadX 13927 3382 512 512
ReadX 13927 3894 512 512
ReadX 13927 4406 512 512
ReadX 13927 4918 512 512
ReadX 13927 1858 512 512
ReadX 13927 1859 512 512
ReadX 13927 1860 488 488
ReadX 13927 1832 24 24
ReadX 13927 1861 228 228
ReadX 13927 1832 284 284
ReadX 13927 2116 512 512
ReadX 13927 2628 512 512
ReadX 13927 3140 512 512
ReadX 13927 3652 512 512
ReadX 13927 4164 512 512
ReadX 13927 4676 512 512
ReadX 13927 5188 228 228
ReadX 13927 1862 284 284
ReadX 13927 2146 512 512
ReadX 13927 2658 38 38
ReadX 13927 1859 512 512
ReadX 13927 2047 512 512
ReadX 13927 2016 512 512
ReadX 13927 2528 512 512
ReadX 13927 3040 512 512
ReadX 13927 3552 512 512
ReadX 13927 4064 512 512
ReadX 13927 4576 512 512
ReadX 13927 5088 512 512
ReadX 13927 5600 424 424
ReadX 13927 2002 88 88
ReadX 13927 2090 512 512
ReadX 13927 2602 512 512
ReadX 13927 3114 512 512
ReadX 13927 3626 512 512
ReadX 13927 4138 512 512
ReadX 13927 4650 512 512
ReadX 13927 5162 424 424
ReadX 13927 2032 88 88
ReadX 13927 2120 512 512
ReadX 13927 2632 512 512
ReadX 13927 3144 512 512
ReadX 13927 3656 512 512
ReadX 13927 4168 512 512
ReadX 13927 4680 512 512
ReadX 13927 5192 512 512
ReadX 13927 2044 512 512
ReadX 13927 2045 512 512
ReadX 13927 2046 512 512
ReadX 13927 2047 512 512
ReadX 13927 2559 110 110
ReadX 13927 2052 402 402
ReadX 13927 2454 512 512
ReadX 13927 2966 512 512
ReadX 13927 3478 512 512
ReadX 13927 3990 512 512
ReadX 13927 4502 512 512
ReadX 13927 5014 512 512
ReadX 13927 5526 512 512
ReadX 13927 6038 512 512
ReadX 13927 6550 512 512
ReadX 13927 7062 512 512
ReadX 13927 7574 512 512
ReadX 13927 8086 512 512
ReadX 13927 8598 512 512
ReadX 13927 9110 512 512
ReadX 13927 9622 512 512
ReadX 13927 10134 512 512
ReadX 13927 10646 512 512
ReadX 13927 11158 512 512
ReadX 13927 11670 512 512
ReadX 13927 12182 512 512
ReadX 13927 12694 118 118
ReadX 13927 2045 512 512
ReadX 13927 1282 512 512
ReadX 13927 1343 512 512
ReadX 13927 1286 512 512
ReadX 13927 1798 512 512
ReadX 13927 2310 512 512
ReadX 13927 2822 512 512
ReadX 13927 3334 512 512
ReadX 13927 3846 512 512
ReadX 13927 4358 512 512
ReadX 13927 4870 416 416
ReadX 13927 1270 96 96
ReadX 13927 1366 512 512
ReadX 13927 1878 512 512
ReadX 13927 2390 512 512
ReadX 13927 2902 512 512
ReadX 13927 3414 512 512
ReadX 13927 3926 416 416
ReadX 13927 1284 96 96
ReadX 13927 1380 416 416
ReadX 13927 1302 96 96
ReadX 13927 1398 512 512
ReadX 13927 1910 512 512
ReadX 13927 2422 512 512
ReadX 13927 2934 512 512
ReadX 13927 3446 512 512
ReadX 13927 3958 512 512
ReadX 13927 4470 512 512
ReadX 13927 4982 512 512
ReadX 13927 5494 512 512
ReadX 13927 6006 512 512
ReadX 13927 6518 512 512
ReadX 13927 7030 512 512
ReadX 13927 7542 512 512
ReadX 13927 1328 512 512
ReadX 13927 1330 512 512
ReadX 13927 1333 512 512
ReadX 13927 1845 512 512
ReadX 13927 2357 512 512
ReadX 13927 2869 512 512
ReadX 13927 3381 512 512
ReadX 13927 1344 512 512
ReadX 13927 1856 512 512
ReadX 13927 2368 512 512
ReadX 13927 2880 512 512
ReadX 13927 3392 512 512
ReadX 13927 3904 512 512
ReadX 13927 4416 512 512
ReadX 13927 4928 512 512
ReadX 13927 5440 512 512
ReadX 13927 5952 512 512
ReadX 13927 6464 512 512
ReadX 13927 6976 512 512
ReadX 13927 7488 512 512
ReadX 13927 8000 512 512
ReadX 13927 8512 512 512
ReadX 13927 9024 512 512
ReadX 13927 9536 512 512
ReadX 13927 10048 512 512
ReadX 13927 10560 512 512
ReadX 13927 11072 512 512
ReadX 13927 11584 426 426
ReadX 13927 1330 512 512
ReadX 13927 1842 512 512
ReadX 13927 1250 512 512
ReadX 13927 1264 268 268
ReadX 13927 1236 244 244
ReadX 13927 1250 512 512
ReadX 13927 1762 512 512
ReadX 13927 2274 512 512
ReadX 13927 2786 512 512
ReadX 13927 3298 512 512
ReadX 13927 3810 512 512
ReadX 13927 4322 512 512
ReadX 13927 1262 512 512
ReadX 13927 1263 512 512
ReadX 13927 1264 488 488
ReadX 13927 1236 24 24
ReadX 13927 1265 228 228
ReadX 13927 1236 284 284
ReadX 13927 1520 512 512
ReadX 13927 2032 512 512
ReadX 13927 2544 512 512
ReadX 13927 3056 512 512
ReadX 13927 3568 512 512
ReadX 13927 4080 512 512
ReadX 13927 4592 228 228
ReadX 13927 1266 284 284
ReadX 13927 1550 512 512
ReadX 13927 2062 42 42
ReadX 13927 1263 512 512
ReadX 13927 1538 512 512
ReadX 13927 1640 512 512
ReadX 13927 1510 512 512
ReadX 13927 2022 512 512
ReadX 13927 2534 512 512
ReadX 13927 3046 512 512
ReadX 13927 3558 512 512
ReadX 13927 4070 512 512
ReadX 13927 4582 512 512
ReadX 13927 5094 408 408
ReadX 13927 1496 104 104
ReadX 13927 1600 512 512
ReadX 13927 2112 512 512
ReadX 13927 2624 512 512
ReadX 13927 3136 512 512
ReadX 13927 3648 512 512
ReadX 13927 4160 512 512
ReadX 13927 4672 408 408
ReadX 13927 1526 104 104
ReadX 13927 1630 512 512
ReadX 13927 2142 512 512
ReadX 13927 2654 512 512
ReadX 13927 3166 512 512
ReadX 13927 3678 512 512
ReadX 13927 4190 408 408
ReadX 13927 1540 104 104
ReadX 13927 1644 512 512
ReadX 13927 2156 512 512
ReadX 13927 2668 512 512
ReadX 13927 3180 512 512
ReadX 13927 3692 512 512
ReadX 13927 4204 512 512
ReadX 13927 4716 512 512
ReadX 13927 5228 512 512
ReadX 13927 5740 512 512
ReadX 13927 6252 512 512
ReadX 13927 6764 512 512
ReadX 13927 7276 512 512
ReadX 13927 7788 512 512
ReadX 13927 8300 512 512
ReadX 13927 8812 512 512
ReadX 13927 9324 512 512
ReadX 13927 9836 512 512
ReadX 13927 10348 512 512
ReadX 13927 10860 512 512
ReadX 13927 11372 512 512
ReadX 13927 1615 512 512
ReadX 13927 2127 512 512
ReadX 13927 1617 512 512
ReadX 13927 1621 512 512
ReadX 13927 2133 512 512
ReadX 13927 2645 512 512
ReadX 13927 3157 512 512
ReadX 13927 3669 512 512
ReadX 13927 4181 512 512
ReadX 13927 4693 512 512
ReadX 13927 5205 512 512
ReadX 13927 5717 512 512
ReadX 13927 6229 512 512
ReadX 13927 1641 512 512
ReadX 13927 2153 512 512
ReadX 13927 2665 512 512
ReadX 13927 3177 512 512
ReadX 13927 3689 512 512
ReadX 13927 4201 512 512
ReadX 13927 4713 512 512
ReadX 13927 5225 512 512
ReadX 13927 5737 512 512
ReadX 13927 6249 512 512
ReadX 13927 6761 512 512
ReadX 13927 7273 512 512
ReadX 13927 7785 512 512
ReadX 13927 8297 512 512
ReadX 13927 8809 512 512
ReadX 13927 9321 512 512
ReadX 13927 9833 512 512
ReadX 13927 10345 512 512
ReadX 13927 10857 512 512
ReadX 13927 11369 512 512
ReadX 13927 11881 2 2
ReadX 13927 1796 510 510
ReadX 13927 2306 512 512
ReadX 13927 2818 512 512
ReadX 13927 3330 512 512
ReadX 13927 3842 512 512
ReadX 13927 4354 512 512
ReadX 13927 4866 512 512
ReadX 13927 5378 512 512
ReadX 13927 5890 512 512
ReadX 13927 6402 512 512
ReadX 13927 6914 512 512
ReadX 13927 7426 512 512
ReadX 13927 7938 512 512
ReadX 13927 8450 512 512
ReadX 13927 8962 512 512
ReadX 13927 9474 512 512
ReadX 13927 9986 512 512
ReadX 13927 10498 326 326
ReadX 13927 1617 512 512
ReadX 13927 2129 512 512
ReadX 13927 1450 512 512
ReadX 13927 1621 512 512
ReadX 13927 1446 512 512
ReadX 13927 1450 512 512
ReadX 13927 1962 512 512
ReadX 13927 2474 512 512
ReadX 13927 2986 512 512
ReadX 13927 3498 512 512
ReadX 13927 4010 512 512
ReadX 13927 4522 512 512
ReadX 13927 5034 424 424
ReadX 13927 1436 88 88
ReadX 13927 1524 512 512
ReadX 13927 2036 512 512
ReadX 13927 2548 512 512
ReadX 13927 3060 512 512
ReadX 13927 1442 512 512
ReadX 13927 1443 512 512
ReadX 13927 1444 512 512
ReadX 13927 1446 512 512
ReadX 13927 1958 386 386
ReadX 13927 1466 126 126
ReadX 13927 1592 512 512
ReadX 13927 2104 512 512
ReadX 13927 2616 512 512
ReadX 13927 3128 512 512
ReadX 13927 3640 512 512
ReadX 13927 4152 512 512
ReadX 13927 4664 512 512
ReadX 13927 5176 512 512
ReadX 13927 5688 512 512
ReadX 13927 6200 512 512
ReadX 13927 6712 512 512
ReadX 13927 7224 512 512
ReadX 13927 7736 512 512
ReadX 13927 8248 512 512
ReadX 13927 8760 294 294
ReadX 13927 1443 512 512
ReadX 13927 964 512 512
ReadX 13927 970 512 512
ReadX 13927 1482 512 512
ReadX 13927 1994 512 512
ReadX 13927 2506 512 512
ReadX 13927 3018 512 512
ReadX 13927 3530 512 512
ReadX 13927 4042 512 512
ReadX 13927 4554 424 424
ReadX 13927 956 88 88
ReadX 13927 1044 512 512
ReadX 13927 1556 512 512
ReadX 13927 2068 512 512
ReadX 13927 2580 512 512
ReadX 13927 962 512 512
ReadX 13927 963 512 512
ReadX 13927 964 512 512
ReadX 13927 965 512 512
ReadX 13927 1477 512 512
ReadX 13927 1989 228 228
ReadX 13927 986 284 284
ReadX 13927 1270 512 512
ReadX 13927 1782 512 512
ReadX 13927 2294 512 512
ReadX 13927 2806 512 512
ReadX 13927 3318 512 512
ReadX 13927 3830 512 512
ReadX 13927 4342 512 512
ReadX 13927 4854 512 512
ReadX 13927 5366 512 512
ReadX 13927 5878 512 512
ReadX 13927 6390 512 512
ReadX 13927 6902 512 512
ReadX 13927 7414 42 42
ReadX 13927 963 512 512
ReadX 13927 2610 512 512
ReadX 13927 3812 512 512
ReadX 13927 3828 512 512
ReadX 13927 3969 512 512
ReadX 13927 3918 512 512
ReadX 13927 4430 512 512
ReadX 13927 4942 512 512
ReadX 13927 5454 512 512
ReadX 13927 5966 512 512
ReadX 13927 6478 512 512
ReadX 13927 6990 512 512
ReadX 13927 7502 424 424
ReadX 13927 3904 88 88
ReadX 13927 3992 512 512
ReadX 13927 4504 512 512
ReadX 13927 5016 512 512
ReadX 13927 5528 512 512
ReadX 13927 6040 512 512
ReadX 13927 6552 512 512
ReadX 13927 7064 424 424
ReadX 13927 3934 88 88
ReadX 13927 4022 512 512
ReadX 13927 4534 512 512
ReadX 13927 5046 512 512
ReadX 13927 5558 512 512
ReadX 13927 6070 512 512
ReadX 13927 6582 512 512
ReadX 13927 7094 512 512
ReadX 13927 7606 512 512
ReadX 13927 8118 512 512
ReadX 13927 8630 512 512
ReadX 13927 3953 512 512
ReadX 13927 4465 512 512
ReadX 13927 3956 512 512
ReadX 13927 3964 512 512
ReadX 13927 4476 512 512
ReadX 13927 4988 512 512
ReadX 13927 3970 512 512
ReadX 13927 4482 512 512
ReadX 13927 4994 512 512
ReadX 13927 5506 512 512
ReadX 13927 6018 512 512
ReadX 13927 6530 512 512
ReadX 13927 7042 512 512
ReadX 13927 7554 512 512
ReadX 13927 8066 512 512
ReadX 13927 8578 512 512
ReadX 13927 9090 512 512
ReadX 13927 9602 512 512
ReadX 13927 10114 512 512
ReadX 13927 10626 512 512
ReadX 13927 11138 512 512
ReadX 13927 11650 512 512
ReadX 13927 12162 512 512
ReadX 13927 12674 512 512
ReadX 13927 13186 512 512
ReadX 13927 13698 512 512
ReadX 13927 14210 134 134
ReadX 13927 3956 512 512
ReadX 13927 4468 512 512
ReadX 13927 4980 512 512
ReadX 13927 5492 512 512
ReadX 13927 3074 512 512
ReadX 13927 3246 512 512
ReadX 13927 3964 512 512
ReadX 13927 3330 512 512
ReadX 13927 3465 512 512
ReadX 13927 3246 512 512
ReadX 13927 3758 512 512
ReadX 13927 4270 512 512
ReadX 13927 4782 512 512
ReadX 13927 5294 512 512
ReadX 13927 5806 512 512
ReadX 13927 6318 512 512
ReadX 13927 6830 368 368
ReadX 13927 3232 144 144
ReadX 13927 3376 512 512
ReadX 13927 3888 512 512
ReadX 13927 4400 512 512
ReadX 13927 4912 512 512
ReadX 13927 5424 512 512
ReadX 13927 5936 512 512
ReadX 13927 6448 368 368
ReadX 13927 3262 144 144
ReadX 13927 3406 512 512
ReadX 13927 3918 512 512
ReadX 13927 4430 512 512
ReadX 13927 4942 512 512
ReadX 13927 5454 512 512
ReadX 13927 5966 512 512
ReadX 13927 6478 512 512
ReadX 13927 6990 512 512
ReadX 13927 7502 512 512
ReadX 13927 8014 512 512
ReadX 13927 8526 512 512
ReadX 13927 9038 512 512
ReadX 13927 9550 512 512
ReadX 13927 10062 512 512
ReadX 13927 10574 512 512
ReadX 13927 11086 512 512
ReadX 13927 11598 512 512
ReadX 13927 12110 512 512
ReadX 13927 12622 512 512
ReadX 13927 13134 512 512
ReadX 13927 13646 368 368
ReadX 13927 3332 144 144
ReadX 13927 3476 512 512
ReadX 13927 3988 512 512
ReadX 13927 4500 512 512
ReadX 13927 5012 512 512
ReadX 13927 5524 512 512
ReadX 13927 6036 512 512
ReadX 13927 6548 512 512
ReadX 13927 7060 512 512
ReadX 13927 7572 512 512
ReadX 13927 8084 512 512
ReadX 13927 8596 512 512
ReadX 13927 9108 512 512
ReadX 13927 9620 512 512
ReadX 13927 10132 512 512
ReadX 13927 10644 512 512
ReadX 13927 11156 512 512
ReadX 13927 11668 512 512
ReadX 13927 12180 512 512
ReadX 13927 12692 512 512
ReadX 13927 13204 512 512
ReadX 13927 3430 512 512
ReadX 13927 3942 512 512
ReadX 13927 3434 512 512
ReadX 13927 3435 512 512
ReadX 13927 3947 512 512
ReadX 13927 4459 512 512
ReadX 13927 4971 512 512
ReadX 13927 5483 512 512
ReadX 13927 5995 512 512
ReadX 13927 6507 512 512
ReadX 13927 7019 512 512
ReadX 13927 7531 512 512
ReadX 13927 8043 512 512
ReadX 13927 8555 512 512
ReadX 13927 9067 512 512
ReadX 13927 9579 512 512
ReadX 13927 10091 512 512
ReadX 13927 10603 512 512
ReadX 13927 11115 512 512
ReadX 13927 3467 512 512
ReadX 13927 3979 512 512
ReadX 13927 4491 512 512
ReadX 13927 5003 512 512
ReadX 13927 5515 512 512
ReadX 13927 6027 512 512
ReadX 13927 6539 512 512
ReadX 13927 7051 512 512
ReadX 13927 7563 512 512
ReadX 13927 8075 512 512
ReadX 13927 8587 512 512
ReadX 13927 9099 512 512
ReadX 13927 9611 512 512
ReadX 13927 10123 512 512
ReadX 13927 10635 512 512
ReadX 13927 11147 512 512
ReadX 13927 11659 512 512
ReadX 13927 12171 512 512
ReadX 13927 12683 512 512
ReadX 13927 13195 512 512
ReadX 13927 13707 56 56
ReadX 13927 13763 512 512
ReadX 13927 14275 456 456
ReadX 13927 14731 512 512
ReadX 13927 15243 512 512
ReadX 13927 15755 512 512
ReadX 13927 16267 512 512
ReadX 13927 16779 512 512
ReadX 13927 17291 512 512
ReadX 13927 17803 512 512
ReadX 13927 18315 512 512
ReadX 13927 18827 512 512
ReadX 13927 19339 512 512
ReadX 13927 19851 512 512
ReadX 13927 20363 512 512
ReadX 13927 20875 512 512
ReadX 13927 21387 512 512
ReadX 13927 21899 512 512
ReadX 13927 22411 512 512
ReadX 13927 22923 512 512
ReadX 13927 23435 512 512
ReadX 13927 23947 512 512
ReadX 13927 24459 512 512
ReadX 13927 24971 282 282
ReadX 13927 3434 512 512
ReadX 13927 2818 512 512
ReadX 13927 2870 512 512
ReadX 13927 3026 512 512
ReadX 13927 3538 512 512
ReadX 13927 2870 512 512
ReadX 13927 3382 512 512
ReadX 13927 3894 512 512
ReadX 13927 4406 512 512
ReadX 13927 4918 512 512
ReadX 13927 5430 512 512
ReadX 13927 5942 512 512
ReadX 13927 6454 374 374
ReadX 13927 2856 138 138
ReadX 13927 2994 512 512
ReadX 13927 3506 512 512
ReadX 13927 4018 512 512
ReadX 13927 4530 512 512
ReadX 13927 5042 512 512
ReadX 13927 5554 512 512
ReadX 13927 6066 374 374
ReadX 13927 2886 138 138
ReadX 13927 3024 512 512
ReadX 13927 3536 512 512
ReadX 13927 4048 512 512
ReadX 13927 4560 512 512
ReadX 13927 5072 512 512
ReadX 13927 5584 512 512
ReadX 13927 6096 512 512
ReadX 13927 6608 512 512
ReadX 13927 7120 512 512
ReadX 13927 7632 512 512
ReadX 13927 8144 512 512
ReadX 13927 8656 512 512
ReadX 13927 9168 512 512
ReadX 13927 9680 512 512
ReadX 13927 10192 512 512
ReadX 13927 10704 512 512
ReadX 13927 11216 512 512
ReadX 13927 11728 512 512
ReadX 13927 12240 512 512
ReadX 13927 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 13927 13264 512 512
ReadX 13927 13776 512 512
ReadX 13927 14288 512 512
ReadX 13927 14800 512 512
ReadX 13927 15312 512 512
ReadX 13927 15824 512 512
ReadX 13927 16336 512 512
ReadX 13927 16848 512 512
ReadX 13927 17360 512 512
ReadX 13927 17872 512 512
ReadX 13927 18384 512 512
ReadX 13927 18896 512 512
ReadX 13927 19408 512 512
ReadX 13927 19920 512 512
ReadX 13927 20432 512 512
ReadX 13927 20944 512 512
ReadX 13927 21456 512 512
ReadX 13927 21968 512 512
ReadX 13927 22480 512 512
ReadX 13927 22992 512 512
ReadX 13927 2998 512 512
ReadX 13927 3510 512 512
ReadX 13927 3001 512 512
ReadX 13927 3003 512 512
ReadX 13927 3515 512 512
ReadX 13927 4027 512 512
ReadX 13927 4539 512 512
ReadX 13927 5051 512 512
ReadX 13927 5563 512 512
ReadX 13927 6075 512 512
ReadX 13927 6587 512 512
ReadX 13927 7099 512 512
ReadX 13927 7611 512 512
ReadX 13927 8123 512 512
ReadX 13927 8635 512 512
ReadX 13927 3029 512 512
ReadX 13927 3541 512 512
ReadX 13927 4053 512 512
ReadX 13927 4565 512 512
ReadX 13927 5077 512 512
ReadX 13927 5589 512 512
ReadX 13927 6101 512 512
ReadX 13927 6613 512 512
ReadX 13927 7125 512 512
ReadX 13927 7637 512 512
ReadX 13927 8149 512 512
ReadX 13927 8661 512 512
ReadX 13927 9173 512 512
ReadX 13927 9685 512 512
ReadX 13927 10197 512 512
ReadX 13927 10709 512 512
ReadX 13927 11221 512 512
ReadX 13927 11733 512 512
ReadX 13927 12245 512 512
ReadX 13927 12757 512 512
ReadX 13927 13269 40 40
ReadX 13927 3076 472 472
ReadX 13927 3548 512 512
ReadX 13927 4060 512 512
ReadX 13927 4572 512 512
ReadX 13927 5084 512 512
ReadX 13927 5596 512 512
ReadX 13927 6108 512 512
ReadX 13927 6620 512 512
ReadX 13927 7132 512 512
ReadX 13927 7644 512 512
ReadX 13927 8156 512 512
ReadX 13927 8668 512 512
ReadX 13927 9180 512 512
ReadX 13927 9692 512 512
ReadX 13927 10204 512 512
ReadX 13927 10716 512 512
ReadX 13927 11228 512 512
ReadX 13927 11740 512 512
ReadX 13927 12252 512 512
ReadX 13927 12764 512 512
ReadX 13927 13276 310 310
ReadX 13927 3001 512 512
ReadX 13927 2562 512 512
ReadX 13927 2626 512 512
ReadX 13927 3003 512 512
ReadX 13927 2721 512 512
ReadX 13927 2626 512 512
ReadX 13927 3138 512 512
ReadX 13927 3650 512 512
ReadX 13927 4162 512 512
ReadX 13927 4674 512 512
ReadX 13927 5186 512 512
ReadX 13927 5698 512 512
ReadX 13927 6210 424 424
ReadX 13927 2612 88 88
ReadX 13927 2700 512 512
ReadX 13927 3212 512 512
ReadX 13927 3724 512 512
ReadX 13927 4236 512 512
ReadX 13927 4748 512 512
ReadX 13927 5260 512 512
ReadX 13927 5772 424 424
ReadX 13927 2642 88 88
ReadX 13927 2730 512 512
ReadX 13927 3242 512 512
ReadX 13927 3754 512 512
ReadX 13927 4266 512 512
ReadX 13927 4778 512 512
ReadX 13927 5290 512 512
ReadX 13927 5802 512 512
ReadX 13927 6314 512 512
ReadX 13927 6826 512 512
ReadX 13927 7338 512 512
ReadX 13927 7850 512 512
ReadX 13927 8362 512 512
ReadX 13927 8874 512 512
ReadX 13927 9386 512 512
ReadX 13927 9898 512 512
ReadX 13927 10410 512 512
ReadX 13927 10922 512 512
ReadX 13927 11434 512 512
ReadX 13927 11946 512 512
ReadX 13927 12458 512 512
ReadX 13927 2716 512 512
ReadX 13927 2717 512 512
ReadX 13927 2718 512 512
ReadX 13927 3230 512 512
ReadX 13927 2721 512 512
ReadX 13927 3233 512 512
ReadX 13927 3745 512 512
ReadX 13927 4257 512 512
ReadX 13927 4769 512 512
ReadX 13927 5281 512 512
ReadX 13927 5793 512 512
ReadX 13927 6305 512 512
ReadX 13927 6817 512 512
ReadX 13927 7329 512 512
ReadX 13927 7841 512 512
ReadX 13927 8353 512 512
ReadX 13927 8865 512 512
ReadX 13927 9377 512 512
ReadX 13927 9889 512 512
ReadX 13927 10401 512 512
ReadX 13927 10913 512 512
ReadX 13927 11425 512 512
ReadX 13927 11937 512 512
ReadX 13927 12449 512 512
ReadX 13927 12961 512 512
ReadX 13927 13473 512 512
ReadX 13927 13985 106 106
ReadX 13927 2820 406 406
ReadX 13927 3226 512 512
ReadX 13927 3738 512 512
ReadX 13927 4250 512 512
ReadX 13927 4762 512 512
ReadX 13927 5274 512 512
ReadX 13927 5786 512 512
ReadX 13927 6298 512 512
ReadX 13927 6810 512 512
ReadX 13927 7322 512 512
ReadX 13927 7834 512 512
ReadX 13927 8346 512 512
ReadX 13927 8858 512 512
ReadX 13927 9370 512 512
ReadX 13927 9882 512 512
ReadX 13927 10394 512 512
ReadX 13927 10906 512 512
ReadX 13927 11418 182 182
ReadX 13927 2717 512 512
ReadX 13927 258 512 512
ReadX 13927 470 512 512
ReadX 13927 376 512 512
ReadX 13927 888 512 512
ReadX 13927 1400 512 512
ReadX 13927 1912 512 512
ReadX 13927 2424 512 512
ReadX 13927 2936 512 512
ReadX 13927 3448 512 512
ReadX 13927 3960 424 424
ReadX 13927 362 88 88
ReadX 13927 450 512 512
ReadX 13927 962 512 512
ReadX 13927 1474 512 512
ReadX 13927 1986 512 512
ReadX 13927 2498 512 512
ReadX 13927 3010 512 512
ReadX 13927 3522 424 424
ReadX 13927 392 88 88
ReadX 13927 480 512 512
ReadX 13927 992 512 512
ReadX 13927 1504 512 512
ReadX 13927 2016 512 512
ReadX 13927 2528 512 512
ReadX 13927 3040 512 512
ReadX 13927 3552 512 512
ReadX 13927 4064 512 512
ReadX 13927 4576 512 512
ReadX 13927 5088 512 512
ReadX 13927 5600 512 512
ReadX 13927 6112 512 512
ReadX 13927 6624 512 512
ReadX 13927 7136 512 512
ReadX 13927 7648 512 512
ReadX 13927 8160 512 512
ReadX 13927 8672 512 512
ReadX 13927 9184 512 512
ReadX 13927 9696 512 512
ReadX 13927 10208 512 512
ReadX 13927 464 512 512
ReadX 13927 465 512 512
ReadX 13927 466 512 512
ReadX 13927 978 512 512
ReadX 13927 470 512 512
ReadX 13927 982 512 512
ReadX 13927 1494 512 512
ReadX 13927 2006 512 512
ReadX 13927 2518 512 512
ReadX 13927 3030 512 512
ReadX 13927 3542 512 512
ReadX 13927 4054 512 512
ReadX 13927 4566 512 512
ReadX 13927 5078 512 512
ReadX 13927 5590 512 512
ReadX 13927 6102 512 512
ReadX 13927 6614 512 512
ReadX 13927 7126 512 512
ReadX 13927 7638 512 512
ReadX 13927 8150 512 512
ReadX 13927 8662 512 512
ReadX 13927 9174 512 512
ReadX 13927 9686 512 512
ReadX 13927 10198 512 512
ReadX 13927 10710 333 333
ReadX 13927 11043 512 512
ReadX 13927 11555 179 179
ReadX 13927 11734 512 512
ReadX 13927 12246 512 512
ReadX 13927 12758 512 512
ReadX 13927 13270 512 512
ReadX 13927 13782 512 512
ReadX 13927 14294 512 512
ReadX 13927 14806 512 512
ReadX 13927 15318 512 512
ReadX 13927 15830 512 512
ReadX 13927 16342 512 512
ReadX 13927 16854 512 512
ReadX 13927 17366 512 512
ReadX 13927 17878 512 512
ReadX 13927 18390 512 512
ReadX 13927 18902 512 512
ReadX 13927 19414 512 512
ReadX 13927 19926 512 512
ReadX 13927 20438 512 512
ReadX 13927 20950 512 512
ReadX 13927 21462 512 512
ReadX 13927 21974 350 350
ReadX 13927 465 512 512
ReadX 13927 3812 512 512
ReadX 13927 4046 512 512
ReadX 13927 3828 512 512
ReadX 13927 256 512 512
ReadX 13927 260 512 512
ReadX 13927 4066 512 512
ReadX 13927 4578 512 512
ReadX 13927 5090 512 512
ReadX 13927 5602 512 512
ReadX 13927 6114 512 512
ReadX 13927 6626 512 512
ReadX 13927 7138 512 512
ReadX 13927 7650 394 394
ReadX 13927 4052 118 118
ReadX 13927 4170 512 512
ReadX 13927 4682 512 512
ReadX 13927 5194 512 512
ReadX 13927 5706 512 512
ReadX 13927 6218 512 512
ReadX 13927 6730 512 512
ReadX 13927 7242 394 394
ReadX 13927 4082 118 118
ReadX 13927 4200 512 512
ReadX 13927 4712 512 512
ReadX 13927 5224 512 512
ReadX 13927 5736 512 512
ReadX 13927 6248 512 512
ReadX 13927 6760 512 512
ReadX 13927 7272 512 512
ReadX 13927 7784 394 394
ReadX 13927 256 118 118
ReadX 13927 374 512 512
ReadX 13927 886 512 512
ReadX 13927 1398 512 512
ReadX 13927 1910 512 512
ReadX 13927 2422 512 512
ReadX 13927 2934 512 512
ReadX 13927 3446 512 512
ReadX 13927 3958 512 512
ReadX 13927 4470 512 512
ReadX 13927 4982 512 512
ReadX 13927 5494 512 512
ReadX 13927 6006 512 512
ReadX 13927 6518 512 512
ReadX 13927 7030 512 512
ReadX 13927 7542 512 512
ReadX 13927 8054 512 512
ReadX 13927 8566 512 512
ReadX 13927 9078 512 512
ReadX 13927 9590 512 512
ReadX 13927 10102 512 512
ReadX 13927 259 512 512
ReadX 13927 771 512 512
ReadX 13927 259 512 512
ReadX 13927 259 512 512
ReadX 13927 771 512 512
ReadX 13927 1283 512 512
ReadX 13927 1795 512 512
ReadX 13927 2307 512 512
ReadX 13927 2819 512 512
ReadX 13927 3331 512 512
ReadX 13927 3843 512 512
ReadX 13927 4355 512 512
ReadX 13927 4867 512 512
ReadX 13927 260 512 512
ReadX 13927 772 512 512
ReadX 13927 1284 512 512
ReadX 13927 1796 512 512
ReadX 13927 2308 512 512
ReadX 13927 2820 512 512
ReadX 13927 3332 512 512
ReadX 13927 3844 512 512
ReadX 13927 4356 512 512
ReadX 13927 4868 512 512
ReadX 13927 5380 512 512
ReadX 13927 5892 512 512
ReadX 13927 6404 512 512
ReadX 13927 6916 512 512
ReadX 13927 7428 512 512
ReadX 13927 7940 512 512
ReadX 13927 8452 512 512
ReadX 13927 8964 512 512
ReadX 13927 9476 512 512
ReadX 13927 9988 512 512
ReadX 13927 10500 378 378
ReadX 13927 10878 512 512
ReadX 13927 11390 134 134
ReadX 13927 11524 512 512
ReadX 13927 12036 512 512
ReadX 13927 12548 512 512
ReadX 13927 13060 512 512
ReadX 13927 13572 138 138
ReadX 13927 259 512 512
ReadX 13927 273 512 512
ReadX 13927 276 512 512
ReadX 13927 295 512 512
ReadX 13927 288 512 512
ReadX 13927 296 512 512
ReadX 13927 259 512 512
ReadX 13927 273 512 512
ReadX 13927 273 512 512
ReadX 13927 785 512 512
ReadX 13927 1297 512 512
ReadX 13927 1809 512 512
ReadX 13927 2321 512 512
ReadX 13927 274 512 512
ReadX 13927 274 512 512
ReadX 13927 274 497 497
ReadX 13927 272 15 15
ReadX 13927 287 512 512
ReadX 13927 799 512 512
ReadX 13927 273 512 512
ReadX 13927 785 512 512
ReadX 13927 1297 512 512
ReadX 13927 1809 512 512
ReadX 13927 2321 512 512
ReadX 13927 2833 317 317
ReadX 13927 274 195 195
ReadX 13927 469 512 512
ReadX 13927 981 512 512
ReadX 13927 1493 512 512
ReadX 13927 2005 512 512
ReadX 13927 2517 512 512
ReadX 13927 3029 512 512
ReadX 13927 3541 512 512
ReadX 13927 4053 512 512
ReadX 13927 4565 250 250
ReadX 13927 274 512 512
ReadX 13927 283 512 512
ReadX 13927 795 512 512
ReadX 13927 276 512 512
ReadX 13927 788 512 512
ReadX 13927 1300 512 512
ReadX 13927 1812 512 512
ReadX 13927 2324 512 512
ReadX 13927 2836 512 512
ReadX 13927 3348 512 512
ReadX 13927 3860 420 420
ReadX 13927 275 92 92
ReadX 13927 367 512 512
ReadX 13927 879 512 512
ReadX 13927 1391 512 512
ReadX 13927 1903 512 512
ReadX 13927 2415 512 512
ReadX 13927 2927 512 512
ReadX 13927 3439 420 420
ReadX 13927 277 92 92
ReadX 13927 369 512 512
ReadX 13927 881 512 512
ReadX 13927 1393 512 512
ReadX 13927 1905 512 512
ReadX 13927 2417 512 512
ReadX 13927 2929 512 512
ReadX 13927 3441 512 512
ReadX 13927 3953 512 512
ReadX 13927 4465 512 512
ReadX 13927 4977 512 512
ReadX 13927 5489 512 512
ReadX 13927 6001 512 512
ReadX 13927 6513 512 512
ReadX 13927 7025 512 512
ReadX 13927 7537 512 512
ReadX 13927 8049 512 512
ReadX 13927 8561 512 512
ReadX 13927 9073 512 512
ReadX 13927 9585 512 512
ReadX 13927 10097 512 512
ReadX 13927 282 512 512
ReadX 13927 794 512 512
ReadX 13927 1306 512 512
ReadX 13927 1818 512 512
ReadX 13927 2330 512 512
ReadX 13927 2842 512 512
ReadX 13927 3354 512 512
ReadX 13927 3866 512 512
ReadX 13927 4378 512 512
ReadX 13927 284 512 512
ReadX 13927 796 512 512
ReadX 13927 1308 512 512
ReadX 13927 1820 512 512
ReadX 13927 2332 512 512
ReadX 13927 2844 512 512
ReadX 13927 3356 512 512
ReadX 13927 3868 512 512
ReadX 13927 4380 512 512
ReadX 13927 4892 512 512
ReadX 13927 5404 512 512
ReadX 13927 5916 512 512
ReadX 13927 6428 512 512
ReadX 13927 6940 512 512
ReadX 13927 7452 512 512
ReadX 13927 7964 512 512
ReadX 13927 8476 512 512
ReadX 13927 8988 512 512
ReadX 13927 9500 512 512
ReadX 13927 10012 512 512
ReadX 13927 10524 472 472
ReadX 13927 288 40 40
ReadX 13927 328 512 512
ReadX 13927 840 512 512
ReadX 13927 1352 512 512
ReadX 13927 1864 512 512
ReadX 13927 2376 512 512
ReadX 13927 2888 512 512
ReadX 13927 3400 512 512
ReadX 13927 3912 512 512
ReadX 13927 4424 512 512
ReadX 13927 4936 512 512
ReadX 13927 5448 512 512
ReadX 13927 5960 512 512
ReadX 13927 6472 512 512
ReadX 13927 6984 512 512
ReadX 13927 7496 512 512
ReadX 13927 8008 512 512
ReadX 13927 8520 512 512
ReadX 13927 9032 512 512
ReadX 13927 9544 512 512
ReadX 13927 10056 512 512
ReadX 13927 10568 506 506
ReadX 13927 282 512 512
ReadX 13927 794 512 512
ReadX 13927 301 512 512
ReadX 13927 296 512 512
ReadX 13927 808 512 512
ReadX 13927 1320 512 512
ReadX 13927 1832 512 512
ReadX 13927 2344 512 512
ReadX 13927 2856 512 512
ReadX 13927 3368 512 512
ReadX 13927 3880 424 424
ReadX 13927 295 88 88
ReadX 13927 383 512 512
ReadX 13927 895 512 512
ReadX 13927 1407 512 512
ReadX 13927 1919 512 512
ReadX 13927 2431 512 512
ReadX 13927 2943 512 512
ReadX 13927 3455 424 424
ReadX 13927 297 88 88
ReadX 13927 385 512 512
ReadX 13927 897 512 512
ReadX 13927 1409 512 512
ReadX 13927 1921 512 512
ReadX 13927 2433 512 512
ReadX 13927 2945 512 512
ReadX 13927 3457 512 512
ReadX 13927 3969 512 512
ReadX 13927 4481 512 512
ReadX 13927 4993 512 512
ReadX 13927 5505 512 512
ReadX 13927 6017 512 512
ReadX 13927 6529 512 512
ReadX 13927 7041 512 512
ReadX 13927 7553 512 512
ReadX 13927 8065 512 512
ReadX 13927 8577 512 512
ReadX 13927 9089 512 512
ReadX 13927 9601 512 512
ReadX 13927 10113 512 512
ReadX 13927 301 512 512
ReadX 13927 301 512 512
ReadX 13927 301 512 512
ReadX 13927 813 512 512
ReadX 13927 301 512 512
ReadX 13927 813 512 512
ReadX 13927 1325 512 512
ReadX 13927 1837 512 512
ReadX 13927 2349 512 512
ReadX 13927 2861 512 512
ReadX 13927 3373 512 512
ReadX 13927 3885 512 512
ReadX 13927 4397 512 512
ReadX 13927 4909 512 512
ReadX 13927 5421 512 512
ReadX 13927 5933 512 512
ReadX 13927 6445 512 512
ReadX 13927 6957 512 512
ReadX 13927 7469 512 512
ReadX 13927 7981 512 512
ReadX 13927 8493 512 512
ReadX 13927 9005 512 512
ReadX 13927 9517 463 463
ReadX 13927 9980 512 512
ReadX 13927 10492 49 49
ReadX 13927 10541 512 512
ReadX 13927 11053 512 512
ReadX 13927 11565 512 512
ReadX 13927 12077 512 512
ReadX 13927 12589 512 512
ReadX 13927 13101 512 512
ReadX 13927 13613 512 512
ReadX 13927 14125 512 512
ReadX 13927 14637 512 512
ReadX 13927 15149 512 512
ReadX 13927 15661 512 512
ReadX 13927 16173 512 512
ReadX 13927 16685 512 512
ReadX 13927 17197 512 512
ReadX 13927 17709 512 512
ReadX 13927 18221 512 512
ReadX 13927 18733 512 512
ReadX 13927 19245 512 512
ReadX 13927 19757 512 512
ReadX 13927 20269 512 512
ReadX 13927 20781 326 326
ReadX 13927 301 512 512
QUERY_FS_INFORMATION 259
Close 13925
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13928
Close 13928
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13929
ReadX 13929 0 24 24
Close 13929
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13930
QUERY_FILE_INFORMATION 13930
ReadX 13930 0 512 512
ReadX 13930 476 512 512
ReadX 13930 510 512 512
ReadX 13930 484 512 512
ReadX 13930 474 512 512
ReadX 13930 478 512 512
ReadX 13930 990 512 512
ReadX 13930 509 57 57
Close 13930
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13931
QUERY_FILE_INFORMATION 13931
ReadX 13931 0 512 512
ReadX 13931 476 512 512
ReadX 13931 510 512 512
ReadX 13931 484 512 512
ReadX 13931 480 512 512
ReadX 13931 474 512 512
ReadX 13931 478 512 512
QUERY_FILE_INFORMATION 13931
WriteX 13931 494 60 60
WriteX 13931 494 4 4
QUERY_FILE_INFORMATION 13931
WriteX 13931 494 11 11
WriteX 13931 510 512 512
WriteX 13931 484 512 512
WriteX 13931 474 512 512
WriteX 13931 478 512 512
WriteX 13931 990 512 512
Close 13931
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 13932
Close 13932
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 13933
Close 13933
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13935
WriteX 13935 4607 1 1
QUERY_FILE_INFORMATION 13935
WriteX 13935 0 65471 65471
WriteX 13935 65471 65 65
WriteX 13935 65536 19490 19490
Close 13935
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13936
QUERY_FILE_INFORMATION 13936
ReadX 13936 0 512 512
ReadX 13936 482 512 512
ReadX 13936 994 512 512
ReadX 13936 1506 512 512
ReadX 13936 480 512 512
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 490 448 448
QUERY_FILE_INFORMATION 13936
WriteX 13936 490 60 60
WriteX 13936 490 4 4
QUERY_FILE_INFORMATION 13936
WriteX 13936 490 11 11
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 484 512 512
WriteX 13936 996 512 512
WriteX 13936 1508 512 512
WriteX 13936 482 512 512
WriteX 13936 0 512 512
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
ReadX 13936 490 512 512
WriteX 13936 502 512 512
WriteX 13936 502 292 292
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 503 20 20
WriteX 13936 503 108 108
QUERY_FILE_INFORMATION 13936
WriteX 13936 504 448 448
QUERY_FILE_INFORMATION 13936
WriteX 13936 504 44 44
WriteX 13936 504 20 20
WriteX 13936 500 512 512
WriteX 13936 492 512 512
WriteX 13936 496 512 512
WriteX 13936 1008 512 512
WriteX 13936 494 512 512
Flush 13936
WriteX 13936 0 512 512
Flush 13936
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 500 512 512
WriteX 13936 492 512 512
WriteX 13936 496 512 512
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 518 320 320
QUERY_FILE_INFORMATION 13936
WriteX 13936 518 60 60
ReadX 13936 504 512 512
WriteX 13936 522 512 512
WriteX 13936 506 3204 3204
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 519 25 25
WriteX 13936 518 103 103
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 519 44 44
WriteX 13936 519 20 20
WriteX 13936 520 512 512
WriteX 13936 482 512 512
WriteX 13936 486 512 512
WriteX 13936 998 512 512
WriteX 13936 484 512 512
WriteX 13936 490 512 512
Flush 13936
WriteX 13936 0 512 512
Flush 13936
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
QUERY_FILE_INFORMATION 13936
WriteX 13936 519 7 7
WriteX 13936 519 57 57
WriteX 13936 520 512 512
WriteX 13936 492 512 512
WriteX 13936 482 512 512
WriteX 13936 486 512 512
WriteX 13936 998 512 512
Flush 13936
WriteX 13936 520 512 512
Flush 13936
Close 13936
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13937
Close 13937
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 13938
QUERY_FILE_INFORMATION 13938
ReadX 13938 0 512 512
ReadX 13938 490 512 512
ReadX 13938 484 512 512
ReadX 13938 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 13939
Close 13939
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13938
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13940
Close 13940
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13941
ReadX 13941 0 24 24
Close 13941
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13942
QUERY_FILE_INFORMATION 13942
ReadX 13942 0 512 512
ReadX 13942 366 512 512
ReadX 13942 878 512 512
ReadX 13942 1390 512 512
ReadX 13942 1902 512 512
ReadX 13942 374 57 57
Close 13942
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13943
QUERY_FILE_INFORMATION 13943
ReadX 13943 0 512 512
ReadX 13943 366 512 512
ReadX 13943 878 512 512
ReadX 13943 1390 512 512
ReadX 13943 1902 512 512
QUERY_FILE_INFORMATION 13943
WriteX 13943 374 60 60
WriteX 13943 374 4 4
QUERY_FILE_INFORMATION 13943
WriteX 13943 374 11 11
ReadX 13943 374 57 57
ReadX 13943 374 57 57
ReadX 13943 292 4096 4096
ReadX 13943 364 512 512
ReadX 13943 512 4096 4096
ReadX 13943 4608 4096 4096
ReadX 13943 8704 4096 4096
ReadX 13943 12800 4096 4096
ReadX 13943 16896 4096 4096
ReadX 13943 20992 4096 4096
ReadX 13943 25088 4096 4096
ReadX 13943 29184 4096 4096
ReadX 13943 33280 4096 4096
ReadX 13943 37376 4096 4096
ReadX 13943 41472 4096 4096
ReadX 13943 45568 4096 4096
ReadX 13943 49664 4096 4096
ReadX 13943 53760 4096 4096
ReadX 13943 57856 4096 4096
ReadX 13943 61952 4096 4096
ReadX 13943 66048 4096 4096
ReadX 13943 70144 4096 4096
ReadX 13943 74240 162 162
ReadX 13943 308 4096 4096
ReadX 13943 4404 4096 4096
WriteX 13943 368 512 512
WriteX 13943 880 512 512
WriteX 13943 1392 512 512
Close 13943
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13944
Close 13944
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13945
QUERY_FILE_INFORMATION 13945
ReadX 13945 0 512 512
ReadX 13945 366 512 512
ReadX 13945 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13946
Close 13946
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13945
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13948
WriteX 13948 4607 1 1
QUERY_FILE_INFORMATION 13948
WriteX 13948 0 65471 65471
WriteX 13948 65471 65 65
WriteX 13948 65536 8866 8866
Close 13948
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13949
QUERY_FILE_INFORMATION 13949
ReadX 13949 0 512 512
ReadX 13949 366 512 512
ReadX 13949 878 512 512
ReadX 13949 1390 512 512
ReadX 13949 364 512 512
QUERY_FILE_INFORMATION 13949
QUERY_FILE_INFORMATION 13949
QUERY_FILE_INFORMATION 13949
WriteX 13949 374 448 448
QUERY_FILE_INFORMATION 13949
WriteX 13949 374 60 60
WriteX 13949 374 4 4
QUERY_FILE_INFORMATION 13949
WriteX 13949 374 11 11
QUERY_FILE_INFORMATION 13949
QUERY_FILE_INFORMATION 13949
WriteX 13949 374 7 7
WriteX 13949 374 57 57
WriteX 13949 368 512 512
WriteX 13949 880 512 512
WriteX 13949 1392 512 512
WriteX 13949 366 512 512
WriteX 13949 0 512 512
Flush 13949
WriteX 13949 368 512 512
Flush 13949
Close 13949
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13950
QUERY_FILE_INFORMATION 13950
ReadX 13950 0 512 512
ReadX 13950 366 512 512
ReadX 13950 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13950
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13951
Close 13951
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13952
ReadX 13952 0 24 24
Close 13952
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13953
QUERY_FILE_INFORMATION 13953
ReadX 13953 0 512 512
ReadX 13953 366 512 512
ReadX 13953 878 512 512
ReadX 13953 1390 512 512
ReadX 13953 1902 512 512
ReadX 13953 374 57 57
Close 13953
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13954
QUERY_FILE_INFORMATION 13954
ReadX 13954 0 512 512
ReadX 13954 366 512 512
ReadX 13954 878 512 512
ReadX 13954 1390 512 512
ReadX 13954 1902 512 512
QUERY_FILE_INFORMATION 13954
WriteX 13954 374 60 60
WriteX 13954 374 4 4
QUERY_FILE_INFORMATION 13954
WriteX 13954 374 11 11
WriteX 13954 368 512 512
WriteX 13954 880 512 512
WriteX 13954 1392 512 512
Close 13954
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 13955
Close 13955
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13956
Close 13956
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13958
WriteX 13958 4607 1 1
QUERY_FILE_INFORMATION 13958
WriteX 13958 0 65471 65471
WriteX 13958 65471 65 65
WriteX 13958 65536 9298 9298
Close 13958
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13959
QUERY_FILE_INFORMATION 13959
ReadX 13959 0 512 512
ReadX 13959 368 512 512
ReadX 13959 880 512 512
ReadX 13959 1392 512 512
ReadX 13959 366 512 512
QUERY_FILE_INFORMATION 13959
QUERY_FILE_INFORMATION 13959
QUERY_FILE_INFORMATION 13959
WriteX 13959 376 448 448
QUERY_FILE_INFORMATION 13959
WriteX 13959 376 60 60
WriteX 13959 376 4 4
QUERY_FILE_INFORMATION 13959
WriteX 13959 376 11 11
QUERY_FILE_INFORMATION 13959
QUERY_FILE_INFORMATION 13959
WriteX 13959 376 7 7
WriteX 13959 376 57 57
WriteX 13959 370 512 512
WriteX 13959 882 512 512
WriteX 13959 1394 512 512
WriteX 13959 368 512 512
WriteX 13959 0 512 512
Flush 13959
WriteX 13959 370 512 512
Flush 13959
Close 13959
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13960
Close 13960
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13961
QUERY_FILE_INFORMATION 13961
ReadX 13961 0 512 512
ReadX 13961 368 512 512
ReadX 13961 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 13962
Close 13962
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13964
Close 13964
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13965
ReadX 13965 0 24 24
Close 13965
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13966
QUERY_FILE_INFORMATION 13966
ReadX 13966 0 512 512
ReadX 13966 512 512 512
ReadX 13966 1024 512 512
ReadX 13966 2016 512 512
ReadX 13966 1056 512 512
ReadX 13966 1096 57 57
Close 13966
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13967
QUERY_FILE_INFORMATION 13967
ReadX 13967 0 512 512
ReadX 13967 512 512 512
ReadX 13967 1024 512 512
ReadX 13967 2016 512 512
ReadX 13967 1056 512 512
ReadX 13967 1096 57 57
ReadX 13967 1096 57 57
ReadX 13967 1088 62 62
ReadX 13967 1536 4096 4096
ReadX 13967 5632 4096 4096
ReadX 13967 9728 4096 4096
ReadX 13967 13824 2859 2859
ReadX 13967 1120 28 28
ReadX 13967 1148 20 20
ReadX 13967 1168 8 8
ReadX 13967 1176 88 88
ReadX 13967 1264 8 8
ReadX 13967 1272 4 4
ReadX 13967 1276 4 4
ReadX 13967 1280 1 1
ReadX 13967 1130 4 4
ReadX 13967 1134 4 4
ReadX 13967 1138 1 1
ReadX 13967 1131 4 4
ReadX 13967 1135 4 4
ReadX 13967 1139 1 1
ReadX 13967 1131 4 4
ReadX 13967 1135 4 4
ReadX 13967 1139 2 2
ReadX 13967 1132 4 4
ReadX 13967 1136 4 4
ReadX 13967 1140 25 25
ReadX 13967 1134 4 4
ReadX 13967 1138 8 8
ReadX 13967 1146 4 4
ReadX 13967 1150 8 8
ReadX 13967 1158 4 4
ReadX 13967 1162 8 8
ReadX 13967 1170 4 4
ReadX 13967 1174 4 4
ReadX 13967 1178 4 4
ReadX 13967 1182 4 4
ReadX 13967 1186 4 4
ReadX 13967 1190 4 4
ReadX 13967 1194 13900 13900
ReadX 13967 2048 4096 4096
Close 13967
QUERY_FS_INFORMATION 259
Close 13961
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13968
Close 13968
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13969
ReadX 13969 0 24 24
Close 13969
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13970
QUERY_FILE_INFORMATION 13970
ReadX 13970 0 512 512
ReadX 13970 368 512 512
ReadX 13970 880 512 512
ReadX 13970 1392 512 512
ReadX 13970 1904 512 512
ReadX 13970 376 57 57
Close 13970
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13971
QUERY_FILE_INFORMATION 13971
ReadX 13971 0 512 512
ReadX 13971 368 512 512
ReadX 13971 880 512 512
ReadX 13971 1392 512 512
ReadX 13971 1904 512 512
QUERY_FILE_INFORMATION 13971
WriteX 13971 376 60 60
WriteX 13971 376 4 4
QUERY_FILE_INFORMATION 13971
WriteX 13971 376 11 11
WriteX 13971 370 512 512
WriteX 13971 882 512 512
WriteX 13971 1394 512 512
Close 13971
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 13972
Close 13972
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 13973
Close 13973
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13975
WriteX 13975 4607 1 1
QUERY_FILE_INFORMATION 13975
WriteX 13975 0 65471 65471
WriteX 13975 65471 65 65
WriteX 13975 65536 11540 11540
Close 13975
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13976
QUERY_FILE_INFORMATION 13976
ReadX 13976 0 512 512
ReadX 13976 398 512 512
ReadX 13976 910 512 512
ReadX 13976 1422 512 512
ReadX 13976 396 512 512
QUERY_FILE_INFORMATION 13976
QUERY_FILE_INFORMATION 13976
QUERY_FILE_INFORMATION 13976
WriteX 13976 406 448 448
QUERY_FILE_INFORMATION 13976
WriteX 13976 406 60 60
WriteX 13976 406 4 4
QUERY_FILE_INFORMATION 13976
WriteX 13976 406 11 11
QUERY_FILE_INFORMATION 13976
QUERY_FILE_INFORMATION 13976
WriteX 13976 406 7 7
WriteX 13976 406 57 57
WriteX 13976 400 512 512
WriteX 13976 912 512 512
WriteX 13976 1424 512 512
WriteX 13976 398 512 512
WriteX 13976 0 512 512
Flush 13976
WriteX 13976 400 512 512
Flush 13976
Close 13976
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13977
Close 13977
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 13978
QUERY_FILE_INFORMATION 13978
ReadX 13978 0 512 512
ReadX 13978 398 512 512
ReadX 13978 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 13979
Close 13979
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 13978
ReadX 13927 1434 512 512
Close 13927
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 13980
WriteX 13980 0 65471 65471
WriteX 13980 65471 63 63
WriteX 13980 65534 65471 65471
WriteX 13980 131005 63 63
Close 13980
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 13981
WriteX 13981 0 65471 65471
WriteX 13981 65471 63 63
WriteX 13981 65534 65471 65471
WriteX 13981 131005 63 63
WriteX 13981 131068 65471 65471
WriteX 13981 196539 63 63
WriteX 13981 196602 65471 65471
WriteX 13981 262073 63 63
Close 13981
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 13982
WriteX 13982 0 65471 65471
WriteX 13982 65471 63 63
WriteX 13982 65534 65471 65471
WriteX 13982 131005 63 63
WriteX 13982 131068 65471 65471
WriteX 13982 196539 63 63
WriteX 13982 196602 65471 65471
WriteX 13982 262073 63 63
WriteX 13982 262136 65471 65471
WriteX 13982 327607 63 63
WriteX 13982 327670 65471 65471
WriteX 13982 393141 63 63
WriteX 13982 393204 65471 65471
WriteX 13982 458675 63 63
WriteX 13982 458738 65471 65471
WriteX 13982 524209 63 63
Close 13982
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13983
Close 13983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 13984
ReadX 13984 0 512 512
ReadX 13984 512 511 511
ReadX 13984 1023 512 512
ReadX 13984 1535 512 512
Close 13984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 13985
ReadX 13985 0 512 512
ReadX 13985 512 510 510
ReadX 13985 1022 512 512
ReadX 13985 1534 510 510
ReadX 13985 2044 510 510
Close 13985
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 13986
ReadX 13986 0 512 512
ReadX 13986 512 512 512
ReadX 13986 1024 512 512
ReadX 13986 1536 512 512
ReadX 13986 2048 512 512
ReadX 13986 2560 512 512
ReadX 13986 3072 512 512
ReadX 13986 3584 512 512
ReadX 13986 4096 512 512
ReadX 13986 4608 512 512
ReadX 13986 5120 512 512
ReadX 13986 5632 512 512
ReadX 13986 6144 512 512
ReadX 13986 6656 512 512
ReadX 13986 7168 512 512
ReadX 13986 7680 512 512
ReadX 13986 8192 512 512
ReadX 13986 8704 512 512
Close 13986
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13987
Close 13987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13988
QUERY_FILE_INFORMATION 13988
Close 13988
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13989
ReadX 13989 0 8192 8192
Close 13989
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13990
Close 13990
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13991
QUERY_FILE_INFORMATION 13991
Close 13991
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13992
ReadX 13992 0 8192 8192
Close 13992
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13993
Close 13993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13994
QUERY_FILE_INFORMATION 13994
Close 13994
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 13995
ReadX 13995 0 8192 8192
Close 13995
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13996
ReadX 13996 0 8192 8192
ReadX 13996 8192 8192 8192
ReadX 13996 16384 8192 8192
ReadX 13996 24576 8192 8192
Close 13996
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13998
Close 13998
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14000
WriteX 14000 8191 1 1
QUERY_FILE_INFORMATION 14000
WriteX 14000 0 10438 10438
Close 14000
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14001
Close 14001
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14002
QUERY_FILE_INFORMATION 14002
QUERY_FILE_INFORMATION 14002
Close 14002
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 14003
QUERY_FILE_INFORMATION 14003
QUERY_FILE_INFORMATION 14003
Close 14003
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14004
Close 14004
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14005
QUERY_FILE_INFORMATION 14005
QUERY_FILE_INFORMATION 14005
Close 14005
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 14006
QUERY_FILE_INFORMATION 14006
QUERY_FILE_INFORMATION 14006
Close 14006
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14007
Close 14007
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14008
QUERY_FILE_INFORMATION 14008
QUERY_FILE_INFORMATION 14008
Close 14008
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 14009
QUERY_FILE_INFORMATION 14009
QUERY_FILE_INFORMATION 14009
Close 14009
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14010
Close 14010
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14011
QUERY_FILE_INFORMATION 14011
QUERY_FILE_INFORMATION 14011
Close 14011
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14012
ReadX 14012 0 8 8
ReadX 14012 8 4 4
ReadX 14012 12 8 8
ReadX 14012 22 8 8
ReadX 14012 520 8 8
ReadX 14012 525 8 8
ReadX 14012 533 4 4
ReadX 14012 543 8 8
ReadX 14012 551 4 4
ReadX 14012 1058 8 8
ReadX 14012 1066 4 4
ReadX 14012 1081 8 8
ReadX 14012 1089 4 4
ReadX 14012 660 8 8
Close 14012
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14013
ReadX 14013 0 8192 8192
Close 14013
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 14014
ReadX 14014 0 8192 8192
ReadX 14014 520 8192 8192
ReadX 14014 8712 8192 8192
ReadX 14014 16904 8192 8192
ReadX 14014 25096 8192 8192
ReadX 14014 33288 8192 8192
ReadX 14014 41480 8192 8192
ReadX 14014 49672 8192 8192
ReadX 14014 57864 8192 8192
ReadX 14014 66056 8192 8192
ReadX 14014 74248 8192 8192
ReadX 14014 82440 8192 8192
ReadX 14014 90632 8192 8192
ReadX 14014 98824 8192 8192
ReadX 14014 107016 8192 8192
ReadX 14014 115208 8192 8192
ReadX 14014 123400 8192 8192
ReadX 14014 131592 8192 8192
ReadX 14014 139784 8192 8192
ReadX 14014 147976 8192 8192
ReadX 14014 156168 8192 8192
Close 14014
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14015
QUERY_FILE_INFORMATION 14015
Close 14015
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14016
Close 14016
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14018
WriteX 14018 8191 1 1
QUERY_FILE_INFORMATION 14018
WriteX 14018 0 28489 28489
Close 14018
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14019
Close 14019
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14020
Close 14020
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14021
QUERY_FILE_INFORMATION 14021
Close 14021
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14022
ReadX 14022 0 8192 8192
Close 14022
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14023
Close 14023
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14024
QUERY_FILE_INFORMATION 14024
Close 14024
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 14025
ReadX 14025 0 8192 8192
Close 14025
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14026
ReadX 14026 0 8192 8192
ReadX 14026 8192 8192 8192
ReadX 14026 16384 8192 8192
ReadX 14026 24576 8192 8192
ReadX 14026 32768 16384 16384
ReadX 14026 49152 8192 8192
ReadX 14026 57344 8192 8192
ReadX 14026 65536 8192 8192
Close 14026
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14030
WriteX 14030 8191 1 1
QUERY_FILE_INFORMATION 14030
WriteX 14030 0 29253 29253
Close 14030
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14031
Close 14031
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14032
QUERY_FILE_INFORMATION 14032
QUERY_FILE_INFORMATION 14032
Close 14032
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 14033
QUERY_FILE_INFORMATION 14033
QUERY_FILE_INFORMATION 14033
Close 14033
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14034
QUERY_FILE_INFORMATION 14034
Close 14034
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14035
Close 14035
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14037
WriteX 14037 8191 1 1
QUERY_FILE_INFORMATION 14037
WriteX 14037 0 30183 30183
Close 14037
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14038
Close 14038
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 14039
WriteX 14039 0 510 510
WriteX 14039 510 512 512
WriteX 14039 1022 510 510
WriteX 14039 1532 510 510
WriteX 14039 2042 168 168
Close 14039
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14040
Close 14040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 14041
WriteX 14041 0 511 511
WriteX 14041 511 512 512
WriteX 14041 1023 512 512
WriteX 14041 1535 488 488
Close 14041
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14042
ReadX 14042 0 65471 65471
ReadX 14042 65471 63 63
ReadX 14042 65534 65471 65471
ReadX 14042 131005 63 63
ReadX 14042 131068 65471 65471
ReadX 14042 196539 63 63
ReadX 14042 196602 65471 65471
ReadX 14042 262073 63 63
ReadX 14042 262136 65471 65471
ReadX 14042 327607 63 63
ReadX 14042 327670 10 10
Close 14042
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14043
ReadX 14043 0 65471 65471
ReadX 14043 65471 63 63
ReadX 14043 65534 65471 65471
ReadX 14043 131005 63 63
ReadX 14043 131068 65471 65471
ReadX 14043 196539 63 63
ReadX 14043 196602 65471 65471
ReadX 14043 262073 63 63
ReadX 14043 262136 65471 65471
ReadX 14043 327607 63 63
ReadX 14043 327670 65471 65471
ReadX 14043 393141 63 63
ReadX 14043 393204 65471 65471
ReadX 14043 458675 63 63
ReadX 14043 458738 65471 65471
ReadX 14043 524209 63 63
ReadX 14043 524272 65471 65471
ReadX 14043 589743 63 63
ReadX 14043 589806 65471 65471
ReadX 14043 655277 63 63
ReadX 14043 655340 32 32
Close 14043
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14044
ReadX 14044 0 65471 65471
ReadX 14044 65471 63 63
ReadX 14044 65534 65471 65471
ReadX 14044 131005 63 63
ReadX 14044 131068 65471 65471
ReadX 14044 196539 63 63
ReadX 14044 196602 65471 65471
ReadX 14044 262073 63 63
ReadX 14044 262136 65471 65471
ReadX 14044 327607 63 63
ReadX 14044 327670 65471 65471
ReadX 14044 393141 63 63
ReadX 14044 393204 65471 65471
ReadX 14044 458675 63 63
ReadX 14044 458738 65471 65471
ReadX 14044 524209 63 63
ReadX 14044 524272 65471 65471
ReadX 14044 589743 63 63
ReadX 14044 589806 65471 65471
ReadX 14044 655277 63 63
ReadX 14044 655340 65471 65471
ReadX 14044 720811 63 63
ReadX 14044 720874 65471 65471
ReadX 14044 786345 63 63
ReadX 14044 786408 65471 65471
ReadX 14044 851879 63 63
ReadX 14044 851942 65471 65471
ReadX 14044 917413 63 63
ReadX 14044 917476 65471 65471
ReadX 14044 982947 63 63
ReadX 14044 983010 65471 65471
ReadX 14044 1048481 63 63
ReadX 14044 1048544 65471 65471
ReadX 14044 1114015 63 63
ReadX 14044 1114078 65471 65471
ReadX 14044 1179549 63 63
ReadX 14044 1179612 65471 65471
ReadX 14044 1245083 63 63
ReadX 14044 1245146 65471 65471
ReadX 14044 1310617 63 63
ReadX 14044 1310680 65471 65471
ReadX 14044 1376151 63 63
ReadX 14044 1376214 65471 65471
ReadX 14044 1441685 63 63
ReadX 14044 1441748 65471 65471
ReadX 14044 1507219 63 63
ReadX 14044 1507282 65471 65471
ReadX 14044 1572753 63 63
ReadX 14044 1572816 65471 65471
ReadX 14044 1638287 63 63
ReadX 14044 1638350 65471 65471
ReadX 14044 1703821 63 63
ReadX 14044 1703884 65471 65471
ReadX 14044 1769355 63 63
ReadX 14044 1769418 65471 65471
ReadX 14044 1834889 63 63
ReadX 14044 1834952 32824 32824
Close 14044
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14045
QUERY_FILE_INFORMATION 14045
ReadX 14045 0 512 512
ReadX 14045 512 512 512
ReadX 14045 1024 512 512
QUERY_FILE_INFORMATION 14045
QUERY_FILE_INFORMATION 14045
ReadX 14045 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 14045
QUERY_FILE_INFORMATION 14045
ReadX 14045 512 4096 4096
QUERY_FILE_INFORMATION 14045
QUERY_FILE_INFORMATION 14045
QUERY_FILE_INFORMATION 14045
WriteX 14045 512 4096 4096
WriteX 14045 1024 512 512
ReadX 14045 502 512 512
QUERY_FILE_INFORMATION 14045
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14045 2560 512 512
ReadX 14045 1536 512 512
ReadX 14045 2176 384 384
ReadX 14045 3072 128 128
ReadX 14045 3107 512 512
ReadX 14045 3619 512 512
ReadX 14045 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14045 286 123 123
ReadX 14045 292 24 24
ReadX 14045 512 2048 2048
ReadX 14045 512 2048 2048
ReadX 14045 2560 2048 2048
ReadX 14045 416 1536 1536
ReadX 14045 768 512 512
ReadX 14045 1280 2048 2048
ReadX 14045 3328 2048 2048
ReadX 14045 5376 2048 2048
ReadX 14045 7424 2048 2048
ReadX 14045 9472 2048 2048
ReadX 14045 11520 2048 2048
ReadX 14045 13568 2048 2048
ReadX 14045 15616 2048 2048
ReadX 14045 17664 2048 2048
ReadX 14045 19712 2048 2048
ReadX 14045 21760 2048 2048
ReadX 14045 23808 2048 2048
ReadX 14045 25856 2048 2048
ReadX 14045 27904 2048 2048
ReadX 14045 29952 2048 2048
ReadX 14045 32000 2048 2048
ReadX 14045 34048 2048 2048
ReadX 14045 36096 2048 2048
ReadX 14045 38144 2048 2048
ReadX 14045 40192 2048 2048
ReadX 14045 42240 512 512
ReadX 14045 42752 2048 2048
ReadX 14045 44800 2048 2048
ReadX 14045 46848 2048 2048
ReadX 14045 48896 2048 2048
ReadX 14045 50944 2048 2048
ReadX 14045 52992 2048 2048
ReadX 14045 55040 2048 2048
ReadX 14045 57088 2048 2048
ReadX 14045 316 2048 2048
ReadX 14045 2364 2048 2048
ReadX 14045 4412 2048 2048
ReadX 14045 6460 2048 2048
ReadX 14045 8508 2048 2048
ReadX 14045 10556 2048 2048
ReadX 14045 12604 2048 2048
ReadX 14045 14652 2048 2048
ReadX 14045 16700 2048 2048
ReadX 14045 18748 2048 2048
ReadX 14045 20796 2048 2048
ReadX 14045 22844 2048 2048
ReadX 14045 24892 2048 2048
ReadX 14045 26940 2048 2048
ReadX 14045 28988 2048 2048
ReadX 14045 31036 2048 2048
ReadX 14045 436 2048 2048
ReadX 14045 2484 2048 2048
ReadX 14045 4532 2048 2048
ReadX 14045 6580 2048 2048
ReadX 14045 8628 2048 2048
ReadX 14045 10676 2048 2048
ReadX 14045 476 2048 2048
ReadX 14045 476 2048 2048
ReadX 14045 476 2048 2048
ReadX 14045 2524 2048 2048
ReadX 14045 484 2048 2048
ReadX 14045 484 2048 2048
ReadX 14045 484 2048 2048
ReadX 14045 2532 665 665
ReadX 14045 492 665 665
ReadX 14045 492 665 665
ReadX 14045 492 665 665
ReadX 14045 296 512 512
ReadX 14045 318 512 512
ReadX 14045 300 512 512
ReadX 14045 312 512 512
ReadX 14045 320 512 512
ReadX 14045 832 354 354
ReadX 14045 504 4096 4096
ReadX 14045 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 14046
Close 14046
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 14047
WriteX 14047 1535 1 1
QUERY_FILE_INFORMATION 14047
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14045 296 1251 1251
ReadX 14045 2176 384 384
ReadX 14045 3072 1634 1634
QUERY_FILE_INFORMATION 14047
WriteX 14047 0 57088 57088
WriteX 14047 0 4096 4096
Flush 14047
Close 14045
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14048
Close 14048
WriteX 14047 0 4096 4096
Close 14047
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 14049
Close 14049
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14050
QUERY_FILE_INFORMATION 14050
ReadX 14050 0 512 512
ReadX 14050 512 512 512
ReadX 14050 1024 512 512
QUERY_FILE_INFORMATION 14050
QUERY_FILE_INFORMATION 14050
ReadX 14050 512 2048 2048
QUERY_FILE_INFORMATION 14050
QUERY_FILE_INFORMATION 14050
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14050 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 14051
WriteX 14051 1535 1 1
QUERY_FILE_INFORMATION 14051
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14050 1536 512 512
ReadX 14050 288 1251 1251
ReadX 14050 2048 2018 2018
QUERY_FILE_INFORMATION 14051
WriteX 14051 0 51456 51456
WriteX 14051 0 4096 4096
Flush 14051
QUERY_FILE_INFORMATION 14050
QUERY_FILE_INFORMATION 14050
Close 14050
WriteX 14051 0 4096 4096
Close 14051
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 14052
Close 14052
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14053
QUERY_FILE_INFORMATION 14053
ReadX 14053 0 512 512
ReadX 14053 512 512 512
ReadX 14053 1024 512 512
QUERY_FILE_INFORMATION 14053
QUERY_FILE_INFORMATION 14053
ReadX 14053 512 2048 2048
QUERY_FILE_INFORMATION 14053
QUERY_FILE_INFORMATION 14053
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14053 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14055
Close 14055
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14057
WriteX 14057 4045 1 1
QUERY_FILE_INFORMATION 14057
WriteX 14057 0 53077 53077
Close 14057
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 14058
WriteX 14058 1535 1 1
QUERY_FILE_INFORMATION 14058
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14053 1536 512 512
ReadX 14053 288 1251 1251
ReadX 14053 2048 2018 2018
QUERY_FILE_INFORMATION 14058
WriteX 14058 0 65471 65471
WriteX 14058 65471 65 65
WriteX 14058 65536 1856 1856
WriteX 14058 0 4096 4096
Flush 14058
QUERY_FILE_INFORMATION 14053
QUERY_FILE_INFORMATION 14053
Close 14053
WriteX 14058 0 4096 4096
Close 14058
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 14059
Close 14059
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14060
QUERY_FILE_INFORMATION 14060
ReadX 14060 0 512 512
ReadX 14060 512 512 512
ReadX 14060 1024 512 512
QUERY_FILE_INFORMATION 14060
QUERY_FILE_INFORMATION 14060
ReadX 14060 576 2048 2048
QUERY_FILE_INFORMATION 14060
QUERY_FILE_INFORMATION 14060
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14062
Close 14062
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14064
WriteX 14064 4076 1 1
QUERY_FILE_INFORMATION 14064
WriteX 14064 0 7983 7983
Close 14064
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14066
Close 14066
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14068
WriteX 14068 4095 1 1
QUERY_FILE_INFORMATION 14068
WriteX 14068 0 65471 65471
WriteX 14068 65471 65 65
WriteX 14068 65536 65471 65471
WriteX 14068 131007 65 65
WriteX 14068 131072 65471 65471
WriteX 14068 196543 65 65
WriteX 14068 196608 65471 65471
WriteX 14068 262079 65 65
WriteX 14068 262144 65471 65471
WriteX 14068 327615 65 65
WriteX 14068 327680 65471 65471
WriteX 14068 393151 65 65
WriteX 14068 393216 65471 65471
WriteX 14068 458687 65 65
WriteX 14068 458752 46731 46731
Close 14068
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 14069
WriteX 14069 1535 1 1
QUERY_FILE_INFORMATION 14069
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14060 1536 512 512
ReadX 14060 2048 2018 2018
ReadX 14060 4096 512 512
ReadX 14060 4608 2197 2197
QUERY_FILE_INFORMATION 14069
WriteX 14069 0 65471 65471
WriteX 14069 65471 65 65
WriteX 14069 65536 22848 22848
WriteX 14069 0 4096 4096
Flush 14069
QUERY_FILE_INFORMATION 14060
QUERY_FILE_INFORMATION 14060
Close 14060
WriteX 14069 0 4096 4096
Close 14069
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 14070
Close 14070
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 14071
QUERY_FILE_INFORMATION 14071
ReadX 14071 0 512 512
ReadX 14071 512 512 512
ReadX 14071 1024 512 512
QUERY_FILE_INFORMATION 14071
QUERY_FILE_INFORMATION 14071
ReadX 14071 576 2048 2048
QUERY_FILE_INFORMATION 14071
QUERY_FILE_INFORMATION 14071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14071 4096 512 512
Close 14071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14072
QUERY_FILE_INFORMATION 14072
ReadX 14072 0 512 512
ReadX 14072 512 512 512
ReadX 14072 1024 512 512
QUERY_FILE_INFORMATION 14072
QUERY_FILE_INFORMATION 14072
ReadX 14072 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 14072
QUERY_FILE_INFORMATION 14072
ReadX 14072 288 4096 4096
QUERY_FILE_INFORMATION 14072
QUERY_FILE_INFORMATION 14072
QUERY_FILE_INFORMATION 14072
WriteX 14072 288 4096 4096
WriteX 14072 1024 512 512
ReadX 14072 1536 512 512
QUERY_FILE_INFORMATION 14072
ReadX 14072 288 2048 2048
ReadX 14072 2336 2048 2048
ReadX 14072 3072 1536 1536
ReadX 14072 544 512 512
ReadX 14072 1056 2048 2048
ReadX 14072 3104 2048 2048
ReadX 14072 5152 2048 2048
ReadX 14072 7200 2048 2048
ReadX 14072 9248 2048 2048
ReadX 14072 11296 2048 2048
ReadX 14072 13344 2048 2048
ReadX 14072 15392 2048 2048
ReadX 14072 17440 2048 2048
ReadX 14072 19488 2048 2048
ReadX 14072 21536 2048 2048
ReadX 14072 23584 2048 2048
ReadX 14072 25632 2048 2048
ReadX 14072 27680 2048 2048
ReadX 14072 29728 2048 2048
ReadX 14072 31776 2048 2048
ReadX 14072 33824 2048 2048
ReadX 14072 35872 2048 2048
ReadX 14072 37920 2048 2048
ReadX 14072 39968 2048 2048
ReadX 14072 42016 512 512
ReadX 14072 42528 512 512
ReadX 14072 43040 1536 1536
ReadX 14072 44576 2048 2048
ReadX 14072 46624 2048 2048
ReadX 14072 48672 2048 2048
ReadX 14072 50720 2048 2048
ReadX 14072 52768 2048 2048
ReadX 14072 54816 2048 2048
ReadX 14072 56864 2048 2048
ReadX 14072 58912 2048 2048
ReadX 14072 60960 2048 2048
ReadX 14072 63008 2048 2048
ReadX 14072 65056 2048 2048
ReadX 14072 67104 2048 2048
ReadX 14072 69152 2048 2048
ReadX 14072 71200 2048 2048
ReadX 14072 73248 2048 2048
ReadX 14072 75296 2048 2048
ReadX 14072 77344 2048 2048
ReadX 14072 79392 2048 2048
ReadX 14072 81440 2048 2048
ReadX 14072 83488 2048 2048
ReadX 14072 85536 512 512
ReadX 14072 86048 512 512
ReadX 14072 86560 1536 1536
ReadX 14072 88096 2048 2048
ReadX 14072 90144 2048 2048
ReadX 14072 92192 2048 2048
ReadX 14072 94240 2048 2048
ReadX 14072 96288 2048 2048
ReadX 14072 552 2048 2048
ReadX 14072 2600 2048 2048
ReadX 14072 4648 2048 2048
ReadX 14072 6696 2048 2048
ReadX 14072 8744 2048 2048
ReadX 14072 10792 2048 2048
ReadX 14072 12840 2048 2048
ReadX 14072 14888 2048 2048
ReadX 14072 16936 2048 2048
ReadX 14072 18984 2048 2048
ReadX 14072 21032 2048 2048
ReadX 14072 23080 2048 2048
ReadX 14072 25128 2048 2048
ReadX 14072 27176 2048 2048
ReadX 14072 29224 2048 2048
ReadX 14072 31272 2048 2048
ReadX 14072 33320 2048 2048
ReadX 14072 35368 2048 2048
ReadX 14072 37416 2048 2048
ReadX 14072 39464 2048 2048
ReadX 14072 41512 512 512
ReadX 14072 42024 512 512
ReadX 14072 42536 1536 1536
ReadX 14072 44072 2048 2048
ReadX 14072 46120 2048 2048
ReadX 14072 48168 2048 2048
ReadX 14072 50216 2048 2048
ReadX 14072 52264 2048 2048
ReadX 14072 54312 2048 2048
ReadX 14072 56360 2048 2048
ReadX 14072 58408 2048 2048
ReadX 14072 60456 2048 2048
ReadX 14072 62504 2048 2048
ReadX 14072 64552 2048 2048
ReadX 14072 66600 2048 2048
ReadX 14072 68648 2048 2048
ReadX 14072 70696 2048 2048
ReadX 14072 72744 2048 2048
ReadX 14072 74792 2048 2048
ReadX 14072 76840 2048 2048
ReadX 14072 78888 2048 2048
ReadX 14072 80936 2048 2048
ReadX 14072 82984 2048 2048
ReadX 14072 85032 512 512
ReadX 14072 85544 2048 2048
ReadX 14072 87592 2048 2048
ReadX 14072 89640 2048 2048
ReadX 14072 91688 2048 2048
ReadX 14072 93736 2048 2048
ReadX 14072 95784 2048 2048
ReadX 14072 97832 2048 2048
ReadX 14072 99880 2048 2048
ReadX 14072 101928 2048 2048
ReadX 14072 103976 2048 2048
ReadX 14072 106024 2048 2048
ReadX 14072 108072 2048 2048
ReadX 14072 110120 2048 2048
ReadX 14072 112168 2048 2048
ReadX 14072 114216 2048 2048
ReadX 14072 116264 2048 2048
ReadX 14072 118312 2048 2048
ReadX 14072 120360 2048 2048
ReadX 14072 122408 2048 2048
ReadX 14072 124456 512 512
ReadX 14072 124968 512 512
ReadX 14072 125480 1536 1536
ReadX 14072 127016 2048 2048
ReadX 14072 129064 2048 2048
ReadX 14072 131112 2048 2048
ReadX 14072 133160 2048 2048
ReadX 14072 135208 2048 2048
ReadX 14072 137256 2048 2048
ReadX 14072 139304 2048 2048
ReadX 14072 141352 2048 2048
ReadX 14072 143400 2048 2048
ReadX 14072 145448 2048 2048
ReadX 14072 147496 2048 2048
ReadX 14072 149544 2048 2048
ReadX 14072 151592 2048 2048
ReadX 14072 153640 2048 2048
ReadX 14072 155688 2048 2048
ReadX 14072 157736 2048 2048
ReadX 14072 159784 2048 2048
ReadX 14072 161832 2048 2048
ReadX 14072 163880 2048 2048
ReadX 14072 165928 2048 2048
ReadX 14072 167976 2048 2048
ReadX 14072 170024 512 512
ReadX 14072 1538 1536 1536
ReadX 14072 3074 2048 2048
ReadX 14072 5122 2048 2048
ReadX 14072 7170 2048 2048
ReadX 14072 9218 2048 2048
ReadX 14072 11266 2048 2048
ReadX 14072 13314 2048 2048
ReadX 14072 15362 2048 2048
ReadX 14072 17410 2048 2048
ReadX 14072 19458 2048 2048
ReadX 14072 21506 2048 2048
ReadX 14072 23554 2048 2048
ReadX 14072 25602 2048 2048
ReadX 14072 27650 2048 2048
ReadX 14072 29698 2048 2048
ReadX 14072 31746 2048 2048
ReadX 14072 33794 2048 2048
ReadX 14072 35842 2048 2048
ReadX 14072 37890 2048 2048
ReadX 14072 39938 2048 2048
ReadX 14072 41986 2048 2048
ReadX 14072 44034 875 875
ReadX 14072 1730 4096 4096
ReadX 14072 1724 1536 1536
ReadX 14072 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14073
Close 14073
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14074
WriteX 14074 2047 1 1
QUERY_FILE_INFORMATION 14074
Close 14072
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14075
Close 14075
WriteX 14074 0 42388 42388
Close 14074
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14076
Close 14076
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14077
QUERY_FILE_INFORMATION 14077
ReadX 14077 0 512 512
ReadX 14077 1756 512 512
ReadX 14077 2268 512 512
QUERY_FILE_INFORMATION 14077
QUERY_FILE_INFORMATION 14077
ReadX 14077 1744 512 512
ReadX 14077 2256 512 512
ReadX 14077 2768 512 512
ReadX 14077 3280 512 512
ReadX 14077 3792 512 512
ReadX 14077 4304 512 512
ReadX 14077 512 2048 2048
QUERY_FILE_INFORMATION 14077
QUERY_FILE_INFORMATION 14077
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14078
WriteX 14078 2047 1 1
QUERY_FILE_INFORMATION 14078
QUERY_FILE_INFORMATION 14077
QUERY_FILE_INFORMATION 14077
Close 14077
WriteX 14078 0 42652 42652
Close 14078
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 14079
Close 14079
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 14080
QUERY_FILE_INFORMATION 14080
ReadX 14080 0 512 512
ReadX 14080 1762 512 512
ReadX 14080 2274 512 512
QUERY_FILE_INFORMATION 14080
QUERY_FILE_INFORMATION 14080
ReadX 14080 1750 512 512
ReadX 14080 2262 512 512
ReadX 14080 2774 512 512
ReadX 14080 3286 512 512
ReadX 14080 3798 512 512
ReadX 14080 4310 512 512
ReadX 14080 512 2048 2048
QUERY_FILE_INFORMATION 14080
QUERY_FILE_INFORMATION 14080
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14082
Close 14082
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14084
WriteX 14084 4080 1 1
QUERY_FILE_INFORMATION 14084
WriteX 14084 0 65471 65471
WriteX 14084 65471 65 65
WriteX 14084 65536 49 49
Close 14084
Close 14080
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 14085
WriteX 14085 0 65471 65471
WriteX 14085 65471 63 63
WriteX 14085 65534 65471 65471
WriteX 14085 131005 63 63
Close 14085
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 14086
WriteX 14086 0 65471 65471
WriteX 14086 65471 63 63
WriteX 14086 65534 65471 65471
WriteX 14086 131005 63 63
WriteX 14086 131068 65471 65471
WriteX 14086 196539 63 63
WriteX 14086 196602 65471 65471
WriteX 14086 262073 63 63
Close 14086
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 14087
WriteX 14087 0 65471 65471
WriteX 14087 65471 63 63
WriteX 14087 65534 65471 65471
WriteX 14087 131005 63 63
WriteX 14087 131068 65471 65471
WriteX 14087 196539 63 63
WriteX 14087 196602 65471 65471
WriteX 14087 262073 63 63
WriteX 14087 262136 65471 65471
WriteX 14087 327607 63 63
WriteX 14087 327670 65471 65471
WriteX 14087 393141 63 63
WriteX 14087 393204 65471 65471
WriteX 14087 458675 63 63
WriteX 14087 458738 65471 65471
WriteX 14087 524209 63 63
Close 14087
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14088
Close 14088
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 14089
Close 14089
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14092
Close 14092
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 14094
Close 14094
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 14095
Close 14095
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 5811
Close 5811
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 5813
Close 5813
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 5814
Close 5814
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5817
Close 5817
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5821
Close 5821
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5825
Close 5825
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5829
Close 5829
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5833
Close 5833
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5837
Close 5837
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5841
Close 5841
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 5845
Close 5845
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 5847
Close 5847
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 5849
Close 5849
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 5851
WriteX 5851 4095 1 1
QUERY_FILE_INFORMATION 5851
QUERY_FS_INFORMATION 259
WriteX 5851 0 65471 65471
WriteX 5851 65471 65 65
WriteX 5851 65536 65471 65471
WriteX 5851 131007 65 65
WriteX 5851 131072 65471 65471
WriteX 5851 196543 65 65
WriteX 5851 196608 65471 65471
WriteX 5851 262079 65 65
WriteX 5851 262144 26634 26634
Close 5851
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 5856
QUERY_FILE_INFORMATION 5856
QUERY_FILE_INFORMATION 5856
Close 5856
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 5857
Close 5857
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 5858
Close 5858
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 5859
QUERY_FILE_INFORMATION 5859
ReadX 5859 0 512 512
ReadX 5859 288 512 512
ReadX 5859 800 512 512
Close 5859
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 5860
ReadX 5860 0 24 24
Close 5860
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 5861
ReadX 5861 0 24 24
Close 5861
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 5862
QUERY_FILE_INFORMATION 5862
ReadX 5862 0 512 512
ReadX 5862 288 512 512
ReadX 5862 800 512 512
ReadX 5862 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 5862 1759 2849 2849
Close 5862
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 5863
Close 5863
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 5866
Close 5866
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 5868
Close 5868
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 5869
Close 5869
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 5872
Close 5872
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 5874
Close 5874
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5875
Close 5875
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5878
Close 5878
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5882
Close 5882
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5886
Close 5886
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5890
Close 5890
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 5894
Close 5894
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 5898
Close 5898
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5901
Close 5901
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5905
Close 5905
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5909
Close 5909
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 5911
Close 5911
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 5912
Close 5912
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 5921
QUERY_FILE_INFORMATION 5921
QUERY_FILE_INFORMATION 5921
Close 5921
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 5922
Close 5922
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 5923
Close 5923
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 5924
QUERY_FILE_INFORMATION 5924
ReadX 5924 0 512 512
ReadX 5924 288 512 512
ReadX 5924 800 512 512
Close 5924
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 5925
ReadX 5925 0 24 24
Close 5925
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 5926
QUERY_FILE_INFORMATION 5926
ReadX 5926 0 512 512
ReadX 5926 288 512 512
ReadX 5926 800 512 512
ReadX 5926 512 36 36
Close 5926
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 5927
QUERY_FILE_INFORMATION 5927
ReadX 5927 0 512 512
ReadX 5927 288 512 512
ReadX 5927 800 512 512
ReadX 5927 512 682 682
ReadX 5927 3584 106 106
ReadX 5927 3712 10 10
ReadX 5927 3722 10 10
ReadX 5927 512 2048 2048
ReadX 5927 3072 512 512
ReadX 5927 276 84 84
ReadX 5927 273 49 49
ReadX 5927 2560 512 512
Close 5927
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 5937
QUERY_FILE_INFORMATION 5937
QUERY_FILE_INFORMATION 5937
Close 5937
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 5938
Close 5938
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 5939
Close 5939
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 5940
QUERY_FILE_INFORMATION 5940
ReadX 5940 0 512 512
ReadX 5940 288 512 512
ReadX 5940 800 512 512
Close 5940
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 5941
ReadX 5941 0 24 24
Close 5941
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 5942
QUERY_FILE_INFORMATION 5942
ReadX 5942 0 512 512
ReadX 5942 288 512 512
ReadX 5942 800 512 512
ReadX 5942 512 36 36
Close 5942
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 5943
QUERY_FILE_INFORMATION 5943
ReadX 5943 0 512 512
ReadX 5943 288 512 512
ReadX 5943 800 512 512
ReadX 5943 512 682 682
ReadX 5943 3072 106 106
ReadX 5943 3200 10 10
ReadX 5943 3210 10 10
ReadX 5943 512 2048 2048
ReadX 5943 2560 512 512
ReadX 5943 3887 84 84
ReadX 5943 3838 49 49
ReadX 5943 2048 512 512
Close 5943
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 5944
Close 5944
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 5945
QUERY_FILE_INFORMATION 5945
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 5945
QUERY_FILE_INFORMATION 5945
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 5946
QUERY_FILE_INFORMATION 5946
QUERY_FILE_INFORMATION 5946
QUERY_FILE_INFORMATION 5946
ReadX 5946 2156 24 24
ReadX 5946 2139 276 276
ReadX 5946 2136 14 14
ReadX 5946 2136 7 7
ReadX 5946 2138 12 12
ReadX 5946 2137 8 8
ReadX 5946 2135 15 15
ReadX 5946 0 16 16
ReadX 5946 16 2048 2048
ReadX 5946 2064 2048 2048
ReadX 5946 257 2048 2048
ReadX 5946 385 2048 2048
ReadX 5946 513 2048 2048
ReadX 5946 641 2048 2048
ReadX 5946 769 2048 2048
ReadX 5946 897 2048 2048
ReadX 5946 1025 2048 2048
ReadX 5946 1153 2048 2048
ReadX 5946 1281 2048 2048
ReadX 5946 1409 2048 2048
ReadX 5946 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 5948
Close 5948
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5950
WriteX 5950 15 1 1
QUERY_FILE_INFORMATION 5950
WriteX 5950 0 10575 10575
Flush 5950
Close 5950
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5951
Close 5951
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 5952
QUERY_FILE_INFORMATION 5952
QUERY_FILE_INFORMATION 5952
QUERY_FILE_INFORMATION 5952
ReadX 5952 2157 24 24
ReadX 5952 2139 276 276
ReadX 5952 2137 14 14
ReadX 5952 2137 7 7
ReadX 5952 2139 12 12
ReadX 5952 2138 8 8
ReadX 5952 2136 15 15
Close 5946
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 5953
Close 5953
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 5954
QUERY_FILE_INFORMATION 5954
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 5955
QUERY_FILE_INFORMATION 5955
ReadX 5955 0 512 512
ReadX 5955 512 512 512
ReadX 5955 1024 512 512
QUERY_FILE_INFORMATION 5955
QUERY_FILE_INFORMATION 5955
Close 5955
QUERY_FILE_INFORMATION 5954
ReadX 5954 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 5956
QUERY_FILE_INFORMATION 5956
ReadX 5956 0 512 512
ReadX 5956 512 512 512
ReadX 5956 1024 512 512
ReadX 5956 288 20 20
ReadX 5956 308 2084 2084
ReadX 5956 388 2084 2084
ReadX 5956 388 2084 2084
ReadX 5945 2157 1386 1386
ReadX 5956 2472 399 399
ReadX 5956 3072 1536 1536
ReadX 5956 544 149 149
ReadX 5956 693 485 485
Close 5956
ReadX 5945 2157 4096 4096
ReadX 5945 6253 4096 4096
ReadX 5945 10349 4096 4096
ReadX 5945 14445 4096 4096
ReadX 5945 18541 4096 4096
ReadX 5945 22637 256 256
ReadX 5945 22893 4096 4096
ReadX 5945 26989 4096 4096
ReadX 5945 31085 4096 4096
ReadX 5945 35181 4096 4096
ReadX 5945 39277 4096 4096
ReadX 5945 43373 4096 4096
ReadX 5945 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 5945 2157 1024 1024
ReadX 5945 1667 4688 4688
ReadX 5945 6355 3516 3516
ReadX 5945 9871 16384 16384
ReadX 5945 26255 3771 3771
ReadX 5945 30026 2048 2048
ReadX 5945 32074 1024 1024
ReadX 5945 33098 6652 6652
ReadX 5945 39750 16384 16384
ReadX 5945 56134 10496 10496
ReadX 5945 66630 1784 1784
ReadX 5945 68414 90 90
ReadX 5945 68504 273 273
ReadX 5945 68777 1600 1600
ReadX 5945 70377 640 640
ReadX 5945 71017 1280 1280
ReadX 5945 72297 8464 8464
ReadX 5945 80761 158 158
ReadX 5945 80919 912 912
ReadX 5945 81831 1980 1980
ReadX 5945 83811 2256 2256
ReadX 5945 86067 400 400
ReadX 5945 86467 252 252
ReadX 5945 86719 42 42
ReadX 5945 86761 725 725
ReadX 5945 2009 512 512
ReadX 5945 3895 9 9
ReadX 5945 3781 46 46
ReadX 5945 4059 92 92
ReadX 5945 3781 92 92
ReadX 5945 3986 184 184
ReadX 5945 3987 16384 16384
ReadX 5945 3902 16384 16384
ReadX 5945 3781 10240 10240
ReadX 5945 3821 16384 16384
ReadX 5945 3891 935 935
ReadX 5945 4060 10240 10240
ReadX 5945 4059 184 184
ReadX 5945 256 184 184
ReadX 5945 256 1026 1026
ReadX 5945 3901 326 326
ReadX 5945 3899 652 652
ReadX 5945 256 2 2
ReadX 5945 258 4948 4948
Close 5945
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 5958
Close 5958
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 5960
WriteX 5960 4055 1 1
QUERY_FILE_INFORMATION 5960
WriteX 5960 0 65471 65471
WriteX 5960 65471 65 65
WriteX 5960 65536 65471 65471
WriteX 5960 131007 65 65
WriteX 5960 131072 65471 65471
WriteX 5960 196543 65 65
WriteX 5960 196608 65471 65471
WriteX 5960 262079 65 65
WriteX 5960 262144 65471 65471
WriteX 5960 327615 65 65
WriteX 5960 327680 65471 65471
WriteX 5960 393151 65 65
WriteX 5960 393216 65471 65471
WriteX 5960 458687 65 65
WriteX 5960 458752 65471 65471
WriteX 5960 524223 65 65
WriteX 5960 524288 65471 65471
WriteX 5960 589759 65 65
WriteX 5960 589824 35257 35257
Close 5960
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 5962
Close 5962
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 5964
WriteX 5964 4055 1 1
QUERY_FILE_INFORMATION 5964
WriteX 5964 0 65471 65471
WriteX 5964 65471 65 65
WriteX 5964 65536 65471 65471
WriteX 5964 131007 65 65
WriteX 5964 131072 65471 65471
WriteX 5964 196543 65 65
WriteX 5964 196608 65471 65471
WriteX 5964 262079 65 65
WriteX 5964 262144 65471 65471
WriteX 5964 327615 65 65
WriteX 5964 327680 65471 65471
WriteX 5964 393151 65 65
WriteX 5964 393216 65471 65471
WriteX 5964 458687 65 65
WriteX 5964 458752 65471 65471
WriteX 5964 524223 65 65
WriteX 5964 524288 65471 65471
WriteX 5964 589759 65 65
WriteX 5964 589824 57598 57598
Close 5964
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5966
WriteX 5966 15 1 1
QUERY_FILE_INFORMATION 5966
WriteX 5966 0 12543 12543
Flush 5966
Close 5966
Close 5952
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5967
Close 5967
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 5968
QUERY_FILE_INFORMATION 5968
QUERY_FILE_INFORMATION 5968
QUERY_FILE_INFORMATION 5968
ReadX 5968 288 24 24
ReadX 5968 287 276 276
ReadX 5968 286 14 14
ReadX 5968 286 7 7
ReadX 5968 287 12 12
ReadX 5968 287 8 8
ReadX 5968 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 5969
Close 5969
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 5970
QUERY_FILE_INFORMATION 5970
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 5970
QUERY_FILE_INFORMATION 5970
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 5971
QUERY_FILE_INFORMATION 5971
QUERY_FILE_INFORMATION 5971
QUERY_FILE_INFORMATION 5971
ReadX 5971 1938 24 24
ReadX 5971 1920 276 276
ReadX 5971 1918 14 14
ReadX 5971 1918 7 7
ReadX 5971 1919 12 12
ReadX 5971 1919 8 8
ReadX 5971 1917 15 15
ReadX 5971 0 16 16
ReadX 5971 16 2048 2048
ReadX 5971 2064 2048 2048
ReadX 5971 257 2048 2048
ReadX 5971 385 2048 2048
ReadX 5971 513 2048 2048
ReadX 5971 641 2048 2048
ReadX 5971 769 2048 2048
ReadX 5971 897 2048 2048
ReadX 5971 1025 2048 2048
ReadX 5971 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 5973
Close 5973
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5975
WriteX 5975 15 1 1
QUERY_FILE_INFORMATION 5975
WriteX 5975 0 11588 11588
Flush 5975
Close 5975
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5976
Close 5976
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 5977
QUERY_FILE_INFORMATION 5977
QUERY_FILE_INFORMATION 5977
QUERY_FILE_INFORMATION 5977
ReadX 5977 1909 24 24
ReadX 5977 1892 276 276
ReadX 5977 1889 14 14
ReadX 5977 1889 7 7
ReadX 5977 1891 12 12
ReadX 5977 1890 8 8
ReadX 5977 1888 15 15
Close 5971
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5979
WriteX 5979 15 1 1
QUERY_FILE_INFORMATION 5979
WriteX 5979 0 11615 11615
Flush 5979
Close 5979
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 5977
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5980
Close 5980
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 5981
QUERY_FILE_INFORMATION 5981
QUERY_FILE_INFORMATION 5981
QUERY_FILE_INFORMATION 5981
ReadX 5981 1947 24 24
ReadX 5981 1929 276 276
ReadX 5981 1927 14 14
ReadX 5981 1927 7 7
ReadX 5981 1929 12 12
ReadX 5981 1928 8 8
ReadX 5981 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 5983
Close 5983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 5985
WriteX 5985 4088 1 1
QUERY_FILE_INFORMATION 5985
WriteX 5985 0 65471 65471
WriteX 5985 65471 65 65
WriteX 5985 65536 16050 16050
Close 5985
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 5970 1939 64 64
ReadX 5970 128 248 248
ReadX 5970 128 568 568
ReadX 5970 3872 1536 1536
ReadX 5970 3456 2560 2560
ReadX 5970 3136 512 512
ReadX 5970 2880 4096 4096
ReadX 5970 3264 3072 3072
ReadX 5970 320 4096 4096
ReadX 5970 1024 4096 4096
ReadX 5970 3616 4096 4096
ReadX 5970 1939 64 64
ReadX 5970 128 248 248
ReadX 5970 128 608 608
ReadX 5970 2858 1024 1024
ReadX 5970 2810 4096 4096
ReadX 5970 2826 4096 4096
ReadX 5970 2580 2048 2048
ReadX 5970 2800 2560 2560
ReadX 5970 2100 4096 4096
ReadX 5970 2084 4096 4096
ReadX 5970 868 4096 4096
ReadX 5970 2324 4096 4096
ReadX 5970 884 4096 4096
ReadX 5970 2604 1024 1024
ReadX 5970 580 4096 4096
ReadX 5970 596 4096 4096
ReadX 5970 2752 4096 4096
ReadX 5970 2842 1024 1024
ReadX 5970 660 4096 4096
ReadX 5970 2720 4096 4096
ReadX 5970 2736 4096 4096
ReadX 5970 628 4096 4096
ReadX 5970 2704 4096 4096
ReadX 5970 1556 4096 4096
ReadX 5970 576 4096 4096
ReadX 5970 3168 1536 1536
ReadX 5970 832 4096 4096
ReadX 5970 1088 4096 4096
ReadX 5970 1344 4096 4096
ReadX 5970 1600 4096 4096
ReadX 5970 1856 4096 4096
ReadX 5970 2112 4096 4096
ReadX 5970 1892 4096 4096
ReadX 5970 820 4096 4096
ReadX 5970 788 4096 4096
ReadX 5970 1604 4096 4096
ReadX 5970 3648 4096 4096
ReadX 5970 2608 4096 4096
ReadX 5970 548 4096 4096
ReadX 5970 740 4096 4096
ReadX 5970 1344 4096 4096
ReadX 5970 3392 4096 4096
ReadX 5970 3904 4096 4096
ReadX 5970 644 4096 4096
ReadX 5970 676 4096 4096
ReadX 5970 2688 4096 4096
ReadX 5970 320 4096 4096
ReadX 5970 900 4096 4096
ReadX 5970 1908 4096 4096
ReadX 5970 852 4096 4096
ReadX 5970 724 4096 4096
ReadX 5970 2292 4096 4096
ReadX 5970 612 4096 4096
ReadX 5970 388 4096 4096
ReadX 5970 2368 4096 4096
ReadX 5970 2624 4096 4096
ReadX 5970 500 4096 4096
ReadX 5970 356 4096 4096
ReadX 5970 1024 4096 4096
ReadX 5970 576 4096 4096
ReadX 5970 340 4096 4096
ReadX 5970 420 4096 4096
ReadX 5970 1600 4096 4096
ReadX 5970 404 4096 4096
ReadX 5970 1428 4096 4096
ReadX 5970 2656 4096 4096
ReadX 5970 2624 4096 4096
ReadX 5970 452 4096 4096
ReadX 5970 692 4096 4096
ReadX 5970 564 4096 4096
ReadX 5970 372 4096 4096
ReadX 5970 468 4096 4096
ReadX 5970 484 4096 4096
ReadX 5970 1088 4096 4096
ReadX 5970 1924 4096 4096
ReadX 5970 2768 4096 4096
ReadX 5970 832 4096 4096
ReadX 5970 836 4096 4096
ReadX 5970 1856 4096 4096
ReadX 5970 2640 4096 4096
ReadX 5970 436 4096 4096
ReadX 5970 1828 4096 4096
ReadX 5970 804 4096 4096
ReadX 5970 1860 4096 4096
ReadX 5970 1812 4096 4096
ReadX 5970 756 4096 4096
ReadX 5970 1636 4096 4096
ReadX 5970 772 4096 4096
ReadX 5970 2036 4096 4096
ReadX 5970 1220 4096 4096
ReadX 5970 1652 4096 4096
ReadX 5970 2588 4096 4096
ReadX 5970 916 4096 4096
ReadX 5970 260 4096 4096
ReadX 5970 932 4096 4096
ReadX 5970 2624 4096 4096
ReadX 5970 308 4096 4096
ReadX 5970 292 4096 4096
ReadX 5970 1140 4096 4096
ReadX 5970 276 4096 4096
ReadX 5970 2020 4096 4096
ReadX 5970 2880 4096 4096
ReadX 5970 516 4096 4096
ReadX 5970 1844 4096 4096
ReadX 5970 1124 4096 4096
ReadX 5970 3136 4096 4096
ReadX 5970 324 4096 4096
ReadX 5970 1156 4096 4096
ReadX 5970 1172 4096 4096
ReadX 5970 2112 4096 4096
ReadX 5970 2368 4096 4096
ReadX 5970 964 4096 4096
ReadX 5970 980 4096 4096
ReadX 5970 1012 4096 4096
ReadX 5970 532 4096 4096
ReadX 5970 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 5970 1620 4096 4096
ReadX 5970 1604 4096 4096
ReadX 5970 2116 4096 4096
ReadX 5970 2132 4096 4096
ReadX 5970 2148 4096 4096
ReadX 5970 2276 4096 4096
ReadX 5970 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 5987
Close 5987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 5989
QUERY_FILE_INFORMATION 5954
WriteX 5989 4088 1 1
QUERY_FILE_INFORMATION 5989
QUERY_FILE_INFORMATION 5954
Close 5954
WriteX 5989 0 65471 65471
WriteX 5989 65471 65 65
WriteX 5989 65536 64850 64850
Close 5989
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5991
WriteX 5991 15 1 1
QUERY_FILE_INFORMATION 5991
ReadX 5970 2068 4096 4096
ReadX 5970 1588 4096 4096
ReadX 5970 1572 4096 4096
WriteX 5991 0 5618 5618
WriteX 5991 0 18630 18630
Flush 5991
Close 5991
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 5981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5992
Close 5992
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 5993
QUERY_FILE_INFORMATION 5993
QUERY_FILE_INFORMATION 5993
QUERY_FILE_INFORMATION 5993
ReadX 5993 661 24 24
ReadX 5993 659 356 356
ReadX 5993 659 14 14
ReadX 5993 659 7 7
ReadX 5993 659 12 12
ReadX 5993 659 8 8
ReadX 5993 659 15 15
ReadX 5993 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 5970 612 4096 4096
ReadX 5970 564 4096 4096
ReadX 5970 1876 4096 4096
ReadX 5970 628 4096 4096
ReadX 5970 740 4096 4096
ReadX 5970 724 4096 4096
ReadX 5970 644 4096 4096
ReadX 5970 2324 4096 4096
ReadX 5970 660 4096 4096
ReadX 5970 852 4096 4096
ReadX 5970 868 4096 4096
Close 5993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 5968
ReadX 5970 2368 4096 4096
ReadX 5970 1024 4096 4096
ReadX 5970 320 4096 4096
ReadX 5970 580 4096 4096
ReadX 5970 3136 512 512
ReadX 5970 2880 4096 4096
Close 5970
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 5994
WriteX 5994 0 65471 65471
WriteX 5994 65471 63 63
WriteX 5994 65534 65471 65471
WriteX 5994 131005 63 63
Close 5994
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 5995
WriteX 5995 0 65471 65471
WriteX 5995 65471 63 63
WriteX 5995 65534 65471 65471
WriteX 5995 131005 63 63
WriteX 5995 131068 65471 65471
WriteX 5995 196539 63 63
WriteX 5995 196602 65471 65471
WriteX 5995 262073 63 63
Close 5995
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 5996
WriteX 5996 0 65471 65471
WriteX 5996 65471 63 63
WriteX 5996 65534 65471 65471
WriteX 5996 131005 63 63
WriteX 5996 131068 65471 65471
WriteX 5996 196539 63 63
WriteX 5996 196602 65471 65471
WriteX 5996 262073 63 63
WriteX 5996 262136 65471 65471
WriteX 5996 327607 63 63
WriteX 5996 327670 65471 65471
WriteX 5996 393141 63 63
WriteX 5996 393204 65471 65471
WriteX 5996 458675 63 63
WriteX 5996 458738 65471 65471
WriteX 5996 524209 63 63
Close 5996
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 5997
Close 5997
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 5998
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 5998 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 5999
ReadX 5999 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6000
ReadX 6000 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6001
ReadX 6001 0 511 511
ReadX 5998 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 5998
Close 5999
Close 6000
Close 6001
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6002
ReadX 6002 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6003
ReadX 6003 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6004
ReadX 6004 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6005
ReadX 6005 0 511 511
ReadX 6002 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 6006
FIND_FIRST \clients\client1\~dmtmp\*
Close 6006
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 6007
QUERY_FILE_INFORMATION 6007
WriteX 6007 2047 1 1
QUERY_FILE_INFORMATION 6007
WriteX 6007 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 6008
Close 6008
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 6009
WriteX 6009 52 1 1
QUERY_FILE_INFORMATION 6009
WriteX 6009 0 53 53
WriteX 6009 53 28 28
WriteX 6009 81 4 4
WriteX 6009 85 28 28
WriteX 6009 113 38 38
WriteX 6009 151 28 28
WriteX 6009 179 2 2
WriteX 6009 181 28 28
WriteX 6009 209 3 3
WriteX 6009 212 279 279
WriteX 6009 9 4 4
Close 6009
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 6010
ReadX 6010 0 53 53
ReadX 6010 53 28 28
ReadX 6010 81 4 4
ReadX 6010 85 28 28
ReadX 6010 113 38 38
ReadX 6010 151 28 28
ReadX 6010 179 2 2
ReadX 6010 181 28 28
ReadX 6010 209 3 3
Close 6010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 6002
Close 6003
Close 6004
Close 6005
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6011
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6011 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6012
ReadX 6012 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6013
ReadX 6013 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6014
ReadX 6014 0 511 511
ReadX 6011 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 6016
Close 6016
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6017
WriteX 6017 52 1 1
QUERY_FILE_INFORMATION 6017
WriteX 6017 0 53 53
WriteX 6017 53 28 28
WriteX 6017 81 28 28
WriteX 6017 109 28 28
WriteX 6017 137 28 28
WriteX 6017 165 28 28
WriteX 6017 193 28 28
WriteX 6017 221 28 28
WriteX 6017 249 4 4
WriteX 6017 253 4 4
WriteX 6017 257 4 4
WriteX 6017 261 28 28
WriteX 6017 289 2 2
WriteX 6017 291 2 2
WriteX 6017 293 2 2
WriteX 6017 295 248 248
WriteX 6017 9 4 4
Close 6017
Close 6011
Close 6012
Close 6013
Close 6014
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6018
ReadX 6018 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6019
ReadX 6019 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6020
ReadX 6020 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6021
ReadX 6021 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6022
ReadX 6022 0 53 53
ReadX 6022 53 28 28
ReadX 6022 81 28 28
ReadX 6022 109 28 28
ReadX 6022 137 28 28
ReadX 6022 165 28 28
ReadX 6022 193 28 28
ReadX 6022 221 28 28
ReadX 6022 249 4 4
ReadX 6022 253 4 4
ReadX 6022 257 4 4
ReadX 6022 261 28 28
ReadX 6022 289 2 2
ReadX 6022 291 2 2
ReadX 6022 293 2 2
Close 6022
ReadX 6018 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6018
Close 6019
Close 6020
Close 6021
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 6007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6023
Close 6023
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6024
ReadX 6024 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6025
ReadX 6025 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6026
ReadX 6026 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6027
ReadX 6027 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6028
ReadX 6028 0 53 53
ReadX 6028 53 28 28
ReadX 6028 81 28 28
ReadX 6028 109 28 28
ReadX 6028 137 28 28
ReadX 6028 165 28 28
ReadX 6028 193 28 28
ReadX 6028 221 28 28
ReadX 6028 249 4 4
ReadX 6028 253 4 4
ReadX 6028 257 4 4
ReadX 6028 261 28 28
ReadX 6028 289 2 2
ReadX 6028 291 2 2
ReadX 6028 293 2 2
Close 6028
ReadX 6024 2048 2048 2048
Close 6024
Close 6025
Close 6026
Close 6027
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6029
ReadX 6029 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6030
ReadX 6030 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6031
ReadX 6031 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6032
ReadX 6032 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6033
ReadX 6033 0 53 53
ReadX 6033 53 28 28
ReadX 6033 81 28 28
ReadX 6033 109 28 28
ReadX 6033 137 28 28
ReadX 6033 165 28 28
ReadX 6033 193 28 28
ReadX 6033 221 28 28
ReadX 6033 249 4 4
ReadX 6033 253 4 4
ReadX 6033 257 4 4
ReadX 6033 261 28 28
ReadX 6033 289 2 2
ReadX 6033 291 2 2
ReadX 6033 293 2 2
Close 6033
ReadX 6029 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 6037
FIND_FIRST \clients\client1\~dmtmp\*
Close 6037
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6038
QUERY_FILE_INFORMATION 6038
WriteX 6038 2047 1 1
QUERY_FILE_INFORMATION 6038
WriteX 6038 0 2048 2048
Close 6038
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6039
ReadX 6039 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 6039
Close 6029
Close 6030
Close 6031
Close 6032
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6040
ReadX 6040 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 6040 4095 1 1
QUERY_FILE_INFORMATION 6040
WriteX 6040 2048 2048 2048
QUERY_FILE_INFORMATION 6040
Flush 6040
WriteX 6040 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6041
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6041 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6042
ReadX 6042 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6043
ReadX 6043 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6044
ReadX 6044 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6045
ReadX 6045 0 53 53
ReadX 6045 53 28 28
ReadX 6045 81 28 28
ReadX 6045 109 28 28
ReadX 6045 137 28 28
ReadX 6045 165 28 28
ReadX 6045 193 28 28
ReadX 6045 221 28 28
ReadX 6045 249 4 4
ReadX 6045 253 4 4
ReadX 6045 257 4 4
ReadX 6045 261 28 28
ReadX 6045 289 2 2
ReadX 6045 291 2 2
ReadX 6045 293 2 2
Close 6045
ReadX 6041 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 6049
FIND_FIRST \clients\client1\~dmtmp\*
Close 6049
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6050
QUERY_FILE_INFORMATION 6050
WriteX 6050 2047 1 1
QUERY_FILE_INFORMATION 6050
WriteX 6050 0 2048 2048
Close 6050
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6051
ReadX 6051 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 6055
Close 6055
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6056
QUERY_FILE_INFORMATION 6056
WriteX 6056 2047 1 1
QUERY_FILE_INFORMATION 6056
WriteX 6056 0 2048 2048
Close 6056
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6057
ReadX 6057 0 511 511
ReadX 6041 384 2048 2048
ReadX 6041 768 16384 16384
ReadX 6041 1792 14336 14336
Close 6057
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6058
ReadX 6058 0 511 511
Close 6058
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6060
Close 6060
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 6051 4095 1 1
QUERY_FILE_INFORMATION 6051
WriteX 6051 2048 2048 2048
WriteX 6051 0 88 88
Close 6051
WriteX 6041 1152 2048 2048
WriteX 6041 1408 6144 6144
WriteX 6041 1920 2048 2048
WriteX 6041 0 88 88
Close 6041
WriteX 6042 0 88 88
Close 6042
WriteX 6043 0 88 88
Close 6043
Close 6044
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6061
ReadX 6061 0 511 511
ReadX 6061 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6061
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6062
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6062 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6063
ReadX 6063 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6064
ReadX 6064 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6065
ReadX 6065 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6066
ReadX 6066 0 53 53
ReadX 6066 53 28 28
ReadX 6066 81 28 28
ReadX 6066 109 28 28
ReadX 6066 137 28 28
ReadX 6066 165 28 28
ReadX 6066 193 28 28
ReadX 6066 221 28 28
ReadX 6066 249 4 4
ReadX 6066 253 4 4
ReadX 6066 257 4 4
ReadX 6066 261 28 28
ReadX 6066 289 2 2
ReadX 6066 291 2 2
ReadX 6066 293 2 2
Close 6066
ReadX 6062 2048 2048 2048
Close 6062
Close 6063
Close 6064
Close 6065
Close 6040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6067
QUERY_FILE_INFORMATION 6067
Close 6067
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6068
Close 6068
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6069
ReadX 6069 0 511 511
ReadX 6069 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6070
ReadX 6070 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6071
ReadX 6071 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6072
ReadX 6072 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6073
ReadX 6073 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6074
ReadX 6074 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6075
ReadX 6075 0 53 53
ReadX 6075 53 2 2
ReadX 6075 55 2 2
ReadX 6075 57 184 184
ReadX 6075 241 298 298
Close 6075
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6076
ReadX 6076 0 41 41
ReadX 6069 2048 2048 2048
Close 6076
Close 6069
Close 6070
Close 6073
Close 6074
Close 6071
Close 6072
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6077
ReadX 6077 0 511 511
ReadX 6077 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6078
ReadX 6078 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6079
ReadX 6079 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6080
ReadX 6080 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6081
ReadX 6081 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6082
ReadX 6082 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6083
ReadX 6083 0 53 53
ReadX 6083 53 2 2
ReadX 6083 55 2 2
ReadX 6083 57 184 184
ReadX 6083 241 298 298
Close 6083
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6084
ReadX 6084 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6085
ReadX 6085 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6086
ReadX 6086 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6087
ReadX 6087 0 511 511
ReadX 6086 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6088
ReadX 6088 0 53 53
ReadX 6088 53 2 2
ReadX 6088 55 480 480
ReadX 6088 535 2 2
Close 6088
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6089
ReadX 6089 0 41 41
ReadX 6077 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 6093
FIND_FIRST \clients\client1\~dmtmp\*
Close 6093
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 6094
QUERY_FILE_INFORMATION 6094
WriteX 6094 2047 1 1
QUERY_FILE_INFORMATION 6094
WriteX 6094 0 2048 2048
Close 6094
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 6095
ReadX 6095 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 6095
Close 6084
Close 6085
Close 6086
Close 6087
Close 6089
Close 6077
Close 6078
Close 6081
Close 6082
Close 6079
Close 6080
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 6096
ReadX 6096 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6097
Close 6097
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6098
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6098 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6099
ReadX 6099 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6100
ReadX 6100 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6101
ReadX 6101 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6102
ReadX 6102 0 53 53
ReadX 6102 53 2 2
ReadX 6102 55 480 480
ReadX 6102 535 2 2
Close 6102
ReadX 6098 2048 2048 2048
Close 6098
Close 6099
Close 6100
Close 6101
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6103
ReadX 6103 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6104
ReadX 6104 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6105
ReadX 6105 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6106
ReadX 6106 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6107
ReadX 6107 0 53 53
ReadX 6107 53 2 2
ReadX 6107 55 480 480
ReadX 6107 535 2 2
Close 6107
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6108
ReadX 6108 0 511 511
ReadX 6108 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6109
ReadX 6109 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6110
ReadX 6110 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6111
ReadX 6111 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6112
ReadX 6112 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6113
ReadX 6113 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6114
ReadX 6114 0 41 41
ReadX 6108 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6115
ReadX 6115 0 53 53
ReadX 6115 53 2 2
ReadX 6115 55 2 2
ReadX 6115 57 184 184
ReadX 6115 241 298 298
Close 6115
ReadX 6103 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 6119
FIND_FIRST \clients\client1\~dmtmp\*
Close 6119
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 6120
QUERY_FILE_INFORMATION 6120
WriteX 6120 2047 1 1
QUERY_FILE_INFORMATION 6120
WriteX 6120 0 2048 2048
Close 6120
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 6121
ReadX 6121 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 6121
Close 6114
Close 6108
Close 6109
Close 6112
Close 6113
Close 6110
Close 6111
Close 6103
Close 6104
Close 6105
Close 6106
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 6122
ReadX 6122 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 6096 4095 1 1
QUERY_FILE_INFORMATION 6096
WriteX 6096 2048 2048 2048
QUERY_FILE_INFORMATION 6096
Flush 6096
WriteX 6096 0 88 88
WriteX 6122 4095 1 1
QUERY_FILE_INFORMATION 6122
WriteX 6122 2048 2048 2048
QUERY_FILE_INFORMATION 6122
Flush 6122
WriteX 6122 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6123
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6123 0 511 511
ReadX 6123 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6124
ReadX 6124 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6125
ReadX 6125 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6126
ReadX 6126 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6127
ReadX 6127 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6128
ReadX 6128 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6129
ReadX 6129 0 53 53
ReadX 6129 53 2 2
ReadX 6129 55 2 2
ReadX 6129 57 184 184
ReadX 6129 241 298 298
Close 6129
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6130
ReadX 6130 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6131
ReadX 6131 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6132
ReadX 6132 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6133
ReadX 6133 0 511 511
ReadX 6132 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6134
ReadX 6134 0 53 53
ReadX 6134 53 2 2
ReadX 6134 55 480 480
ReadX 6134 535 2 2
Close 6134
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6135
ReadX 6135 0 41 41
ReadX 6123 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6136
ReadX 6136 0 53 53
ReadX 6136 53 2 2
ReadX 6136 55 480 480
ReadX 6136 535 2 2
Close 6136
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6137
ReadX 6137 0 53 53
ReadX 6137 53 2 2
ReadX 6137 55 2 2
ReadX 6137 57 184 184
ReadX 6137 241 298 298
Close 6137
ReadX 6130 2048 2048 2048
ReadX 6131 2048 2048 2048
ReadX 6130 320 16384 16384
ReadX 6130 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 6138
FIND_FIRST \clients\client1\~dmtmp\*
Close 6138
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 6139
QUERY_FILE_INFORMATION 6139
WriteX 6139 4095 1 1
QUERY_FILE_INFORMATION 6139
WriteX 6139 0 4096 4096
Close 6139
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 6140
ReadX 6140 0 41 41
Close 6130
Close 6131
Close 6132
Close 6133
Close 6135
Close 6123
Close 6124
Close 6127
Close 6128
Close 6125
Close 6126
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 6141
Close 6141
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 6142
QUERY_FILE_INFORMATION 6142
WriteX 6142 4095 1 1
QUERY_FILE_INFORMATION 6142
WriteX 6142 0 4096 4096
Close 6142
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 6143
ReadX 6143 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 6140
ReadX 6140 0 4096 4096
WriteX 6143 0 4096 4096
Close 6143
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 6145
ReadX 6145 0 41 41
Close 6140
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 6145
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 6146
Close 6146
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 6147
ReadX 6147 0 41 41
Close 6147
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 6148
Close 6148
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6149
QUERY_FILE_INFORMATION 6149
WriteX 6149 2047 1 1
QUERY_FILE_INFORMATION 6149
WriteX 6149 0 2048 2048
Close 6149
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6150
ReadX 6150 0 511 511
ReadX 6150 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 6151
ReadX 6151 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6151
Close 6150
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6152
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6152 0 511 511
ReadX 6152 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6153
ReadX 6153 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6154
ReadX 6154 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6155
ReadX 6155 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6156
ReadX 6156 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6157
ReadX 6157 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6158
ReadX 6158 0 53 53
ReadX 6158 53 2 2
ReadX 6158 55 2 2
ReadX 6158 57 184 184
ReadX 6158 241 298 298
Close 6158
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6159
ReadX 6159 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6160
ReadX 6160 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6161
ReadX 6161 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6162
ReadX 6162 0 511 511
ReadX 6161 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6163
ReadX 6163 0 53 53
ReadX 6163 53 2 2
ReadX 6163 55 480 480
ReadX 6163 535 2 2
Close 6163
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6164
ReadX 6164 0 41 41
ReadX 6152 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6165
ReadX 6165 0 53 53
ReadX 6165 53 2 2
ReadX 6165 55 480 480
ReadX 6165 535 2 2
Close 6165
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6166
ReadX 6166 0 53 53
ReadX 6166 53 2 2
ReadX 6166 55 2 2
ReadX 6166 57 184 184
ReadX 6166 241 298 298
Close 6166
ReadX 6159 2048 2048 2048
Close 6159
Close 6160
Close 6161
Close 6162
Close 6164
Close 6152
Close 6153
Close 6156
Close 6157
Close 6154
Close 6155
Close 6096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 6167
QUERY_FILE_INFORMATION 6167
Close 6167
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 6122
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 6168
QUERY_FILE_INFORMATION 6168
Close 6168
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6169
Close 6169
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6170
ReadX 6170 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6171
ReadX 6171 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6172
ReadX 6172 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6173
ReadX 6173 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6174
ReadX 6174 0 53 53
ReadX 6174 53 2 2
ReadX 6174 55 480 480
ReadX 6174 535 2 2
Close 6174
ReadX 6170 2048 2048 2048
Close 6170
Close 6171
Close 6172
Close 6173
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6175
ReadX 6175 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6176
ReadX 6176 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6177
ReadX 6177 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6178
ReadX 6178 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6179
ReadX 6179 0 53 53
ReadX 6179 53 2 2
ReadX 6179 55 480 480
ReadX 6179 535 2 2
Close 6179
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6180
ReadX 6180 0 511 511
ReadX 6180 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6181
ReadX 6181 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6182
ReadX 6182 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6183
ReadX 6183 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6184
ReadX 6184 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6185
ReadX 6185 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6186
ReadX 6186 0 41 41
ReadX 6180 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6187
ReadX 6187 0 53 53
ReadX 6187 53 2 2
ReadX 6187 55 2 2
ReadX 6187 57 184 184
ReadX 6187 241 298 298
Close 6187
ReadX 6175 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 6191
FIND_FIRST \clients\client1\~dmtmp\*
Close 6191
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 6192
QUERY_FILE_INFORMATION 6192
WriteX 6192 2047 1 1
QUERY_FILE_INFORMATION 6192
WriteX 6192 0 2048 2048
Close 6192
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 6193
ReadX 6193 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 6193
Close 6186
Close 6180
Close 6181
Close 6184
Close 6185
Close 6182
Close 6183
Close 6175
Close 6176
Close 6177
Close 6178
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 6194
ReadX 6194 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6195
Close 6195
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6196
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6196 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6197
ReadX 6197 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6198
ReadX 6198 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6199
ReadX 6199 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6200
ReadX 6200 0 53 53
ReadX 6200 53 28 28
ReadX 6200 81 28 28
ReadX 6200 109 28 28
ReadX 6200 137 28 28
ReadX 6200 165 28 28
ReadX 6200 193 28 28
ReadX 6200 221 28 28
ReadX 6200 249 4 4
ReadX 6200 253 4 4
ReadX 6200 257 4 4
ReadX 6200 261 28 28
ReadX 6200 289 2 2
ReadX 6200 291 2 2
ReadX 6200 293 2 2
Close 6200
ReadX 6196 2048 2048 2048
Close 6196
Close 6197
Close 6198
Close 6199
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6201
ReadX 6201 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6202
ReadX 6202 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6203
ReadX 6203 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6204
ReadX 6204 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6205
ReadX 6205 0 53 53
ReadX 6205 53 28 28
ReadX 6205 81 28 28
ReadX 6205 109 28 28
ReadX 6205 137 28 28
ReadX 6205 165 28 28
ReadX 6205 193 28 28
ReadX 6205 221 28 28
ReadX 6205 249 4 4
ReadX 6205 253 4 4
ReadX 6205 257 4 4
ReadX 6205 261 28 28
ReadX 6205 289 2 2
ReadX 6205 291 2 2
ReadX 6205 293 2 2
Close 6205
ReadX 6201 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 6209
FIND_FIRST \clients\client1\~dmtmp\*
Close 6209
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 6210
QUERY_FILE_INFORMATION 6210
WriteX 6210 2047 1 1
QUERY_FILE_INFORMATION 6210
WriteX 6210 0 2048 2048
Close 6210
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 6211
ReadX 6211 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 6211
Close 6201
Close 6202
Close 6203
Close 6204
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 6212
ReadX 6212 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6213
Close 6213
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6214
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6214 0 511 511
ReadX 6214 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6215
ReadX 6215 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6216
ReadX 6216 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6217
ReadX 6217 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6218
ReadX 6218 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6219
ReadX 6219 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6220
ReadX 6220 0 53 53
ReadX 6220 53 2 2
ReadX 6220 55 2 2
ReadX 6220 57 184 184
ReadX 6220 241 298 298
Close 6220
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6221
ReadX 6221 0 41 41
ReadX 6214 2048 2048 2048
Close 6221
Close 6214
Close 6215
Close 6218
Close 6219
Close 6216
Close 6217
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6222
ReadX 6222 0 511 511
ReadX 6222 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6223
ReadX 6223 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6224
ReadX 6224 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6225
ReadX 6225 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6226
ReadX 6226 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6227
ReadX 6227 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6228
ReadX 6228 0 53 53
ReadX 6228 53 2 2
ReadX 6228 55 2 2
ReadX 6228 57 184 184
ReadX 6228 241 298 298
Close 6228
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6229
ReadX 6229 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6230
ReadX 6230 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6231
ReadX 6231 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6232
ReadX 6232 0 511 511
ReadX 6231 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6233
ReadX 6233 0 53 53
ReadX 6233 53 2 2
ReadX 6233 55 480 480
ReadX 6233 535 2 2
Close 6233
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6234
ReadX 6234 0 41 41
ReadX 6222 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 6238
FIND_FIRST \clients\client1\~dmtmp\*
Close 6238
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 6239
QUERY_FILE_INFORMATION 6239
WriteX 6239 2047 1 1
QUERY_FILE_INFORMATION 6239
WriteX 6239 0 2048 2048
Close 6239
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 6240
ReadX 6240 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 6240
Close 6229
Close 6230
Close 6231
Close 6232
Close 6234
Close 6222
Close 6223
Close 6226
Close 6227
Close 6224
Close 6225
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 6241
ReadX 6241 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 6194 4095 1 1
QUERY_FILE_INFORMATION 6194
WriteX 6194 2048 2048 2048
QUERY_FILE_INFORMATION 6194
Flush 6194
WriteX 6194 0 88 88
WriteX 6212 4095 1 1
QUERY_FILE_INFORMATION 6212
WriteX 6212 2048 2048 2048
QUERY_FILE_INFORMATION 6212
Flush 6212
WriteX 6212 0 88 88
WriteX 6241 4095 1 1
QUERY_FILE_INFORMATION 6241
WriteX 6241 2048 2048 2048
QUERY_FILE_INFORMATION 6241
Flush 6241
WriteX 6241 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6242
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6242 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6243
ReadX 6243 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6244
ReadX 6244 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6245
ReadX 6245 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6246
ReadX 6246 0 53 53
ReadX 6246 53 2 2
ReadX 6246 55 480 480
ReadX 6246 535 2 2
Close 6246
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6247
ReadX 6247 0 511 511
ReadX 6247 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6248
ReadX 6248 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6249
ReadX 6249 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6250
ReadX 6250 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6251
ReadX 6251 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6252
ReadX 6252 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6253
ReadX 6253 0 41 41
ReadX 6247 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6254
ReadX 6254 0 53 53
ReadX 6254 53 2 2
ReadX 6254 55 2 2
ReadX 6254 57 184 184
ReadX 6254 241 298 298
Close 6254
ReadX 6242 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6255
ReadX 6255 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6256
ReadX 6256 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6257
ReadX 6257 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6258
ReadX 6258 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6259
ReadX 6259 0 53 53
ReadX 6259 53 28 28
ReadX 6259 81 28 28
ReadX 6259 109 28 28
ReadX 6259 137 28 28
ReadX 6259 165 28 28
ReadX 6259 193 28 28
ReadX 6259 221 28 28
ReadX 6259 249 4 4
ReadX 6259 253 4 4
ReadX 6259 257 4 4
ReadX 6259 261 28 28
ReadX 6259 289 2 2
ReadX 6259 291 2 2
ReadX 6259 293 2 2
Close 6259
ReadX 6255 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6260
ReadX 6260 0 53 53
ReadX 6260 53 2 2
ReadX 6260 55 2 2
ReadX 6260 57 184 184
ReadX 6260 241 298 298
Close 6260
ReadX 6244 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6261
ReadX 6261 0 53 53
ReadX 6261 53 2 2
ReadX 6261 55 480 480
ReadX 6261 535 2 2
Close 6261
ReadX 6255 4096 16384 16384
ReadX 6255 1280 16384 16384
ReadX 6255 2304 6144 6144
ReadX 6255 2688 2048 2048
ReadX 6242 4096 16384 16384
ReadX 6242 1280 16384 16384
ReadX 6242 2304 16384 16384
ReadX 6242 3328 16384 16384
ReadX 6242 272 16384 16384
ReadX 6242 336 16384 16384
ReadX 6242 400 16384 16384
ReadX 6242 464 16384 16384
ReadX 6242 528 16384 16384
ReadX 6242 592 16384 16384
ReadX 6242 656 16384 16384
ReadX 6242 720 16384 16384
ReadX 6242 784 16384 16384
ReadX 6242 848 16384 16384
ReadX 6242 912 16384 16384
ReadX 6248 2048 2048 2048
ReadX 6247 760 2048 2048
ReadX 6247 1144 2048 2048
ReadX 6247 408 2048 2048
ReadX 6247 912 2048 2048
ReadX 6247 1096 2048 2048
ReadX 6247 776 2048 2048
ReadX 6247 560 2048 2048
ReadX 6247 376 2048 2048
ReadX 6247 320 2048 2048
ReadX 6247 3072 2048 2048
ReadX 6247 784 2048 2048
ReadX 6247 2176 2048 2048
ReadX 6247 792 2048 2048
ReadX 6247 576 2048 2048
ReadX 6247 600 2048 2048
ReadX 6247 728 2048 2048
ReadX 6247 1112 2048 2048
ReadX 6247 664 2048 2048
ReadX 6247 976 2048 2048
ReadX 6247 3840 2048 2048
ReadX 6247 296 2048 2048
ReadX 6247 480 2048 2048
ReadX 6247 680 2048 2048
ReadX 6247 696 2048 2048
ReadX 6247 832 2048 2048
ReadX 6247 1016 2048 2048
ReadX 6247 1104 2048 2048
ReadX 6247 3200 2048 2048
ReadX 6247 264 2048 2048
ReadX 6247 448 2048 2048
ReadX 6247 648 2048 2048
ReadX 6247 1136 2048 2048
ReadX 6247 288 2048 2048
ReadX 6247 352 2048 2048
ReadX 6247 536 2048 2048
ReadX 6247 800 2048 2048
ReadX 6247 736 2048 2048
ReadX 6247 392 2048 2048
ReadX 6247 752 2048 2048
ReadX 6247 880 2048 2048
ReadX 6247 1064 2048 2048
ReadX 6247 1128 2048 2048
ReadX 6247 1536 2048 2048
ReadX 6247 2432 2048 2048
ReadX 6247 688 2048 2048
ReadX 6247 872 2048 2048
ReadX 6247 1072 2048 2048
ReadX 6247 984 2048 2048
ReadX 6247 704 2048 2048
ReadX 6247 3328 2048 2048
ReadX 6247 888 2048 2048
ReadX 6247 496 2048 2048
ReadX 6247 624 2048 2048
ReadX 6247 808 2048 2048
ReadX 6247 1008 2048 2048
ReadX 6247 1152 2048 2048
ReadX 6247 416 2048 2048
ReadX 6247 584 2048 2048
ReadX 6247 384 2048 2048
ReadX 6247 568 2048 2048
ReadX 6247 512 2048 2048
ReadX 6247 1408 2048 2048
ReadX 6247 472 2048 2048
ReadX 6247 672 2048 2048
ReadX 6247 2560 2048 2048
ReadX 6247 544 2048 2048
ReadX 6247 920 2048 2048
ReadX 6247 1120 2048 2048
ReadX 6247 2304 2048 2048
ReadX 6247 1080 2048 2048
ReadX 6247 1664 2048 2048
ReadX 6247 608 2048 2048
ReadX 6247 2688 2048 2048
ReadX 6247 3712 2048 2048
ReadX 6247 616 2048 2048
ReadX 6247 632 2048 2048
ReadX 6247 944 2048 2048
ReadX 6247 856 2048 2048
ReadX 6247 768 2048 2048
ReadX 6247 720 2048 2048
ReadX 6247 640 2048 2048
ReadX 6247 1048 2048 2048
ReadX 6247 1040 2048 2048
ReadX 6247 1032 2048 2048
ReadX 6247 1000 2048 2048
ReadX 6247 992 2048 2048
ReadX 6247 968 2048 2048
ReadX 6247 952 2048 2048
ReadX 6247 1056 2048 2048
ReadX 6247 816 2048 2048
ReadX 6247 864 2048 2048
ReadX 6247 2816 2048 2048
ReadX 6247 640 2048 2048
ReadX 6247 1024 2048 2048
ReadX 6247 504 2048 2048
ReadX 6247 424 2048 2048
ReadX 6247 840 2048 2048
ReadX 6247 896 2048 2048
ReadX 6247 520 2048 2048
ReadX 6247 960 2048 2048
ReadX 6247 552 2048 2048
ReadX 6247 488 2048 2048
ReadX 6247 824 2048 2048
ReadX 6247 304 2048 2048
ReadX 6247 768 2048 2048
ReadX 6247 712 2048 2048
ReadX 6247 512 2048 2048
ReadX 6247 432 2048 2048
ReadX 6247 384 2048 2048
ReadX 6247 2944 2048 2048
ReadX 6247 1088 2048 2048
ReadX 6247 928 2048 2048
ReadX 6247 280 2048 2048
ReadX 6247 744 2048 2048
ReadX 6247 3968 2048 2048
ReadX 6247 336 2048 2048
ReadX 6247 592 2048 2048
ReadX 6247 312 2048 2048
ReadX 6247 400 2048 2048
ReadX 6247 904 2048 2048
ReadX 6247 464 2048 2048
ReadX 6247 3456 2048 2048
ReadX 6247 848 2048 2048
ReadX 6247 936 2048 2048
ReadX 6247 656 2048 2048
ReadX 6247 344 2048 2048
ReadX 6247 440 2048 2048
ReadX 6247 4096 2048 2048
ReadX 6247 528 2048 2048
ReadX 6247 2048 2048 2048
ReadX 6247 1024 2048 2048
ReadX 6247 456 2048 2048
ReadX 6247 1792 2048 2048
ReadX 6247 1152 2048 2048
ReadX 6247 3584 2048 2048
ReadX 6247 1920 2048 2048
ReadX 6247 1280 2048 2048
ReadX 6247 896 2048 2048
ReadX 6247 328 2048 2048
Close 6255
Close 6256
Close 6257
Close 6258
Close 6253
Close 6247
Close 6248
Close 6251
Close 6252
Close 6249
Close 6250
Close 6242
Close 6243
Close 6244
Close 6245
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6262
FIND_FIRST \clients\client1\~dmtmp\*
Close 6262
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6263
QUERY_FILE_INFORMATION 6263
WriteX 6263 0 2048 2048
WriteX 6263 18431 1 1
QUERY_FILE_INFORMATION 6263
WriteX 6263 2048 16384 16384
WriteX 6263 1152 16384 16384
WriteX 6263 2176 16384 16384
WriteX 6263 3200 16384 16384
WriteX 6263 264 16384 16384
WriteX 6263 328 16384 16384
WriteX 6263 392 16384 16384
WriteX 6263 456 16384 16384
WriteX 6263 520 16384 16384
WriteX 6263 584 16384 16384
WriteX 6263 648 16384 16384
WriteX 6263 712 16384 16384
WriteX 6263 776 16384 16384
WriteX 6263 840 16384 16384
WriteX 6263 904 16384 16384
WriteX 6263 968 16384 16384
WriteX 6263 1032 16384 16384
WriteX 6263 1096 16384 16384
WriteX 6263 1160 16384 16384
WriteX 6263 1224 16384 16384
WriteX 6263 1288 16384 16384
WriteX 6263 1352 16384 16384
WriteX 6263 1416 16384 16384
WriteX 6263 1480 16384 16384
WriteX 6263 1544 16384 16384
WriteX 6263 1608 16384 16384
WriteX 6263 1672 16384 16384
WriteX 6263 1736 16384 16384
WriteX 6263 1800 16384 16384
WriteX 6263 1864 16384 16384
WriteX 6263 1928 16384 16384
WriteX 6263 1992 16384 16384
WriteX 6263 2056 16384 16384
WriteX 6263 2120 16384 16384
WriteX 6263 2184 16384 16384
WriteX 6263 2248 16384 16384
WriteX 6263 2312 16384 16384
WriteX 6263 2376 16384 16384
WriteX 6263 2440 16384 16384
WriteX 6263 0 88 88
Close 6263
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6264
ReadX 6264 0 511 511
ReadX 6264 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6264
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6265
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6265 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6266
ReadX 6266 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6267
ReadX 6267 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6268
ReadX 6268 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6269
ReadX 6269 0 53 53
ReadX 6269 53 2 2
ReadX 6269 55 480 480
ReadX 6269 535 2 2
Close 6269
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6270
ReadX 6270 0 511 511
ReadX 6270 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6271
ReadX 6271 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6272
ReadX 6272 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6273
ReadX 6273 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6274
ReadX 6274 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6275
ReadX 6275 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6276
ReadX 6276 0 41 41
ReadX 6270 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6277
ReadX 6277 0 53 53
ReadX 6277 53 2 2
ReadX 6277 55 2 2
ReadX 6277 57 184 184
ReadX 6277 241 298 298
Close 6277
ReadX 6265 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6278
ReadX 6278 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6279
ReadX 6279 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6280
ReadX 6280 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6281
ReadX 6281 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6282
ReadX 6282 0 53 53
ReadX 6282 53 28 28
ReadX 6282 81 28 28
ReadX 6282 109 28 28
ReadX 6282 137 28 28
ReadX 6282 165 28 28
ReadX 6282 193 28 28
ReadX 6282 221 28 28
ReadX 6282 249 4 4
ReadX 6282 253 4 4
ReadX 6282 257 4 4
ReadX 6282 261 28 28
ReadX 6282 289 2 2
ReadX 6282 291 2 2
ReadX 6282 293 2 2
Close 6282
ReadX 6278 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6283
ReadX 6283 0 53 53
ReadX 6283 53 2 2
ReadX 6283 55 2 2
ReadX 6283 57 184 184
ReadX 6283 241 298 298
Close 6283
ReadX 6267 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6284
ReadX 6284 0 53 53
ReadX 6284 53 2 2
ReadX 6284 55 480 480
ReadX 6284 535 2 2
Close 6284
Close 6278
Close 6279
Close 6280
Close 6281
Close 6276
Close 6270
Close 6271
Close 6274
Close 6275
Close 6272
Close 6273
Close 6265
Close 6266
Close 6267
Close 6268
Close 6194
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 6285
QUERY_FILE_INFORMATION 6285
Close 6285
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 6212
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 6286
QUERY_FILE_INFORMATION 6286
Close 6286
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 6241
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 6287
QUERY_FILE_INFORMATION 6287
Close 6287
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6288
Close 6288
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6289
ReadX 6289 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6290
ReadX 6290 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6291
ReadX 6291 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6292
ReadX 6292 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6293
ReadX 6293 0 53 53
ReadX 6293 53 28 28
ReadX 6293 81 28 28
ReadX 6293 109 28 28
ReadX 6293 137 28 28
ReadX 6293 165 28 28
ReadX 6293 193 28 28
ReadX 6293 221 28 28
ReadX 6293 249 4 4
ReadX 6293 253 4 4
ReadX 6293 257 4 4
ReadX 6293 261 28 28
ReadX 6293 289 2 2
ReadX 6293 291 2 2
ReadX 6293 293 2 2
Close 6293
ReadX 6289 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 6289 384 2048 2048
ReadX 6289 768 16384 16384
ReadX 6289 1792 14336 14336
ReadX 6292 2048 2048 2048
ReadX 6291 2048 2048 2048
WriteX 6289 1152 2048 2048
WriteX 6292 2048 2048 2048
WriteX 6291 2048 2048 2048
WriteX 6289 0 88 88
WriteX 6290 0 88 88
WriteX 6291 0 88 88
WriteX 6292 0 88 88
Close 6289
Close 6290
Close 6291
Close 6292
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6294
Close 6294
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6295
ReadX 6295 0 511 511
ReadX 6295 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6296
ReadX 6296 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6297
ReadX 6297 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6298
ReadX 6298 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6299
ReadX 6299 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6300
ReadX 6300 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6301
ReadX 6301 0 53 53
ReadX 6301 53 2 2
ReadX 6301 55 2 2
ReadX 6301 57 184 184
ReadX 6301 241 298 298
Close 6301
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6302
ReadX 6302 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6303
ReadX 6303 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6304
ReadX 6304 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6305
ReadX 6305 0 511 511
ReadX 6304 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6306
ReadX 6306 0 53 53
ReadX 6306 53 2 2
ReadX 6306 55 480 480
ReadX 6306 535 2 2
Close 6306
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6307
ReadX 6307 0 41 41
ReadX 6295 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 6308
QUERY_FILE_INFORMATION 6308
QUERY_FILE_INFORMATION 6308
ReadX 6308 0 8192 8192
Close 6308
ReadX 6295 1152 2048 2048
ReadX 6295 4096 16384 16384
Close 6302
Close 6303
Close 6304
Close 6305
Close 6307
Close 6295
Close 6296
Close 6299
Close 6300
Close 6297
Close 6298
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6309
Close 6309
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6310
QUERY_FILE_INFORMATION 6310
ReadX 6310 0 64 64
ReadX 6310 144 64 64
ReadX 6310 224 156 156
ReadX 6310 1193 128 128
ReadX 6310 1201 128 128
ReadX 6310 1072 4 4
ReadX 6310 1076 1925 1925
ReadX 6310 758 4 4
ReadX 6310 762 4557 4557
ReadX 6310 1052 4 4
ReadX 6310 1056 314 314
ReadX 6310 1056 11056 11056
Close 6310
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6311
ReadX 6311 0 511 511
ReadX 6311 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6312
ReadX 6312 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6313
ReadX 6313 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6314
ReadX 6314 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6315
ReadX 6315 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6316
ReadX 6316 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6317
ReadX 6317 0 53 53
ReadX 6317 53 2 2
ReadX 6317 55 2 2
ReadX 6317 57 184 184
ReadX 6317 241 298 298
Close 6317
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6318
ReadX 6318 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6319
ReadX 6319 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6320
ReadX 6320 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6321
ReadX 6321 0 511 511
ReadX 6320 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6322
ReadX 6322 0 53 53
ReadX 6322 53 2 2
ReadX 6322 55 480 480
ReadX 6322 535 2 2
Close 6322
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6323
ReadX 6323 0 41 41
ReadX 6311 2048 2048 2048
ReadX 6312 2048 2048 2048
ReadX 6311 1144 2048 2048
ReadX 6311 1152 2048 2048
ReadX 6311 4096 16384 16384
WriteX 6311 2048 2048 2048
WriteX 6312 2048 2048 2048
WriteX 6311 0 88 88
WriteX 6312 0 88 88
Close 6318
Close 6319
Close 6320
Close 6321
Close 6323
Close 6311
Close 6312
Close 6315
Close 6316
Close 6313
Close 6314
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 6324
Close 6324
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 6325
QUERY_FILE_INFORMATION 6325
ReadX 6325 0 64 64
ReadX 6325 144 64 64
ReadX 6325 224 84 84
ReadX 6325 478 16 16
ReadX 6325 1056 6176 6176
Close 6325
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6326
ReadX 6326 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6327
ReadX 6327 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6328
ReadX 6328 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6329
ReadX 6329 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6330
ReadX 6330 0 53 53
ReadX 6330 53 28 28
ReadX 6330 81 28 28
ReadX 6330 109 28 28
ReadX 6330 137 28 28
ReadX 6330 165 28 28
ReadX 6330 193 28 28
ReadX 6330 221 28 28
ReadX 6330 249 4 4
ReadX 6330 253 4 4
ReadX 6330 257 4 4
ReadX 6330 261 28 28
ReadX 6330 289 2 2
ReadX 6330 291 2 2
ReadX 6330 293 2 2
Close 6330
ReadX 6326 2048 2048 2048
ReadX 6327 2048 2048 2048
ReadX 6326 1280 2048 2048
ReadX 6329 2048 2048 2048
ReadX 6328 2048 2048 2048
WriteX 6326 1280 2048 2048
WriteX 6329 2048 2048 2048
WriteX 6328 2048 2048 2048
WriteX 6327 2048 2048 2048
WriteX 6326 0 88 88
WriteX 6327 0 88 88
WriteX 6328 0 88 88
WriteX 6329 0 88 88
WriteX 6326 1280 2048 2048
WriteX 6329 2048 2048 2048
WriteX 6328 2048 2048 2048
WriteX 6327 2048 2048 2048
WriteX 6326 0 88 88
WriteX 6327 0 88 88
WriteX 6328 0 88 88
WriteX 6329 0 88 88
WriteX 6326 1280 2048 2048
WriteX 6329 2048 2048 2048
WriteX 6328 2048 2048 2048
WriteX 6327 2048 2048 2048
WriteX 6326 0 88 88
WriteX 6327 0 88 88
WriteX 6328 0 88 88
WriteX 6329 0 88 88
Close 6326
Close 6327
Close 6328
Close 6329
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6331
ReadX 6331 0 511 511
ReadX 6331 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6332
ReadX 6332 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6333
ReadX 6333 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6334
ReadX 6334 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6335
ReadX 6335 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6336
ReadX 6336 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6337
ReadX 6337 0 53 53
ReadX 6337 53 2 2
ReadX 6337 55 2 2
ReadX 6337 57 184 184
ReadX 6337 241 298 298
Close 6337
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6338
ReadX 6338 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6339
ReadX 6339 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6340
ReadX 6340 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6341
ReadX 6341 0 511 511
ReadX 6340 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6342
ReadX 6342 0 53 53
ReadX 6342 53 2 2
ReadX 6342 55 480 480
ReadX 6342 535 2 2
Close 6342
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6343
ReadX 6343 0 41 41
ReadX 6331 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 6347
FIND_FIRST \clients\client1\~dmtmp\*
Close 6347
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 6348
QUERY_FILE_INFORMATION 6348
WriteX 6348 2047 1 1
QUERY_FILE_INFORMATION 6348
WriteX 6348 0 2048 2048
Close 6348
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 6349
ReadX 6349 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 6349 4095 1 1
QUERY_FILE_INFORMATION 6349
WriteX 6349 2048 2048 2048
WriteX 6349 0 88 88
Close 6349
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 6350
ReadX 6350 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 6350 2048 2048 2048
Close 6338
Close 6339
Close 6340
Close 6341
Close 6343
Close 6331
Close 6332
Close 6335
Close 6336
Close 6333
Close 6334
WriteX 6350 2048 2048 2048
WriteX 6350 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6351
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6351 0 511 511
ReadX 6351 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6352
ReadX 6352 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6353
ReadX 6353 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6354
ReadX 6354 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6355
ReadX 6355 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6356
ReadX 6356 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6357
ReadX 6357 0 53 53
ReadX 6357 53 2 2
ReadX 6357 55 2 2
ReadX 6357 57 184 184
ReadX 6357 241 298 298
Close 6357
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6358
ReadX 6358 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6359
ReadX 6359 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6360
ReadX 6360 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6361
ReadX 6361 0 511 511
ReadX 6360 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6362
ReadX 6362 0 53 53
ReadX 6362 53 2 2
ReadX 6362 55 480 480
ReadX 6362 535 2 2
Close 6362
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6363
ReadX 6363 0 41 41
ReadX 6351 2048 2048 2048
ReadX 6351 1152 2048 2048
ReadX 6351 4096 16384 16384
ReadX 6351 1280 16384 16384
ReadX 6351 2304 16384 16384
ReadX 6351 3328 16384 16384
ReadX 6351 272 16384 16384
ReadX 6351 336 16384 16384
ReadX 6351 400 16384 16384
ReadX 6351 464 16384 16384
ReadX 6351 528 16384 16384
ReadX 6351 592 16384 16384
ReadX 6351 656 16384 16384
ReadX 6351 720 16384 16384
ReadX 6351 784 16384 16384
ReadX 6351 848 16384 16384
ReadX 6351 912 16384 16384
ReadX 6351 976 16384 16384
ReadX 6351 1040 16384 16384
ReadX 6351 1104 12288 12288
Close 6358
Close 6359
Close 6360
Close 6361
Close 6363
Close 6351
Close 6352
Close 6355
Close 6356
Close 6353
Close 6354
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6364
FIND_FIRST \clients\client1\~dmtmp\*
Close 6364
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6365
QUERY_FILE_INFORMATION 6365
WriteX 6365 0 2048 2048
WriteX 6365 2048 4096 4096
WriteX 6365 0 88 88
Close 6365
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6366
ReadX 6366 0 511 511
ReadX 6366 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6366
WriteX 6350 2048 2048 2048
WriteX 6350 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6367
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6367 0 511 511
ReadX 6367 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6368
ReadX 6368 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6369
ReadX 6369 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6370
ReadX 6370 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6371
ReadX 6371 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6372
ReadX 6372 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6373
ReadX 6373 0 53 53
ReadX 6373 53 2 2
ReadX 6373 55 2 2
ReadX 6373 57 184 184
ReadX 6373 241 298 298
Close 6373
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6374
ReadX 6374 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6375
ReadX 6375 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6376
ReadX 6376 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6377
ReadX 6377 0 511 511
ReadX 6376 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6378
ReadX 6378 0 53 53
ReadX 6378 53 2 2
ReadX 6378 55 480 480
ReadX 6378 535 2 2
Close 6378
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6379
ReadX 6379 0 41 41
ReadX 6367 2048 2048 2048
ReadX 6367 1152 2048 2048
ReadX 6367 4096 16384 16384
ReadX 6367 1280 16384 16384
ReadX 6367 2304 16384 16384
ReadX 6367 3328 16384 16384
ReadX 6367 272 16384 16384
ReadX 6367 336 16384 16384
ReadX 6367 400 16384 16384
ReadX 6367 464 16384 16384
ReadX 6367 528 16384 16384
ReadX 6367 592 16384 16384
ReadX 6367 656 16384 16384
ReadX 6367 720 16384 16384
ReadX 6367 784 16384 16384
ReadX 6367 848 16384 16384
ReadX 6367 912 16384 16384
ReadX 6367 976 16384 16384
ReadX 6367 1040 16384 16384
ReadX 6367 1104 12288 12288
Close 6374
Close 6375
Close 6376
Close 6377
Close 6379
Close 6367
Close 6368
Close 6371
Close 6372
Close 6369
Close 6370
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6380
FIND_FIRST \clients\client1\~dmtmp\*
Close 6380
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6381
QUERY_FILE_INFORMATION 6381
WriteX 6381 0 2048 2048
WriteX 6381 2048 4096 4096
WriteX 6381 0 88 88
Close 6381
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6382
ReadX 6382 0 511 511
ReadX 6382 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6382
Close 6350
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 6383
QUERY_FILE_INFORMATION 6383
Close 6383
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6384
Close 6384
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6385
QUERY_FILE_INFORMATION 6385
ReadX 6385 0 64 64
ReadX 6385 144 64 64
ReadX 6385 224 156 156
ReadX 6385 1193 128 128
ReadX 6385 1201 128 128
ReadX 6385 1072 4 4
ReadX 6385 1076 1925 1925
ReadX 6385 758 4 4
ReadX 6385 762 4557 4557
ReadX 6385 1052 4 4
ReadX 6385 1056 314 314
ReadX 6385 1056 11056 11056
Close 6385
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6386
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6386 0 511 511
ReadX 6386 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6387
ReadX 6387 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6388
ReadX 6388 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6389
ReadX 6389 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6390
ReadX 6390 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6391
ReadX 6391 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6392
ReadX 6392 0 53 53
ReadX 6392 53 2 2
ReadX 6392 55 2 2
ReadX 6392 57 184 184
ReadX 6392 241 298 298
Close 6392
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6393
ReadX 6393 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6394
ReadX 6394 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6395
ReadX 6395 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6396
ReadX 6396 0 511 511
ReadX 6395 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6397
ReadX 6397 0 53 53
ReadX 6397 53 2 2
ReadX 6397 55 480 480
ReadX 6397 535 2 2
Close 6397
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6398
ReadX 6398 0 41 41
ReadX 6386 2048 2048 2048
ReadX 6386 1152 2048 2048
ReadX 6386 4096 16384 16384
Close 6393
Close 6394
Close 6395
Close 6396
Close 6398
Close 6386
Close 6387
Close 6390
Close 6391
Close 6388
Close 6389
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6399
ReadX 6399 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6400
ReadX 6400 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6401
ReadX 6401 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6402
ReadX 6402 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6403
ReadX 6403 0 53 53
ReadX 6403 53 2 2
ReadX 6403 55 480 480
ReadX 6403 535 2 2
Close 6403
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6404
ReadX 6404 0 511 511
ReadX 6404 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6405
ReadX 6405 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6406
ReadX 6406 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6407
ReadX 6407 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6408
ReadX 6408 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6409
ReadX 6409 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6410
ReadX 6410 0 41 41
ReadX 6404 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6411
ReadX 6411 0 53 53
ReadX 6411 53 2 2
ReadX 6411 55 2 2
ReadX 6411 57 184 184
ReadX 6411 241 298 298
Close 6411
ReadX 6399 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 6415
FIND_FIRST \clients\client1\~dmtmp\*
Close 6415
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 6416
QUERY_FILE_INFORMATION 6416
WriteX 6416 2047 1 1
QUERY_FILE_INFORMATION 6416
WriteX 6416 0 2048 2048
Close 6416
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 6417
ReadX 6417 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 6417 4095 1 1
QUERY_FILE_INFORMATION 6417
WriteX 6417 2048 2048 2048
WriteX 6417 0 88 88
Close 6417
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 6418
ReadX 6418 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 6418 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 6422
Close 6422
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 6423
QUERY_FILE_INFORMATION 6423
WriteX 6423 2047 1 1
QUERY_FILE_INFORMATION 6423
WriteX 6423 0 2048 2048
Close 6423
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 6424
ReadX 6424 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 6424 4095 1 1
QUERY_FILE_INFORMATION 6424
WriteX 6424 2048 2048 2048
WriteX 6424 0 88 88
Close 6424
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 6425
ReadX 6425 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 6425 2048 2048 2048
Close 6410
Close 6404
Close 6405
Close 6408
Close 6409
Close 6406
Close 6407
Close 6399
Close 6400
Close 6401
Close 6402
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6426
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6426 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6427
ReadX 6427 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6428
ReadX 6428 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6429
ReadX 6429 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6430
ReadX 6430 0 53 53
ReadX 6430 53 2 2
ReadX 6430 55 480 480
ReadX 6430 535 2 2
Close 6430
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6431
ReadX 6431 0 511 511
ReadX 6431 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6432
ReadX 6432 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6433
ReadX 6433 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6434
ReadX 6434 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6435
ReadX 6435 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6436
ReadX 6436 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6437
ReadX 6437 0 41 41
ReadX 6431 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6438
ReadX 6438 0 53 53
ReadX 6438 53 2 2
ReadX 6438 55 2 2
ReadX 6438 57 184 184
ReadX 6438 241 298 298
Close 6438
ReadX 6426 2048 2048 2048
ReadX 6426 384 16384 16384
ReadX 6426 1408 16384 16384
ReadX 6426 2560 16384 16384
ReadX 6426 3584 16384 16384
ReadX 6426 288 16384 16384
ReadX 6426 352 16384 16384
ReadX 6426 416 16384 16384
ReadX 6426 480 16384 16384
ReadX 6426 552 16384 16384
ReadX 6426 616 16384 16384
ReadX 6426 680 16384 16384
ReadX 6426 744 16384 16384
ReadX 6426 808 16384 16384
ReadX 6426 872 16384 16384
ReadX 6426 936 10240 10240
Close 6437
Close 6431
Close 6432
Close 6435
Close 6436
Close 6433
Close 6434
Close 6426
Close 6427
Close 6428
Close 6429
Close 6418
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 6439
QUERY_FILE_INFORMATION 6439
Close 6439
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 6425
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 6440
QUERY_FILE_INFORMATION 6440
Close 6440
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 6441
ReadX 6441 0 65471 65471
ReadX 6441 65471 63 63
ReadX 6441 65534 65471 65471
ReadX 6441 131005 63 63
ReadX 6441 131068 65471 65471
ReadX 6441 196539 63 63
ReadX 6441 196602 65471 65471
ReadX 6441 262073 63 63
ReadX 6441 262136 65471 65471
ReadX 6441 327607 63 63
ReadX 6441 327670 10 10
Close 6441
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 6442
ReadX 6442 0 65471 65471
ReadX 6442 65471 63 63
ReadX 6442 65534 65471 65471
ReadX 6442 131005 63 63
ReadX 6442 131068 65471 65471
ReadX 6442 196539 63 63
ReadX 6442 196602 65471 65471
ReadX 6442 262073 63 63
ReadX 6442 262136 65471 65471
ReadX 6442 327607 63 63
ReadX 6442 327670 65471 65471
ReadX 6442 393141 63 63
ReadX 6442 393204 65471 65471
ReadX 6442 458675 63 63
ReadX 6442 458738 65471 65471
ReadX 6442 524209 63 63
ReadX 6442 524272 65471 65471
ReadX 6442 589743 63 63
ReadX 6442 589806 65471 65471
ReadX 6442 655277 63 63
ReadX 6442 655340 32 32
Close 6442
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 6443
ReadX 6443 0 65471 65471
ReadX 6443 65471 63 63
ReadX 6443 65534 65471 65471
ReadX 6443 131005 63 63
ReadX 6443 131068 65471 65471
ReadX 6443 196539 63 63
ReadX 6443 196602 65471 65471
ReadX 6443 262073 63 63
ReadX 6443 262136 65471 65471
ReadX 6443 327607 63 63
ReadX 6443 327670 65471 65471
ReadX 6443 393141 63 63
ReadX 6443 393204 65471 65471
ReadX 6443 458675 63 63
ReadX 6443 458738 65471 65471
ReadX 6443 524209 63 63
ReadX 6443 524272 65471 65471
ReadX 6443 589743 63 63
ReadX 6443 589806 65471 65471
ReadX 6443 655277 63 63
ReadX 6443 655340 65471 65471
ReadX 6443 720811 63 63
ReadX 6443 720874 65471 65471
ReadX 6443 786345 63 63
ReadX 6443 786408 65471 65471
ReadX 6443 851879 63 63
ReadX 6443 851942 65471 65471
ReadX 6443 917413 63 63
ReadX 6443 917476 65471 65471
ReadX 6443 982947 63 63
ReadX 6443 983010 65471 65471
ReadX 6443 1048481 63 63
ReadX 6443 1048544 65471 65471
ReadX 6443 1114015 63 63
ReadX 6443 1114078 65471 65471
ReadX 6443 1179549 63 63
ReadX 6443 1179612 65471 65471
ReadX 6443 1245083 63 63
ReadX 6443 1245146 65471 65471
ReadX 6443 1310617 63 63
ReadX 6443 1310680 65471 65471
ReadX 6443 1376151 63 63
ReadX 6443 1376214 65471 65471
ReadX 6443 1441685 63 63
ReadX 6443 1441748 65471 65471
ReadX 6443 1507219 63 63
ReadX 6443 1507282 65471 65471
ReadX 6443 1572753 63 63
ReadX 6443 1572816 65471 65471
ReadX 6443 1638287 63 63
ReadX 6443 1638350 65471 65471
ReadX 6443 1703821 63 63
ReadX 6443 1703884 65471 65471
ReadX 6443 1769355 63 63
ReadX 6443 1769418 65471 65471
ReadX 6443 1834889 63 63
ReadX 6443 1834952 32824 32824
Close 6443
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 6444
QUERY_FILE_INFORMATION 6444
ReadX 6444 0 512 512
ReadX 6444 512 512 512
ReadX 6444 1024 512 512
QUERY_FILE_INFORMATION 6444
QUERY_FILE_INFORMATION 6444
ReadX 6444 2560 2048 2048
ReadX 6444 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 6445
WriteX 6445 52 1 1
QUERY_FILE_INFORMATION 6445
WriteX 6445 0 53 53
Close 6445
ReadX 6444 2208 650 650
ReadX 6444 1920 2048 2048
ReadX 6444 2112 2048 2048
ReadX 6444 1856 2048 2048
ReadX 6444 1824 2048 2048
ReadX 6444 1536 512 512
ReadX 6444 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 6446
Close 6446
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 6444 1568 512 512
ReadX 6444 1536 512 512
ReadX 6444 2176 384 384
ReadX 6444 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 6447
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 6444 288 2048 2048
ReadX 6444 2336 2048 2048
ReadX 6444 4384 2048 2048
ReadX 6444 6432 2048 2048
ReadX 6444 8480 2048 2048
ReadX 6444 10528 2048 2048
ReadX 6444 12576 2048 2048
WriteX 6447 15359 1 1
QUERY_FILE_INFORMATION 6447
ReadX 6444 14624 2048 2048
ReadX 6444 16672 2048 2048
ReadX 6444 18720 2048 2048
ReadX 6444 1728 2048 2048
WriteX 6447 0 15360 15360
Close 6447
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 6448
QUERY_FILE_INFORMATION 6448
ReadX 6448 0 512 512
ReadX 6448 2048 512 512
ReadX 6448 2560 512 512
QUERY_FILE_INFORMATION 6448
QUERY_FILE_INFORMATION 6448
QUERY_FILE_INFORMATION 6448
QUERY_FILE_INFORMATION 6448
QUERY_FILE_INFORMATION 6448
WriteX 6448 2152 384 384
QUERY_FILE_INFORMATION 6448
WriteX 6448 2150 22 22
WriteX 6448 2144 106 106
QUERY_FILE_INFORMATION 6448
WriteX 6448 2176 496 496
ReadX 6448 2176 496 496
QUERY_FILE_INFORMATION 6448
WriteX 6448 2440 384 384
QUERY_FILE_INFORMATION 6448
WriteX 6448 2152 384 384
WriteX 6448 2432 112 112
QUERY_FILE_INFORMATION 6448
WriteX 6448 2439 16 16
QUERY_FILE_INFORMATION 6448
WriteX 6448 2208 220 220
ReadX 6448 2208 220 220
QUERY_FILE_INFORMATION 6448
QUERY_FILE_INFORMATION 6448
WriteX 6448 2440 220 220
QUERY_FILE_INFORMATION 6448
WriteX 6448 2453 36 36
WriteX 6448 2080 512 512
WriteX 6448 2176 512 512
WriteX 6448 2112 512 512
WriteX 6448 2048 512 512
WriteX 6448 0 512 512
QUERY_FILE_INFORMATION 6444
QUERY_FILE_INFORMATION 6444
WriteX 6448 2080 512 512
Close 6448
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 6449
Close 6449
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 6450
QUERY_FILE_INFORMATION 6450
ReadX 6450 0 512 512
ReadX 6450 2048 512 512
ReadX 6450 2560 512 512
QUERY_FILE_INFORMATION 6450
QUERY_FILE_INFORMATION 6450
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 6451
Close 6451
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 6444
ReadX 6450 1408 512 512
ReadX 6450 2048 512 512
ReadX 6450 1536 512 512
ReadX 6450 2560 512 512
ReadX 6450 3072 512 512
ReadX 6450 3584 512 512
ReadX 6450 4096 512 512
ReadX 6450 4608 512 512
ReadX 6450 5120 512 512
ReadX 6450 5632 512 512
ReadX 6450 6144 512 512
ReadX 6450 6656 512 512
ReadX 6450 7168 512 512
ReadX 6450 7680 512 512
ReadX 6450 8192 512 512
ReadX 6450 8704 512 512
ReadX 6450 9216 512 512
ReadX 6450 9728 512 512
ReadX 6450 10240 512 512
ReadX 6450 10752 512 512
ReadX 6450 11264 512 512
ReadX 6450 11776 512 512
ReadX 6450 12288 512 512
ReadX 6450 12800 512 512
ReadX 6450 13312 512 512
ReadX 6450 13824 512 512
ReadX 6450 14336 512 512
ReadX 6450 14848 512 512
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 15360 512 0
ReadX 6450 2560 2048 2048
ReadX 6450 4608 2048 2048
ReadX 6450 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 6452
QUERY_FILE_INFORMATION 6452
ReadX 6452 0 512 512
ReadX 6452 512 512 512
ReadX 6452 1024 512 512
QUERY_FILE_INFORMATION 6452
QUERY_FILE_INFORMATION 6452
ReadX 6452 352 2048 2048
ReadX 6452 608 1097 1097
ReadX 6452 576 1609 1609
ReadX 6452 4096 512 512
ReadX 6452 1536 512 512
ReadX 6452 3840 256 256
ReadX 6452 288 576 576
ReadX 6452 512 512 512
ReadX 6452 480 512 512
ReadX 6452 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 6453
ReadX 6453 0 4096 4096
ReadX 6453 4096 4096 4096
ReadX 6453 8192 4096 4096
Close 6452
Close 6453
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 6454
WriteX 6454 15359 1 1
QUERY_FILE_INFORMATION 6454
WriteX 6454 0 15360 15360
Close 6454
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 6455
QUERY_FILE_INFORMATION 6455
ReadX 6455 0 512 512
ReadX 6455 2048 512 512
ReadX 6455 2560 512 512
QUERY_FILE_INFORMATION 6455
QUERY_FILE_INFORMATION 6455
QUERY_FILE_INFORMATION 6455
QUERY_FILE_INFORMATION 6455
QUERY_FILE_INFORMATION 6455
WriteX 6455 2152 384 384
QUERY_FILE_INFORMATION 6455
WriteX 6455 2150 22 22
WriteX 6455 2144 106 106
QUERY_FILE_INFORMATION 6455
WriteX 6455 2176 476 476
ReadX 6455 2176 476 476
QUERY_FILE_INFORMATION 6455
WriteX 6455 2440 384 384
QUERY_FILE_INFORMATION 6455
WriteX 6455 2152 384 384
WriteX 6455 2432 92 92
QUERY_FILE_INFORMATION 6455
WriteX 6455 2437 36 36
QUERY_FILE_INFORMATION 6455
WriteX 6455 2208 220 220
ReadX 6455 2208 220 220
QUERY_FILE_INFORMATION 6455
QUERY_FILE_INFORMATION 6455
WriteX 6455 2440 220 220
QUERY_FILE_INFORMATION 6455
WriteX 6455 2453 36 36
WriteX 6455 2080 512 512
WriteX 6455 2176 512 512
WriteX 6455 2112 512 512
WriteX 6455 2048 512 512
WriteX 6455 0 512 512
QUERY_FILE_INFORMATION 6450
QUERY_FILE_INFORMATION 6450
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 6450
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 6456
Close 6456
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 6457
QUERY_FILE_INFORMATION 6457
ReadX 6457 0 512 512
ReadX 6457 2048 512 512
ReadX 6457 2560 512 512
QUERY_FILE_INFORMATION 6457
QUERY_FILE_INFORMATION 6457
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 6458
Close 6458
WriteX 6455 2080 512 512
Close 6455
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 6459
Close 6459
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 6460
QUERY_FILE_INFORMATION 6460
ReadX 6460 0 512 512
ReadX 6460 2048 512 512
ReadX 6460 2560 512 512
QUERY_FILE_INFORMATION 6460
QUERY_FILE_INFORMATION 6460
ReadX 6460 1312 512 512
ReadX 6460 1536 512 512
ReadX 6460 2048 512 512
ReadX 6460 576 512 512
ReadX 6460 1088 512 512
ReadX 6460 1056 512 512
ReadX 6460 1120 512 512
ReadX 6460 1184 512 512
ReadX 6460 2560 2048 2048
ReadX 6460 4608 2048 2048
ReadX 6460 6656 2048 2048
ReadX 6460 8704 2048 2048
ReadX 6460 10752 2048 2048
ReadX 6460 12800 2048 2048
ReadX 6460 14848 2048 512
ReadX 6460 15360 1536 0
ReadX 6460 1088 2048 2048
ReadX 6460 3136 2048 2048
ReadX 6460 1665 5835 5835
ReadX 6460 1856 2048 2048
ReadX 6460 2112 512 512
ReadX 6460 2152 384 384
ReadX 6460 2432 92 92
ReadX 6460 2176 512 512
ReadX 6460 2440 220 220
QUERY_FILE_INFORMATION 6460
QUERY_FILE_INFORMATION 6460
ReadX 6460 2432 512 512
WriteX 6460 2272 512 512
ReadX 6460 2144 512 512
WriteX 6460 2304 512 512
WriteX 6460 2272 92 92
WriteX 6460 2208 512 512
WriteX 6460 2720 512 512
WriteX 6460 0 512 512
QUERY_FILE_INFORMATION 6460
QUERY_FILE_INFORMATION 6460
ReadX 6460 1312 4096 4096
ReadX 6460 5408 4096 4096
ReadX 6460 9504 3305 3305
ReadX 6460 512 4096 4096
QUERY_FILE_INFORMATION 6460
QUERY_FILE_INFORMATION 6460
QUERY_FILE_INFORMATION 6460
WriteX 6460 3132 50 50
WriteX 6460 3182 4096 4096
WriteX 6460 7278 4096 4096
WriteX 6460 15469 1 1
QUERY_FILE_INFORMATION 6460
WriteX 6460 11374 4096 4096
WriteX 6460 15470 3584 3584
WriteX 6460 2144 512 512
WriteX 6460 2336 4096 4096
WriteX 6460 6432 4096 4096
WriteX 6460 10528 4096 4096
WriteX 6460 14624 462 462
WriteX 6460 2048 512 512
WriteX 6460 2560 512 512
WriteX 6460 0 512 512
QUERY_FILE_INFORMATION 6460
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 6461
QUERY_FILE_INFORMATION 6461
ReadX 6461 0 512 512
ReadX 6461 1152 512 512
ReadX 6461 1664 512 512
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
ReadX 6461 512 2048 2048
ReadX 6461 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 6462
WriteX 6462 52 1 1
QUERY_FILE_INFORMATION 6462
WriteX 6462 0 53 53
Close 6462
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
ReadX 6461 1120 504 504
ReadX 6461 896 2048 2048
ReadX 6461 1056 1528 1528
ReadX 6461 864 2048 2048
ReadX 6461 832 2048 2048
ReadX 6461 736 2048 2048
ReadX 6461 1216 512 512
ReadX 6461 1256 384 384
ReadX 6461 1536 140 140
ReadX 6461 1280 512 512
ReadX 6461 1548 252 252
ReadX 6460 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 6463
Close 6463
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 6464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 6461 2560 2048 2048
ReadX 6461 4608 2048 2048
ReadX 6461 6656 2048 2048
ReadX 6461 8704 2048 2048
ReadX 6461 10752 2048 2048
WriteX 6464 12005 1 1
QUERY_FILE_INFORMATION 6464
WriteX 6464 0 12006 12006
Close 6464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 6465
QUERY_FILE_INFORMATION 6465
ReadX 6465 0 512 512
ReadX 6465 1152 512 512
ReadX 6465 1664 512 512
QUERY_FILE_INFORMATION 6465
QUERY_FILE_INFORMATION 6465
QUERY_FILE_INFORMATION 6465
QUERY_FILE_INFORMATION 6465
QUERY_FILE_INFORMATION 6465
QUERY_FILE_INFORMATION 6465
QUERY_FILE_INFORMATION 6465
WriteX 6465 1256 384 384
QUERY_FILE_INFORMATION 6465
WriteX 6465 1254 22 22
WriteX 6465 1248 106 106
QUERY_FILE_INFORMATION 6465
WriteX 6465 1280 508 508
ReadX 6465 1280 508 508
QUERY_FILE_INFORMATION 6465
WriteX 6465 1544 384 384
QUERY_FILE_INFORMATION 6465
WriteX 6465 1256 384 384
WriteX 6465 1536 124 124
QUERY_FILE_INFORMATION 6465
WriteX 6465 1543 4 4
QUERY_FILE_INFORMATION 6465
WriteX 6465 1312 252 252
ReadX 6465 1312 252 252
QUERY_FILE_INFORMATION 6465
QUERY_FILE_INFORMATION 6465
WriteX 6465 1544 252 252
QUERY_FILE_INFORMATION 6465
WriteX 6465 1559 4 4
WriteX 6465 1184 512 512
WriteX 6465 1280 512 512
WriteX 6465 1216 512 512
WriteX 6465 1152 512 512
WriteX 6465 0 512 512
QUERY_FILE_INFORMATION 6461
QUERY_FILE_INFORMATION 6461
WriteX 6465 1184 512 512
Close 6465
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 6466
Close 6466
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 6467
QUERY_FILE_INFORMATION 6467
ReadX 6467 0 512 512
ReadX 6467 1152 512 512
ReadX 6467 1664 512 512
QUERY_FILE_INFORMATION 6467
QUERY_FILE_INFORMATION 6467
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 6468
Close 6468
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 6461
ReadX 6467 736 512 512
ReadX 6467 1536 2048 2048
ReadX 6467 3584 2048 2048
ReadX 6467 5632 2048 2048
ReadX 6467 7680 2048 2048
ReadX 6467 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 6469
WriteX 6469 11990 1 1
QUERY_FILE_INFORMATION 6469
WriteX 6469 0 11991 11991
Close 6469
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 6470
QUERY_FILE_INFORMATION 6470
ReadX 6470 0 512 512
ReadX 6470 1184 512 512
ReadX 6470 1696 512 512
QUERY_FILE_INFORMATION 6470
QUERY_FILE_INFORMATION 6470
QUERY_FILE_INFORMATION 6470
QUERY_FILE_INFORMATION 6470
QUERY_FILE_INFORMATION 6470
QUERY_FILE_INFORMATION 6470
QUERY_FILE_INFORMATION 6470
WriteX 6470 1288 384 384
QUERY_FILE_INFORMATION 6470
WriteX 6470 1286 22 22
WriteX 6470 1280 106 106
QUERY_FILE_INFORMATION 6470
WriteX 6470 1312 508 508
ReadX 6470 1312 508 508
QUERY_FILE_INFORMATION 6470
WriteX 6470 1576 384 384
QUERY_FILE_INFORMATION 6470
WriteX 6470 1288 384 384
WriteX 6470 1568 124 124
QUERY_FILE_INFORMATION 6470
WriteX 6470 1575 4 4
QUERY_FILE_INFORMATION 6470
WriteX 6470 1344 252 252
ReadX 6470 1344 252 252
QUERY_FILE_INFORMATION 6470
QUERY_FILE_INFORMATION 6470
WriteX 6470 1576 252 252
QUERY_FILE_INFORMATION 6470
WriteX 6470 1591 4 4
WriteX 6470 1216 512 512
WriteX 6470 1312 512 512
WriteX 6470 1248 512 512
WriteX 6470 1184 512 512
WriteX 6470 0 512 512
QUERY_FILE_INFORMATION 6467
QUERY_FILE_INFORMATION 6467
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 6467
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 6471
Close 6471
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 6472
QUERY_FILE_INFORMATION 6472
ReadX 6472 0 512 512
ReadX 6472 1152 512 512
ReadX 6472 1664 512 512
QUERY_FILE_INFORMATION 6472
QUERY_FILE_INFORMATION 6472
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 6473
Close 6473
WriteX 6470 1216 512 512
Close 6470
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 6474
Close 6474
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 6475
QUERY_FILE_INFORMATION 6475
ReadX 6475 0 512 512
ReadX 6475 1184 512 512
ReadX 6475 1696 512 512
QUERY_FILE_INFORMATION 6475
QUERY_FILE_INFORMATION 6475
ReadX 6475 1536 512 512
ReadX 6475 736 512 512
ReadX 6475 2048 512 512
ReadX 6475 2560 512 512
ReadX 6475 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 6476
Close 6476
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 6475 914 3899 3899
ReadX 6475 1248 512 512
ReadX 6475 1288 384 384
ReadX 6475 1568 124 124
ReadX 6475 1312 512 512
ReadX 6475 1576 252 252
QUERY_FILE_INFORMATION 6475
QUERY_FILE_INFORMATION 6475
ReadX 6475 1568 512 512
WriteX 6475 1408 512 512
ReadX 6475 1280 512 512
WriteX 6475 1440 512 512
WriteX 6475 1408 124 124
WriteX 6475 1344 512 512
WriteX 6475 1856 512 512
WriteX 6475 0 512 512
QUERY_FILE_INFORMATION 6475
QUERY_FILE_INFORMATION 6475
ReadX 6475 544 4096 4096
ReadX 6475 4640 4096 4096
ReadX 6475 8736 1637 1637
ReadX 6475 512 4096 4096
QUERY_FILE_INFORMATION 6475
QUERY_FILE_INFORMATION 6475
WriteX 6475 1280 512 512
WriteX 6475 1472 3584 3584
WriteX 6475 5056 4096 4096
WriteX 6475 13247 1 1
QUERY_FILE_INFORMATION 6475
WriteX 6475 9152 4096 4096
WriteX 6475 13248 1736 1736
WriteX 6475 1184 512 512
WriteX 6475 1696 512 512
WriteX 6475 0 512 512
QUERY_FILE_INFORMATION 6475
ReadX 6475 1632 1024 1024
ReadX 6475 288 1024 1024
ReadX 6475 1312 2048 2048
ReadX 6475 3360 1024 1024
ReadX 6475 1696 1024 1024
ReadX 6475 2720 512 512
ReadX 6475 3232 512 512
ReadX 6475 3744 512 512
ReadX 6475 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 6475 2066 3998 3998
ReadX 6475 1448 384 384
ReadX 6475 1408 124 124
ReadX 6475 1416 252 252
QUERY_FILE_INFORMATION 6475
QUERY_FILE_INFORMATION 6475
ReadX 6475 1408 512 512
WriteX 6475 1536 512 512
ReadX 6475 1440 512 512
WriteX 6475 2048 512 512
WriteX 6475 1536 124 124
WriteX 6475 512 512 512
WriteX 6475 1024 512 512
WriteX 6475 0 512 512
QUERY_FILE_INFORMATION 6475
ReadX 6475 1696 4096 4096
ReadX 6475 5792 4096 4096
ReadX 6475 9888 1736 1736
ReadX 6475 1280 512 512
ReadX 6475 1472 3584 3584
QUERY_FILE_INFORMATION 6475
QUERY_FILE_INFORMATION 6475
WriteX 6475 3940 156 156
WriteX 6475 4096 512 512
WriteX 6475 544 3584 3584
WriteX 6475 4128 4096 4096
WriteX 6475 8224 3584 3584
WriteX 6475 1344 512 512
WriteX 6475 1856 1536 1536
WriteX 6475 2336 512 512
WriteX 6475 3584 356 356
WriteX 6475 2560 512 512
WriteX 6475 3072 512 512
WriteX 6475 0 512 512
QUERY_FILE_INFORMATION 6475
Close 6457
Close 6460
Close 6475
Close 6472
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 6477
Close 6477
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 6478
Close 6478
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 6479
WriteX 6479 0 65471 65471
WriteX 6479 65471 63 63
WriteX 6479 65534 65471 65471
WriteX 6479 131005 63 63
Close 6479
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 6480
WriteX 6480 0 65471 65471
WriteX 6480 65471 63 63
WriteX 6480 65534 65471 65471
WriteX 6480 131005 63 63
WriteX 6480 131068 65471 65471
WriteX 6480 196539 63 63
WriteX 6480 196602 65471 65471
WriteX 6480 262073 63 63
Close 6480
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 6481
WriteX 6481 0 65471 65471
WriteX 6481 65471 63 63
WriteX 6481 65534 65471 65471
WriteX 6481 131005 63 63
WriteX 6481 131068 65471 65471
WriteX 6481 196539 63 63
WriteX 6481 196602 65471 65471
WriteX 6481 262073 63 63
WriteX 6481 262136 65471 65471
WriteX 6481 327607 63 63
WriteX 6481 327670 65471 65471
WriteX 6481 393141 63 63
WriteX 6481 393204 65471 65471
WriteX 6481 458675 63 63
WriteX 6481 458738 65471 65471
WriteX 6481 524209 63 63
Close 6481
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 6482
QUERY_FILE_INFORMATION 6482
QUERY_FILE_INFORMATION 6482
ReadX 6482 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 6483
Close 6483
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 6484
WriteX 6484 63 1 1
QUERY_FILE_INFORMATION 6484
WriteX 6484 0 64 64
ReadX 6482 992 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 344 2048 2048
ReadX 6482 1344 2048 2048
ReadX 6482 1352 2048 2048
ReadX 6482 1320 2048 2048
ReadX 6482 1360 2048 2048
ReadX 6482 1344 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2304 2048 2048
ReadX 6482 1472 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 1480 2048 2048
ReadX 6482 1488 2048 2048
ReadX 6482 1496 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 1504 2048 2048
ReadX 6482 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 1000 2048 2048
ReadX 6482 1416 2048 2048
ReadX 6482 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 6482 360 2048 2048
ReadX 6482 368 2048 2048
ReadX 6482 360 2048 2048
ReadX 6482 376 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 1232 2048 2048
ReadX 6482 2432 6144 6144
ReadX 6482 2376 2048 2048
ReadX 6482 2360 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 2376 2048 2048
ReadX 6482 2384 2048 2048
ReadX 6482 2368 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 1296 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 6482 0 2048 2048
ReadX 6482 2688 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 2688 2048 2048
WriteX 6482 2688 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 2688 2048 2048
ReadX 6482 2688 2048 2048
ReadX 6482 2688 2048 2048
WriteX 6482 2688 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 6482 2688 2048 2048
ReadX 6482 2688 2048 2048
WriteX 6482 2688 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 320 4096 4096
ReadX 6482 0 2048 2048
ReadX 6482 3584 2048 2048
ReadX 6482 3584 2048 2048
ReadX 6482 3584 2048 2048
ReadX 6482 0 2048 2048
WriteX 6482 3584 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2688 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 2688 2048 2048
ReadX 6482 2688 2048 2048
WriteX 6482 2688 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 3200 2048 2048
ReadX 6482 3200 2048 2048
ReadX 6482 3200 2048 2048
WriteX 6482 3200 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 3456 2048 2048
ReadX 6482 3456 2048 2048
ReadX 6482 3456 2048 2048
WriteX 6482 3456 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2496 2048 2048
ReadX 6482 2472 2048 2048
ReadX 6482 2456 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 2472 2048 2048
ReadX 6482 2480 2048 2048
ReadX 6482 2464 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 2488 2048 2048
ReadX 6482 2568 8192 8192
ReadX 6482 1000 2048 2048
ReadX 6482 328 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 2048 2048 2048
ReadX 6482 2560 2048 2048
ReadX 6482 920 2048 2048
WriteX 6482 2048 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 312 2048 2048
WriteX 6482 336 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 328 2048 2048
WriteX 6482 2560 2048 2048
WriteX 6482 3840 2048 2048
WriteX 6482 920 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2432 2048 2048
WriteX 6482 2432 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2456 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 328 2048 2048
ReadX 6482 2560 2048 2048
ReadX 6482 2048 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 336 2048 2048
ReadX 6482 920 2048 2048
WriteX 6482 1536 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 2048 2048 2048
WriteX 6482 2560 2048 2048
WriteX 6482 336 2048 2048
WriteX 6482 920 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2048 2048 2048
ReadX 6482 2432 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 2048 2048 2048
WriteX 6482 2432 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2456 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1536 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 336 2048 2048
ReadX 6482 920 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 1536 2048 2048
WriteX 6482 336 2048 2048
WriteX 6482 920 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2432 2048 2048
WriteX 6482 2432 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2456 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1536 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 336 2048 2048
ReadX 6482 920 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 1536 2048 2048
WriteX 6482 336 2048 2048
WriteX 6482 920 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2432 2048 2048
WriteX 6482 2432 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2456 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1536 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 336 2048 2048
ReadX 6482 920 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 1536 2048 2048
WriteX 6482 336 2048 2048
WriteX 6482 920 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2432 2048 2048
WriteX 6482 2432 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2456 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1536 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 336 2048 2048
ReadX 6482 920 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 1536 2048 2048
WriteX 6482 336 2048 2048
WriteX 6482 920 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2432 2048 2048
WriteX 6482 2432 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
Flush 6482
ReadX 6482 2456 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1536 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 336 2048 2048
ReadX 6482 920 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 1536 2048 2048
WriteX 6482 336 2048 2048
WriteX 6482 920 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2432 2048 2048
WriteX 6482 2432 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2624 6144 6144
ReadX 6482 2616 2048 2048
ReadX 6482 2688 2048 2048
ReadX 6482 2600 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 2616 2048 2048
ReadX 6482 2608 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 344 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 520 2048 2048
ReadX 6482 1392 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 400 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 536 2048 2048
ReadX 6482 824 2048 2048
ReadX 6482 832 2048 2048
ReadX 6482 384 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 408 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 552 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 824 2048 2048
ReadX 6482 840 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 768 2048 2048
ReadX 6482 2048 2048 2048
WriteX 6482 1415 1 1
WriteX 6482 352 2048 2048
WriteX 6482 1112 2048 2048
WriteX 6482 1400 2048 2048
WriteX 6482 1408 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 2048 2048 2048
WriteX 6482 768 2048 2048
WriteX 6482 344 2048 2048
WriteX 6482 1000 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 416 2048 2048
ReadX 6482 424 2048 2048
ReadX 6482 432 2048 2048
ReadX 6482 440 2048 2048
ReadX 6482 576 16384 16384
ReadX 6482 448 2048 2048
ReadX 6482 456 2048 2048
ReadX 6482 464 2048 2048
ReadX 6482 640 16384 16384
ReadX 6482 704 16384 16384
ReadX 6482 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 6482 848 2048 2048
ReadX 6482 560 2048 2048
ReadX 6482 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 2600 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 352 2048 2048
ReadX 6482 1928 8192 8192
ReadX 6482 528 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 824 2048 2048
ReadX 6482 0 2048 2048
Flush 6482
ReadX 6482 2600 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 352 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 824 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 856 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 392 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 472 2048 2048
ReadX 6482 480 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 488 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 928 2048 2048
ReadX 6482 936 2048 2048
ReadX 6482 976 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 392 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 952 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 528 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 528 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 816 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 6482 1336 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 528 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 528 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1240 2048 2048
ReadX 6482 1000 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2200 4096 4096
ReadX 6482 2152 2048 2048
ReadX 6482 2160 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1312 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 1928 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 824 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1416 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 352 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 824 2048 2048
ReadX 6482 384 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 6482 352 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 768 2048 2048
ReadX 6482 2048 2048 2048
ReadX 6482 352 2048 2048
WriteX 6482 1551 1 1
WriteX 6482 1512 2048 2048
WriteX 6482 1520 2048 2048
WriteX 6482 1528 2048 2048
WriteX 6482 1544 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 2048 2048 2048
WriteX 6482 768 2048 2048
WriteX 6482 344 2048 2048
WriteX 6482 1000 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2048 2048 2048
WriteX 6482 2048 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 1000 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1240 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 344 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 384 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 768 2048 2048
WriteX 6482 1567 1 1
WriteX 6482 1552 2048 2048
WriteX 6482 1560 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 768 2048 2048
WriteX 6482 344 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 1328 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1240 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2200 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1240 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 344 2048 2048
ReadX 6482 384 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 2048 2048 2048
ReadX 6482 768 2048 2048
WriteX 6482 1583 1 1
WriteX 6482 1568 2048 2048
WriteX 6482 1576 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 2048 2048 2048
WriteX 6482 768 2048 2048
WriteX 6482 344 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 864 2048 2048
ReadX 6482 872 2048 2048
ReadX 6482 912 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 2688 2048 2048
ReadX 6482 1000 2048 2048
WriteX 6482 2688 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 2944 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 0 2048 2048
Flush 6482
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 2688 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 2688 2048 2048
WriteX 6482 2688 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 392 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 416 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 416 2048 2048
ReadX 6482 864 2048 2048
ReadX 6482 872 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 312 2048 2048
ReadX 6482 888 2048 2048
ReadX 6482 400 2048 2048
ReadX 6482 896 2048 2048
WriteX 6482 1584 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 400 2048 2048
WriteX 6482 416 2048 2048
WriteX 6482 864 2048 2048
WriteX 6482 872 2048 2048
WriteX 6482 888 2048 2048
WriteX 6482 896 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 584 2048 2048
ReadX 6482 392 2048 2048
WriteX 6482 392 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 1328 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 0 2048 2048
ReadX 6482 408 2048 2048
ReadX 6482 1328 2048 2048
ReadX 6482 864 2048 2048
ReadX 6482 912 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 3840 2048 2048
ReadX 6482 312 2048 2048
ReadX 6482 1584 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 408 2048 2048
WriteX 6482 912 2048 2048
WriteX 6482 1584 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 408 2048 2048
ReadX 6482 392 2048 2048
WriteX 6482 392 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 528 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 528 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 552 2048 2048
ReadX 6482 1336 2048 2048
WriteX 6482 552 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 0 2048 2048
ReadX 6482 552 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 2664 2048 2048
ReadX 6482 2648 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 2672 2048 2048
ReadX 6482 2656 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6482 528 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 1336 2048 2048
ReadX 6482 2680 2048 2048
ReadX 6482 2760 8192 8192
ReadX 6482 544 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 568 2048 2048
ReadX 6482 544 2048 2048
ReadX 6482 0 2048 2048
Flush 6482
ReadX 6482 2816 6144 6144
ReadX 6482 2760 2048 2048
ReadX 6482 2744 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 2752 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 528 2048 2048
ReadX 6482 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 6486
Close 6486
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 6488
WriteX 6488 4065 1 1
QUERY_FILE_INFORMATION 6488
WriteX 6488 0 62591 62591
Close 6488
ReadX 6482 0 2048 2048
ReadX 6482 2808 2048 2048
ReadX 6482 2792 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 2800 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 384 2048 2048
ReadX 6482 392 2048 2048
ReadX 6482 1384 2048 2048
ReadX 6482 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 6490
Close 6490
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 6492
WriteX 6492 4094 1 1
QUERY_FILE_INFORMATION 6492
WriteX 6492 0 10845 10845
Close 6492
ReadX 6482 1432 2048 2048
ReadX 6482 1304 2048 2048
ReadX 6482 1368 2048 2048
ReadX 6482 2304 2048 2048
ReadX 6482 1440 2048 2048
ReadX 6482 1424 2048 2048
ReadX 6482 1448 2048 2048
ReadX 6482 1456 2048 2048
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 6494
Close 6494
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 6496
ReadX 6482 0 2048 2048
WriteX 6496 4081 1 1
QUERY_FILE_INFORMATION 6496
WriteX 6496 0 30118 30118
Close 6496
ReadX 6482 1344 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1152 2048 2048
ReadX 6482 1152 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 1000 2048 2048
ReadX 6482 768 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 344 2048 2048
WriteX 6482 1000 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 1416 2048 2048
ReadX 6482 1416 2048 2048
ReadX 6482 344 2048 2048
ReadX 6482 896 2048 2048
WriteX 6482 1538 2 2
WriteX 6482 344 2048 2048
WriteX 6482 1416 2048 2048
WriteX 6482 1538 2 2
ReadX 6482 2048 2048 2048
WriteX 6482 2048 2048 2048
WriteX 6482 1538 2 2
Close 6482
Close 6484
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 6497
ReadX 6497 0 65471 65471
ReadX 6497 65471 63 63
ReadX 6497 65534 65471 65471
ReadX 6497 131005 63 63
ReadX 6497 131068 65471 65471
ReadX 6497 196539 63 63
ReadX 6497 196602 65471 65471
ReadX 6497 262073 63 63
ReadX 6497 262136 65471 65471
ReadX 6497 327607 63 63
ReadX 6497 327670 10 10
Close 6497
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 6498
ReadX 6498 0 65471 65471
ReadX 6498 65471 63 63
ReadX 6498 65534 65471 65471
ReadX 6498 131005 63 63
ReadX 6498 131068 65471 65471
ReadX 6498 196539 63 63
ReadX 6498 196602 65471 65471
ReadX 6498 262073 63 63
ReadX 6498 262136 65471 65471
ReadX 6498 327607 63 63
ReadX 6498 327670 65471 65471
ReadX 6498 393141 63 63
ReadX 6498 393204 65471 65471
ReadX 6498 458675 63 63
ReadX 6498 458738 65471 65471
ReadX 6498 524209 63 63
ReadX 6498 524272 65471 65471
ReadX 6498 589743 63 63
ReadX 6498 589806 65471 65471
ReadX 6498 655277 63 63
ReadX 6498 655340 32 32
Close 6498
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 6499
ReadX 6499 0 65471 65471
ReadX 6499 65471 63 63
ReadX 6499 65534 65471 65471
ReadX 6499 131005 63 63
ReadX 6499 131068 65471 65471
ReadX 6499 196539 63 63
ReadX 6499 196602 65471 65471
ReadX 6499 262073 63 63
ReadX 6499 262136 65471 65471
ReadX 6499 327607 63 63
ReadX 6499 327670 65471 65471
ReadX 6499 393141 63 63
ReadX 6499 393204 65471 65471
ReadX 6499 458675 63 63
ReadX 6499 458738 65471 65471
ReadX 6499 524209 63 63
ReadX 6499 524272 65471 65471
ReadX 6499 589743 63 63
ReadX 6499 589806 65471 65471
ReadX 6499 655277 63 63
ReadX 6499 655340 65471 65471
ReadX 6499 720811 63 63
ReadX 6499 720874 65471 65471
ReadX 6499 786345 63 63
ReadX 6499 786408 65471 65471
ReadX 6499 851879 63 63
ReadX 6499 851942 65471 65471
ReadX 6499 917413 63 63
ReadX 6499 917476 65471 65471
ReadX 6499 982947 63 63
ReadX 6499 983010 65471 65471
ReadX 6499 1048481 63 63
ReadX 6499 1048544 65471 65471
ReadX 6499 1114015 63 63
ReadX 6499 1114078 65471 65471
ReadX 6499 1179549 63 63
ReadX 6499 1179612 65471 65471
ReadX 6499 1245083 63 63
ReadX 6499 1245146 65471 65471
ReadX 6499 1310617 63 63
ReadX 6499 1310680 65471 65471
ReadX 6499 1376151 63 63
ReadX 6499 1376214 65471 65471
ReadX 6499 1441685 63 63
ReadX 6499 1441748 65471 65471
ReadX 6499 1507219 63 63
ReadX 6499 1507282 65471 65471
ReadX 6499 1572753 63 63
ReadX 6499 1572816 65471 65471
ReadX 6499 1638287 63 63
ReadX 6499 1638350 65471 65471
ReadX 6499 1703821 63 63
ReadX 6499 1703884 65471 65471
ReadX 6499 1769355 63 63
ReadX 6499 1769418 65471 65471
ReadX 6499 1834889 63 63
ReadX 6499 1834952 32824 32824
Close 6499
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6500
Close 6500
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6501
ReadX 6501 0 24 24
Close 6501
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6502
QUERY_FILE_INFORMATION 6502
ReadX 6502 0 512 512
ReadX 6502 464 512 512
ReadX 6502 498 512 512
ReadX 6502 472 512 512
ReadX 6502 466 512 512
ReadX 6502 978 512 512
ReadX 6502 497 57 57
Close 6502
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6503
QUERY_FILE_INFORMATION 6503
ReadX 6503 0 512 512
ReadX 6503 464 512 512
ReadX 6503 498 512 512
ReadX 6503 472 512 512
ReadX 6503 462 512 512
ReadX 6503 468 512 512
ReadX 6503 466 512 512
QUERY_FILE_INFORMATION 6503
WriteX 6503 482 60 60
WriteX 6503 482 4 4
QUERY_FILE_INFORMATION 6503
WriteX 6503 482 11 11
ReadX 6503 497 57 57
ReadX 6503 497 57 57
ReadX 6503 368 4096 4096
ReadX 6503 460 512 512
ReadX 6503 512 4096 4096
ReadX 6503 4608 4096 4096
ReadX 6503 8704 4096 4096
ReadX 6503 12800 4096 4096
ReadX 6503 16896 4096 4096
ReadX 6503 20992 4096 4096
ReadX 6503 25088 4096 4096
ReadX 6503 29184 4096 4096
ReadX 6503 33280 4096 4096
ReadX 6503 37376 4096 4096
ReadX 6503 41472 4096 4096
ReadX 6503 45568 4096 4096
ReadX 6503 49664 4096 4096
ReadX 6503 53760 4096 4096
ReadX 6503 57856 4096 4096
ReadX 6503 61952 4096 4096
ReadX 6503 66048 4096 4096
ReadX 6503 70144 4096 4096
ReadX 6503 497 20 20
ReadX 6503 496 103 103
ReadX 6503 500 448 448
ReadX 6503 470 512 512
ReadX 6503 486 2692 2692
ReadX 6503 290 4096 4096
ReadX 6503 4386 4096 4096
ReadX 6503 8482 4096 4096
ReadX 6503 500 20 20
ReadX 6503 483 108 108
ReadX 6503 482 292 292
ReadX 6503 338 4096 4096
ReadX 6503 4434 3103 3103
ReadX 6503 384 28 28
ReadX 6503 412 20 20
ReadX 6503 432 8 8
ReadX 6503 440 136 136
ReadX 6503 576 8 8
ReadX 6503 584 4 4
ReadX 6503 588 4 4
ReadX 6503 592 39 39
ReadX 6503 384 4 4
ReadX 6503 388 4 4
ReadX 6503 392 23 23
ReadX 6503 385 4 4
ReadX 6503 389 4 4
ReadX 6503 393 12 12
ReadX 6503 405 4 4
ReadX 6503 409 4 4
ReadX 6503 413 1 1
ReadX 6503 385 4 4
ReadX 6503 389 4 4
ReadX 6503 393 1 1
ReadX 6503 385 4 4
ReadX 6503 389 4 4
ReadX 6503 393 12 12
ReadX 6503 405 4 4
ReadX 6503 409 4 4
ReadX 6503 413 2 2
ReadX 6503 385 4 4
ReadX 6503 389 4 4
ReadX 6503 393 25 25
ReadX 6503 385 4 4
ReadX 6503 389 8 8
ReadX 6503 397 4 4
ReadX 6503 401 8 8
ReadX 6503 409 4 4
ReadX 6503 413 8 8
ReadX 6503 421 4 4
ReadX 6503 425 8 8
ReadX 6503 433 4 4
ReadX 6503 437 4 4
ReadX 6503 441 4 4
ReadX 6503 445 4 4
ReadX 6503 449 4 4
ReadX 6503 453 4 4
ReadX 6503 457 4 4
ReadX 6503 461 4 4
ReadX 6503 465 10670 10670
ReadX 6503 428 4096 4096
WriteX 6503 498 512 512
WriteX 6503 472 512 512
WriteX 6503 462 512 512
WriteX 6503 468 512 512
Close 6503
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6504
Close 6504
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6505
QUERY_FILE_INFORMATION 6505
ReadX 6505 0 512 512
ReadX 6505 464 512 512
ReadX 6505 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 6506
Close 6506
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 6505
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 6508
WriteX 6508 4607 1 1
QUERY_FILE_INFORMATION 6508
WriteX 6508 0 65471 65471
WriteX 6508 65471 65 65
WriteX 6508 65536 19979 19979
Close 6508
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6509
QUERY_FILE_INFORMATION 6509
ReadX 6509 0 512 512
ReadX 6509 462 512 512
ReadX 6509 974 512 512
ReadX 6509 1486 512 512
ReadX 6509 460 512 512
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
WriteX 6509 470 448 448
QUERY_FILE_INFORMATION 6509
WriteX 6509 470 60 60
WriteX 6509 470 4 4
QUERY_FILE_INFORMATION 6509
WriteX 6509 470 11 11
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
WriteX 6509 464 512 512
WriteX 6509 976 512 512
WriteX 6509 1488 512 512
WriteX 6509 462 512 512
WriteX 6509 0 512 512
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
ReadX 6509 470 512 512
WriteX 6509 482 512 512
WriteX 6509 482 292 292
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
WriteX 6509 483 20 20
WriteX 6509 483 108 108
QUERY_FILE_INFORMATION 6509
WriteX 6509 484 448 448
QUERY_FILE_INFORMATION 6509
WriteX 6509 484 44 44
WriteX 6509 484 20 20
WriteX 6509 480 512 512
WriteX 6509 472 512 512
WriteX 6509 476 512 512
WriteX 6509 988 512 512
WriteX 6509 474 512 512
Flush 6509
WriteX 6509 0 512 512
Flush 6509
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
WriteX 6509 480 512 512
WriteX 6509 472 512 512
WriteX 6509 476 512 512
QUERY_FILE_INFORMATION 6509
WriteX 6509 496 320 320
QUERY_FILE_INFORMATION 6509
WriteX 6509 496 60 60
ReadX 6509 484 512 512
WriteX 6509 500 512 512
WriteX 6509 470 512 512
WriteX 6509 486 2692 2692
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
WriteX 6509 497 25 25
WriteX 6509 496 103 103
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
WriteX 6509 497 44 44
WriteX 6509 497 20 20
WriteX 6509 498 512 512
WriteX 6509 462 512 512
WriteX 6509 466 512 512
WriteX 6509 978 512 512
WriteX 6509 464 512 512
Flush 6509
WriteX 6509 0 512 512
Flush 6509
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
QUERY_FILE_INFORMATION 6509
WriteX 6509 497 7 7
WriteX 6509 497 57 57
WriteX 6509 498 512 512
WriteX 6509 472 512 512
WriteX 6509 462 512 512
WriteX 6509 466 512 512
WriteX 6509 978 512 512
Flush 6509
WriteX 6509 498 512 512
Flush 6509
Close 6509
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6510
QUERY_FILE_INFORMATION 6510
ReadX 6510 0 512 512
ReadX 6510 464 512 512
ReadX 6510 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 6511
ReadX 6511 0 20 20
ReadX 6511 14 40 40
ReadX 6511 54 64 64
ReadX 6511 118 1152 1152
Close 6511
Close 6510
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6512
Close 6512
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6513
ReadX 6513 0 24 24
Close 6513
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6514
QUERY_FILE_INFORMATION 6514
ReadX 6514 0 512 512
ReadX 6514 464 512 512
ReadX 6514 498 512 512
ReadX 6514 472 512 512
ReadX 6514 462 512 512
ReadX 6514 466 512 512
ReadX 6514 978 512 512
ReadX 6514 497 57 57
Close 6514
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6515
QUERY_FILE_INFORMATION 6515
ReadX 6515 0 512 512
ReadX 6515 464 512 512
ReadX 6515 498 512 512
ReadX 6515 472 512 512
ReadX 6515 468 512 512
ReadX 6515 462 512 512
ReadX 6515 466 512 512
QUERY_FILE_INFORMATION 6515
WriteX 6515 482 60 60
WriteX 6515 482 4 4
QUERY_FILE_INFORMATION 6515
WriteX 6515 482 11 11
WriteX 6515 498 512 512
WriteX 6515 472 512 512
WriteX 6515 462 512 512
WriteX 6515 466 512 512
WriteX 6515 978 512 512
Close 6515
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 6516
Close 6516
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 6517
Close 6517
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 6519
WriteX 6519 4607 1 1
QUERY_FILE_INFORMATION 6519
WriteX 6519 0 65471 65471
WriteX 6519 65471 65 65
WriteX 6519 65536 17654 17654
Close 6519
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6520
QUERY_FILE_INFORMATION 6520
ReadX 6520 0 512 512
ReadX 6520 474 512 512
ReadX 6520 986 512 512
ReadX 6520 1498 512 512
ReadX 6520 472 512 512
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
WriteX 6520 482 448 448
QUERY_FILE_INFORMATION 6520
WriteX 6520 482 60 60
WriteX 6520 482 4 4
QUERY_FILE_INFORMATION 6520
WriteX 6520 482 11 11
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
WriteX 6520 476 512 512
WriteX 6520 988 512 512
WriteX 6520 1500 512 512
WriteX 6520 474 512 512
WriteX 6520 0 512 512
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
ReadX 6520 482 512 512
WriteX 6520 494 512 512
WriteX 6520 494 292 292
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
WriteX 6520 495 20 20
WriteX 6520 495 108 108
QUERY_FILE_INFORMATION 6520
WriteX 6520 496 448 448
QUERY_FILE_INFORMATION 6520
WriteX 6520 496 44 44
WriteX 6520 496 20 20
WriteX 6520 492 512 512
WriteX 6520 484 512 512
WriteX 6520 488 512 512
WriteX 6520 1000 512 512
WriteX 6520 486 512 512
Flush 6520
WriteX 6520 0 512 512
Flush 6520
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
WriteX 6520 492 512 512
WriteX 6520 484 512 512
WriteX 6520 488 512 512
QUERY_FILE_INFORMATION 6520
WriteX 6520 508 320 320
QUERY_FILE_INFORMATION 6520
WriteX 6520 508 60 60
ReadX 6520 496 512 512
WriteX 6520 512 512 512
WriteX 6520 482 512 512
WriteX 6520 498 2692 2692
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
WriteX 6520 509 25 25
WriteX 6520 508 103 103
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
WriteX 6520 509 44 44
WriteX 6520 509 20 20
WriteX 6520 510 512 512
WriteX 6520 474 512 512
WriteX 6520 478 512 512
WriteX 6520 990 512 512
WriteX 6520 476 512 512
Flush 6520
WriteX 6520 0 512 512
Flush 6520
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
QUERY_FILE_INFORMATION 6520
WriteX 6520 509 7 7
WriteX 6520 509 57 57
WriteX 6520 510 512 512
WriteX 6520 484 512 512
WriteX 6520 474 512 512
WriteX 6520 478 512 512
WriteX 6520 990 512 512
Flush 6520
WriteX 6520 510 512 512
Flush 6520
Close 6520
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6521
Close 6521
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6522
QUERY_FILE_INFORMATION 6522
ReadX 6522 0 512 512
ReadX 6522 476 512 512
ReadX 6522 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 6523
Close 6523
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 6524
QUERY_FILE_INFORMATION 6524
ReadX 6524 0 512 512
ReadX 6524 512 512 512
ReadX 6524 770 512 512
ReadX 6524 1282 512 512
ReadX 6524 1794 512 512
ReadX 6524 2562 512 512
ReadX 6524 3586 512 512
ReadX 6524 3828 512 512
ReadX 6524 288 512 512
ReadX 6524 1024 512 512
ReadX 6524 954 512 512
ReadX 6524 295 512 512
ReadX 6524 320 512 512
ReadX 6524 322 512 512
ReadX 6524 834 512 512
ReadX 6524 1346 512 512
ReadX 6524 1858 512 512
ReadX 6524 323 512 512
ReadX 6524 835 512 512
ReadX 6524 1347 512 512
ReadX 6524 1859 512 512
ReadX 6524 2371 345 345
ReadX 6524 322 167 167
ReadX 6524 489 512 512
ReadX 6524 1001 512 512
ReadX 6524 1513 512 512
ReadX 6524 2025 512 512
ReadX 6524 2537 512 512
ReadX 6524 3049 512 512
ReadX 6524 3561 345 345
ReadX 6524 323 167 167
ReadX 6524 490 512 512
ReadX 6524 1002 512 512
ReadX 6524 1514 512 512
ReadX 6524 2026 512 512
ReadX 6524 2538 512 512
ReadX 6524 3050 512 512
ReadX 6524 3562 512 512
ReadX 6524 4074 512 512
ReadX 6524 4586 512 512
ReadX 6524 5098 512 512
ReadX 6524 5610 512 512
ReadX 6524 6122 512 512
ReadX 6524 6634 512 512
ReadX 6524 7146 512 512
ReadX 6524 7658 512 512
ReadX 6524 8170 512 512
ReadX 6524 8682 512 512
ReadX 6524 9194 512 512
ReadX 6524 9706 512 512
ReadX 6524 10218 512 512
ReadX 6524 10730 345 345
ReadX 6524 11075 512 512
ReadX 6524 11587 167 167
ReadX 6524 11754 512 512
ReadX 6524 12266 512 512
ReadX 6524 12778 512 512
ReadX 6524 13290 512 512
ReadX 6524 13802 512 512
ReadX 6524 14314 512 512
ReadX 6524 14826 512 512
ReadX 6524 15338 512 512
ReadX 6524 337 512 512
ReadX 6524 337 512 512
ReadX 6524 849 34 34
ReadX 6524 352 512 512
ReadX 6524 864 512 512
ReadX 6524 1376 512 512
ReadX 6524 1888 512 512
ReadX 6524 2400 512 512
ReadX 6524 2912 512 512
ReadX 6524 3424 512 512
ReadX 6524 3936 512 512
ReadX 6524 1632 512 512
ReadX 6524 2144 512 512
ReadX 6524 1682 512 512
ReadX 6524 258 512 512
ReadX 6524 360 144 144
ReadX 6524 2517 512 512
ReadX 6524 3029 512 512
ReadX 6524 1751 512 512
ReadX 6524 2263 512 512
ReadX 6524 2775 512 512
ReadX 6524 3287 512 512
ReadX 6524 3799 512 512
ReadX 6524 4311 512 512
ReadX 6524 4823 512 512
ReadX 6524 5335 512 512
ReadX 6524 5847 512 512
ReadX 6524 6359 512 512
ReadX 6524 6871 512 512
ReadX 6524 7383 512 512
ReadX 6524 7895 512 512
ReadX 6524 8407 512 512
ReadX 6524 8919 512 512
ReadX 6524 9431 512 512
ReadX 6524 9943 512 512
ReadX 6524 10455 512 512
ReadX 6524 10967 512 512
ReadX 6524 11479 512 512
ReadX 6524 2556 512 512
ReadX 6524 3068 512 512
ReadX 6524 3580 512 512
ReadX 6524 4092 512 512
ReadX 6524 4604 512 512
ReadX 6524 5116 512 512
ReadX 6524 5628 512 512
ReadX 6524 6140 512 512
ReadX 6524 6652 512 512
ReadX 6524 7164 512 512
ReadX 6524 7676 512 512
ReadX 6524 8188 512 512
ReadX 6524 8700 512 512
ReadX 6524 9212 512 512
ReadX 6524 9724 512 512
ReadX 6524 10236 512 512
ReadX 6524 10748 512 512
ReadX 6524 11260 512 512
ReadX 6524 11772 512 512
ReadX 6524 12284 512 512
ReadX 6524 12796 49 49
ReadX 6524 260 463 463
ReadX 6524 723 512 512
ReadX 6524 1235 512 512
ReadX 6524 1747 512 512
ReadX 6524 2259 512 512
ReadX 6524 2771 512 512
ReadX 6524 3283 512 512
ReadX 6524 3795 512 512
ReadX 6524 4307 512 512
ReadX 6524 4819 512 512
ReadX 6524 5331 512 512
ReadX 6524 5843 512 512
ReadX 6524 6355 512 512
ReadX 6524 6867 512 512
ReadX 6524 7379 512 512
ReadX 6524 7891 512 512
ReadX 6524 8403 512 512
ReadX 6524 8915 512 512
ReadX 6524 9427 512 512
ReadX 6524 9939 512 512
ReadX 6524 10451 512 512
ReadX 6524 10963 402 402
ReadX 6524 593 240 240
ReadX 6524 2048 272 272
ReadX 6524 2320 512 512
ReadX 6524 2832 512 512
ReadX 6524 3344 512 512
ReadX 6524 3856 512 512
ReadX 6524 4368 512 512
ReadX 6524 4880 512 512
ReadX 6524 5392 240 240
ReadX 6524 608 272 272
ReadX 6524 880 512 512
ReadX 6524 1392 512 512
ReadX 6524 1904 512 512
ReadX 6524 2416 512 512
ReadX 6524 2928 512 512
ReadX 6524 3440 512 512
ReadX 6524 3952 512 512
ReadX 6524 4464 512 512
ReadX 6524 4976 512 512
ReadX 6524 5488 512 512
ReadX 6524 6000 512 512
ReadX 6524 6512 512 512
ReadX 6524 7024 512 512
ReadX 6524 7536 512 512
ReadX 6524 8048 512 512
ReadX 6524 8560 512 512
ReadX 6524 9072 512 512
ReadX 6524 9584 512 512
ReadX 6524 10096 512 512
ReadX 6524 1683 512 512
ReadX 6524 514 512 512
ReadX 6524 620 512 512
ReadX 6524 770 512 512
ReadX 6524 1282 512 512
ReadX 6524 1794 512 512
ReadX 6524 2000 512 512
ReadX 6524 1434 512 512
ReadX 6524 2050 512 512
ReadX 6524 2118 512 512
ReadX 6524 1715 512 512
ReadX 6524 1024 512 512
ReadX 6524 954 512 512
ReadX 6524 1880 512 512
ReadX 6524 1286 512 512
ReadX 6524 1510 512 512
ReadX 6524 2562 512 512
ReadX 6524 2610 512 512
ReadX 6524 3586 512 512
ReadX 6524 3812 512 512
ReadX 6524 3828 512 512
ReadX 6524 4046 512 512
ReadX 6524 4066 512 512
ReadX 6524 1747 512 512
ReadX 6524 1026 512 512
ReadX 6524 1538 512 512
ReadX 6524 514 512 512
ReadX 6524 751 512 512
ReadX 6524 1263 512 512
ReadX 6524 620 512 512
ReadX 6524 1132 512 512
ReadX 6524 1644 512 512
ReadX 6524 2156 512 512
ReadX 6524 2668 512 512
ReadX 6524 3180 512 512
ReadX 6524 3692 512 512
ReadX 6524 4204 394 394
ReadX 6524 606 118 118
ReadX 6524 724 512 512
ReadX 6524 1236 512 512
ReadX 6524 1748 512 512
ReadX 6524 2260 512 512
ReadX 6524 2772 512 512
ReadX 6524 3284 512 512
ReadX 6524 3796 394 394
ReadX 6524 636 118 118
ReadX 6524 754 512 512
ReadX 6524 1266 512 512
ReadX 6524 1778 512 512
ReadX 6524 2290 512 512
ReadX 6524 2802 512 512
ReadX 6524 3314 512 512
ReadX 6524 3826 512 512
ReadX 6524 4338 512 512
ReadX 6524 4850 512 512
ReadX 6524 5362 512 512
ReadX 6524 5874 512 512
ReadX 6524 6386 512 512
ReadX 6524 6898 512 512
ReadX 6524 7410 512 512
ReadX 6524 7922 512 512
ReadX 6524 8434 512 512
ReadX 6524 8946 512 512
ReadX 6524 9458 512 512
ReadX 6524 9970 512 512
ReadX 6524 10482 512 512
ReadX 6524 723 512 512
ReadX 6524 1235 512 512
ReadX 6524 725 512 512
ReadX 6524 729 512 512
ReadX 6524 1241 512 512
ReadX 6524 1753 512 512
ReadX 6524 2265 512 512
ReadX 6524 2777 512 512
ReadX 6524 3289 512 512
ReadX 6524 3801 512 512
ReadX 6524 4313 512 512
ReadX 6524 4825 512 512
ReadX 6524 5337 512 512
ReadX 6524 5849 512 512
ReadX 6524 6361 512 512
ReadX 6524 755 512 512
ReadX 6524 1267 512 512
ReadX 6524 1779 512 512
ReadX 6524 2291 512 512
ReadX 6524 2803 512 512
ReadX 6524 3315 512 512
ReadX 6524 3827 512 512
ReadX 6524 4339 244 244
ReadX 6524 4583 512 512
ReadX 6524 5095 268 268
ReadX 6524 5363 512 512
ReadX 6524 5875 512 512
ReadX 6524 6387 512 512
ReadX 6524 6899 512 512
ReadX 6524 7411 512 512
ReadX 6524 7923 512 512
ReadX 6524 8435 512 512
ReadX 6524 8947 512 512
ReadX 6524 9459 512 512
ReadX 6524 9971 512 512
ReadX 6524 10483 512 512
ReadX 6524 10995 512 512
ReadX 6524 11507 512 512
ReadX 6524 12019 512 512
ReadX 6524 12531 512 512
ReadX 6524 13043 512 512
ReadX 6524 13555 512 512
ReadX 6524 14067 512 512
ReadX 6524 14579 512 512
ReadX 6524 15091 512 512
ReadX 6524 15603 342 342
ReadX 6524 725 512 512
ReadX 6524 2000 512 512
ReadX 6524 3918 512 512
ReadX 6524 727 512 512
ReadX 6524 258 512 512
ReadX 6524 376 512 512
ReadX 6524 1109 512 512
ReadX 6524 1028 512 512
ReadX 6524 1540 512 512
ReadX 6524 2052 512 512
ReadX 6524 2564 512 512
ReadX 6524 3076 512 512
ReadX 6524 3588 512 512
ReadX 6524 4100 512 512
ReadX 6524 4612 412 412
ReadX 6524 1012 100 100
ReadX 6524 1112 512 512
ReadX 6524 1624 512 512
ReadX 6524 2136 512 512
ReadX 6524 2648 512 512
ReadX 6524 3160 512 512
ReadX 6524 3672 512 512
ReadX 6524 4184 412 412
ReadX 6524 1044 100 100
ReadX 6524 1144 512 512
ReadX 6524 1656 512 512
ReadX 6524 2168 512 512
ReadX 6524 2680 512 512
ReadX 6524 3192 512 512
ReadX 6524 3704 512 512
ReadX 6524 4216 512 512
ReadX 6524 4728 512 512
ReadX 6524 5240 512 512
ReadX 6524 5752 512 512
ReadX 6524 6264 512 512
ReadX 6524 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 6524 7288 512 512
ReadX 6524 7800 512 512
ReadX 6524 8312 512 512
ReadX 6524 8824 512 512
ReadX 6524 9336 512 512
ReadX 6524 9848 512 512
ReadX 6524 10360 512 512
ReadX 6524 10872 512 512
ReadX 6524 11384 512 512
ReadX 6524 11896 512 512
ReadX 6524 12408 512 512
ReadX 6524 1088 512 512
ReadX 6524 1600 512 512
ReadX 6524 1090 512 512
ReadX 6524 1094 512 512
ReadX 6524 1606 512 512
ReadX 6524 2118 512 512
ReadX 6524 2630 512 512
ReadX 6524 3142 512 512
ReadX 6524 3654 512 512
ReadX 6524 4166 512 512
ReadX 6524 4678 512 512
ReadX 6524 1111 512 512
ReadX 6524 1623 512 512
ReadX 6524 2135 512 512
ReadX 6524 2647 512 512
ReadX 6524 3159 512 512
ReadX 6524 3671 512 512
ReadX 6524 4183 512 512
ReadX 6524 4695 512 512
ReadX 6524 5207 512 512
ReadX 6524 5719 512 512
ReadX 6524 6231 512 512
ReadX 6524 6743 512 512
ReadX 6524 7255 512 512
ReadX 6524 7767 512 512
ReadX 6524 8279 512 512
ReadX 6524 8791 512 512
ReadX 6524 9303 512 512
ReadX 6524 9815 512 512
ReadX 6524 10327 512 512
ReadX 6524 10839 512 512
ReadX 6524 11351 294 294
ReadX 6524 1091 512 512
ReadX 6524 970 512 512
ReadX 6524 1093 512 512
ReadX 6524 1434 512 512
ReadX 6524 2050 512 512
ReadX 6524 2158 512 512
ReadX 6524 2118 512 512
ReadX 6524 2630 512 512
ReadX 6524 3142 512 512
ReadX 6524 3654 512 512
ReadX 6524 4166 512 512
ReadX 6524 4678 512 512
ReadX 6524 5190 512 512
ReadX 6524 5702 382 382
ReadX 6524 2104 130 130
ReadX 6524 2234 512 512
ReadX 6524 2746 512 512
ReadX 6524 3258 512 512
ReadX 6524 3770 512 512
ReadX 6524 4282 512 512
ReadX 6524 4794 512 512
ReadX 6524 5306 382 382
ReadX 6524 2134 130 130
ReadX 6524 2264 512 512
ReadX 6524 2776 512 512
ReadX 6524 3288 512 512
ReadX 6524 3800 512 512
ReadX 6524 4312 512 512
ReadX 6524 4824 512 512
ReadX 6524 5336 512 512
ReadX 6524 2147 512 512
ReadX 6524 2149 512 512
ReadX 6524 2152 512 512
ReadX 6524 2664 512 512
ReadX 6524 3176 512 512
ReadX 6524 3688 512 512
ReadX 6524 2159 512 512
ReadX 6524 2671 512 512
ReadX 6524 3183 512 512
ReadX 6524 3695 512 512
ReadX 6524 4207 512 512
ReadX 6524 4719 512 512
ReadX 6524 5231 512 512
ReadX 6524 5743 512 512
ReadX 6524 6255 512 512
ReadX 6524 6767 512 512
ReadX 6524 7279 512 512
ReadX 6524 7791 512 512
ReadX 6524 8303 512 512
ReadX 6524 8815 512 512
ReadX 6524 9327 512 512
ReadX 6524 9839 512 512
ReadX 6524 10351 512 512
ReadX 6524 10863 512 512
ReadX 6524 11375 512 512
ReadX 6524 11887 512 512
ReadX 6524 12399 38 38
ReadX 6524 2149 512 512
ReadX 6524 1794 512 512
ReadX 6524 2016 512 512
ReadX 6524 2151 512 512
ReadX 6524 1918 512 512
ReadX 6524 1880 512 512
ReadX 6524 2392 512 512
ReadX 6524 2904 512 512
ReadX 6524 3416 512 512
ReadX 6524 3928 512 512
ReadX 6524 4440 512 512
ReadX 6524 4952 512 512
ReadX 6524 5464 416 416
ReadX 6524 1866 96 96
ReadX 6524 1962 512 512
ReadX 6524 2474 512 512
ReadX 6524 2986 512 512
ReadX 6524 3498 512 512
ReadX 6524 4010 512 512
ReadX 6524 4522 512 512
ReadX 6524 5034 416 416
ReadX 6524 1896 96 96
ReadX 6524 1992 512 512
ReadX 6524 2504 512 512
ReadX 6524 3016 512 512
ReadX 6524 3528 512 512
ReadX 6524 1903 512 512
ReadX 6524 1905 512 512
ReadX 6524 1908 512 512
ReadX 6524 2420 512 512
ReadX 6524 2932 512 512
ReadX 6524 3444 512 512
ReadX 6524 3956 512 512
ReadX 6524 1919 512 512
ReadX 6524 2431 512 512
ReadX 6524 2943 512 512
ReadX 6524 3455 512 512
ReadX 6524 3967 512 512
ReadX 6524 4479 512 512
ReadX 6524 4991 512 512
ReadX 6524 5503 512 512
ReadX 6524 6015 512 512
ReadX 6524 6527 512 512
ReadX 6524 7039 512 512
ReadX 6524 7551 512 512
ReadX 6524 8063 512 512
ReadX 6524 8575 512 512
ReadX 6524 9087 512 512
ReadX 6524 9599 512 512
ReadX 6524 10111 512 512
ReadX 6524 10623 512 512
ReadX 6524 11135 512 512
ReadX 6524 11647 512 512
ReadX 6524 12159 322 322
ReadX 6524 1905 512 512
ReadX 6524 1846 512 512
ReadX 6524 1907 512 512
ReadX 6524 1860 268 268
ReadX 6524 1832 244 244
ReadX 6524 1846 512 512
ReadX 6524 2358 512 512
ReadX 6524 2870 512 512
ReadX 6524 3382 512 512
ReadX 6524 3894 512 512
ReadX 6524 4406 512 512
ReadX 6524 4918 512 512
ReadX 6524 1858 512 512
ReadX 6524 1859 512 512
ReadX 6524 1860 488 488
ReadX 6524 1832 24 24
ReadX 6524 1861 228 228
ReadX 6524 1832 284 284
ReadX 6524 2116 512 512
ReadX 6524 2628 512 512
ReadX 6524 3140 512 512
ReadX 6524 3652 512 512
ReadX 6524 4164 512 512
ReadX 6524 4676 512 512
ReadX 6524 5188 228 228
ReadX 6524 1862 284 284
ReadX 6524 2146 512 512
ReadX 6524 2658 38 38
ReadX 6524 1859 512 512
ReadX 6524 2047 512 512
ReadX 6524 2016 512 512
ReadX 6524 2528 512 512
ReadX 6524 3040 512 512
ReadX 6524 3552 512 512
ReadX 6524 4064 512 512
ReadX 6524 4576 512 512
ReadX 6524 5088 512 512
ReadX 6524 5600 424 424
ReadX 6524 2002 88 88
ReadX 6524 2090 512 512
ReadX 6524 2602 512 512
ReadX 6524 3114 512 512
ReadX 6524 3626 512 512
ReadX 6524 4138 512 512
ReadX 6524 4650 512 512
ReadX 6524 5162 424 424
ReadX 6524 2032 88 88
ReadX 6524 2120 512 512
ReadX 6524 2632 512 512
ReadX 6524 3144 512 512
ReadX 6524 3656 512 512
ReadX 6524 4168 512 512
ReadX 6524 4680 512 512
ReadX 6524 5192 512 512
ReadX 6524 2044 512 512
ReadX 6524 2045 512 512
ReadX 6524 2046 512 512
ReadX 6524 2047 512 512
ReadX 6524 2559 110 110
ReadX 6524 2052 402 402
ReadX 6524 2454 512 512
ReadX 6524 2966 512 512
ReadX 6524 3478 512 512
ReadX 6524 3990 512 512
ReadX 6524 4502 512 512
ReadX 6524 5014 512 512
ReadX 6524 5526 512 512
ReadX 6524 6038 512 512
ReadX 6524 6550 512 512
ReadX 6524 7062 512 512
ReadX 6524 7574 512 512
ReadX 6524 8086 512 512
ReadX 6524 8598 512 512
ReadX 6524 9110 512 512
ReadX 6524 9622 512 512
ReadX 6524 10134 512 512
ReadX 6524 10646 512 512
ReadX 6524 11158 512 512
ReadX 6524 11670 512 512
ReadX 6524 12182 512 512
ReadX 6524 12694 118 118
ReadX 6524 2045 512 512
ReadX 6524 1282 512 512
ReadX 6524 1343 512 512
ReadX 6524 1286 512 512
ReadX 6524 1798 512 512
ReadX 6524 2310 512 512
ReadX 6524 2822 512 512
ReadX 6524 3334 512 512
ReadX 6524 3846 512 512
ReadX 6524 4358 512 512
ReadX 6524 4870 416 416
ReadX 6524 1270 96 96
ReadX 6524 1366 512 512
ReadX 6524 1878 512 512
ReadX 6524 2390 512 512
ReadX 6524 2902 512 512
ReadX 6524 3414 512 512
ReadX 6524 3926 416 416
ReadX 6524 1284 96 96
ReadX 6524 1380 416 416
ReadX 6524 1302 96 96
ReadX 6524 1398 512 512
ReadX 6524 1910 512 512
ReadX 6524 2422 512 512
ReadX 6524 2934 512 512
ReadX 6524 3446 512 512
ReadX 6524 3958 512 512
ReadX 6524 4470 512 512
ReadX 6524 4982 512 512
ReadX 6524 5494 512 512
ReadX 6524 6006 512 512
ReadX 6524 6518 512 512
ReadX 6524 7030 512 512
ReadX 6524 7542 512 512
ReadX 6524 1328 512 512
ReadX 6524 1330 512 512
ReadX 6524 1333 512 512
ReadX 6524 1845 512 512
ReadX 6524 2357 512 512
ReadX 6524 2869 512 512
ReadX 6524 3381 512 512
ReadX 6524 1344 512 512
ReadX 6524 1856 512 512
ReadX 6524 2368 512 512
ReadX 6524 2880 512 512
ReadX 6524 3392 512 512
ReadX 6524 3904 512 512
ReadX 6524 4416 512 512
ReadX 6524 4928 512 512
ReadX 6524 5440 512 512
ReadX 6524 5952 512 512
ReadX 6524 6464 512 512
ReadX 6524 6976 512 512
ReadX 6524 7488 512 512
ReadX 6524 8000 512 512
ReadX 6524 8512 512 512
ReadX 6524 9024 512 512
ReadX 6524 9536 512 512
ReadX 6524 10048 512 512
ReadX 6524 10560 512 512
ReadX 6524 11072 512 512
ReadX 6524 11584 426 426
ReadX 6524 1330 512 512
ReadX 6524 1842 512 512
ReadX 6524 1250 512 512
ReadX 6524 1264 268 268
ReadX 6524 1236 244 244
ReadX 6524 1250 512 512
ReadX 6524 1762 512 512
ReadX 6524 2274 512 512
ReadX 6524 2786 512 512
ReadX 6524 3298 512 512
ReadX 6524 3810 512 512
ReadX 6524 4322 512 512
ReadX 6524 1262 512 512
ReadX 6524 1263 512 512
ReadX 6524 1264 488 488
ReadX 6524 1236 24 24
ReadX 6524 1265 228 228
ReadX 6524 1236 284 284
ReadX 6524 1520 512 512
ReadX 6524 2032 512 512
ReadX 6524 2544 512 512
ReadX 6524 3056 512 512
ReadX 6524 3568 512 512
ReadX 6524 4080 512 512
ReadX 6524 4592 228 228
ReadX 6524 1266 284 284
ReadX 6524 1550 512 512
ReadX 6524 2062 42 42
ReadX 6524 1263 512 512
ReadX 6524 1538 512 512
ReadX 6524 1640 512 512
ReadX 6524 1510 512 512
ReadX 6524 2022 512 512
ReadX 6524 2534 512 512
ReadX 6524 3046 512 512
ReadX 6524 3558 512 512
ReadX 6524 4070 512 512
ReadX 6524 4582 512 512
ReadX 6524 5094 408 408
ReadX 6524 1496 104 104
ReadX 6524 1600 512 512
ReadX 6524 2112 512 512
ReadX 6524 2624 512 512
ReadX 6524 3136 512 512
ReadX 6524 3648 512 512
ReadX 6524 4160 512 512
ReadX 6524 4672 408 408
ReadX 6524 1526 104 104
ReadX 6524 1630 512 512
ReadX 6524 2142 512 512
ReadX 6524 2654 512 512
ReadX 6524 3166 512 512
ReadX 6524 3678 512 512
ReadX 6524 4190 408 408
ReadX 6524 1540 104 104
ReadX 6524 1644 512 512
ReadX 6524 2156 512 512
ReadX 6524 2668 512 512
ReadX 6524 3180 512 512
ReadX 6524 3692 512 512
ReadX 6524 4204 512 512
ReadX 6524 4716 512 512
ReadX 6524 5228 512 512
ReadX 6524 5740 512 512
ReadX 6524 6252 512 512
ReadX 6524 6764 512 512
ReadX 6524 7276 512 512
ReadX 6524 7788 512 512
ReadX 6524 8300 512 512
ReadX 6524 8812 512 512
ReadX 6524 9324 512 512
ReadX 6524 9836 512 512
ReadX 6524 10348 512 512
ReadX 6524 10860 512 512
ReadX 6524 11372 512 512
ReadX 6524 1615 512 512
ReadX 6524 2127 512 512
ReadX 6524 1617 512 512
ReadX 6524 1621 512 512
ReadX 6524 2133 512 512
ReadX 6524 2645 512 512
ReadX 6524 3157 512 512
ReadX 6524 3669 512 512
ReadX 6524 4181 512 512
ReadX 6524 4693 512 512
ReadX 6524 5205 512 512
ReadX 6524 5717 512 512
ReadX 6524 6229 512 512
ReadX 6524 1641 512 512
ReadX 6524 2153 512 512
ReadX 6524 2665 512 512
ReadX 6524 3177 512 512
ReadX 6524 3689 512 512
ReadX 6524 4201 512 512
ReadX 6524 4713 512 512
ReadX 6524 5225 512 512
ReadX 6524 5737 512 512
ReadX 6524 6249 512 512
ReadX 6524 6761 512 512
ReadX 6524 7273 512 512
ReadX 6524 7785 512 512
ReadX 6524 8297 512 512
ReadX 6524 8809 512 512
ReadX 6524 9321 512 512
ReadX 6524 9833 512 512
ReadX 6524 10345 512 512
ReadX 6524 10857 512 512
ReadX 6524 11369 512 512
ReadX 6524 11881 2 2
ReadX 6524 1796 510 510
ReadX 6524 2306 512 512
ReadX 6524 2818 512 512
ReadX 6524 3330 512 512
ReadX 6524 3842 512 512
ReadX 6524 4354 512 512
ReadX 6524 4866 512 512
ReadX 6524 5378 512 512
ReadX 6524 5890 512 512
ReadX 6524 6402 512 512
ReadX 6524 6914 512 512
ReadX 6524 7426 512 512
ReadX 6524 7938 512 512
ReadX 6524 8450 512 512
ReadX 6524 8962 512 512
ReadX 6524 9474 512 512
ReadX 6524 9986 512 512
ReadX 6524 10498 326 326
ReadX 6524 1617 512 512
ReadX 6524 2129 512 512
ReadX 6524 1450 512 512
ReadX 6524 1621 512 512
ReadX 6524 1446 512 512
ReadX 6524 1450 512 512
ReadX 6524 1962 512 512
ReadX 6524 2474 512 512
ReadX 6524 2986 512 512
ReadX 6524 3498 512 512
ReadX 6524 4010 512 512
ReadX 6524 4522 512 512
ReadX 6524 5034 424 424
ReadX 6524 1436 88 88
ReadX 6524 1524 512 512
ReadX 6524 2036 512 512
ReadX 6524 2548 512 512
ReadX 6524 3060 512 512
ReadX 6524 1442 512 512
ReadX 6524 1443 512 512
ReadX 6524 1444 512 512
ReadX 6524 1446 512 512
ReadX 6524 1958 386 386
ReadX 6524 1466 126 126
ReadX 6524 1592 512 512
ReadX 6524 2104 512 512
ReadX 6524 2616 512 512
ReadX 6524 3128 512 512
ReadX 6524 3640 512 512
ReadX 6524 4152 512 512
ReadX 6524 4664 512 512
ReadX 6524 5176 512 512
ReadX 6524 5688 512 512
ReadX 6524 6200 512 512
ReadX 6524 6712 512 512
ReadX 6524 7224 512 512
ReadX 6524 7736 512 512
ReadX 6524 8248 512 512
ReadX 6524 8760 294 294
ReadX 6524 1443 512 512
ReadX 6524 964 512 512
ReadX 6524 970 512 512
ReadX 6524 1482 512 512
ReadX 6524 1994 512 512
ReadX 6524 2506 512 512
ReadX 6524 3018 512 512
ReadX 6524 3530 512 512
ReadX 6524 4042 512 512
ReadX 6524 4554 424 424
ReadX 6524 956 88 88
ReadX 6524 1044 512 512
ReadX 6524 1556 512 512
ReadX 6524 2068 512 512
ReadX 6524 2580 512 512
ReadX 6524 962 512 512
ReadX 6524 963 512 512
ReadX 6524 964 512 512
ReadX 6524 965 512 512
ReadX 6524 1477 512 512
ReadX 6524 1989 228 228
ReadX 6524 986 284 284
ReadX 6524 1270 512 512
ReadX 6524 1782 512 512
ReadX 6524 2294 512 512
ReadX 6524 2806 512 512
ReadX 6524 3318 512 512
ReadX 6524 3830 512 512
ReadX 6524 4342 512 512
ReadX 6524 4854 512 512
ReadX 6524 5366 512 512
ReadX 6524 5878 512 512
ReadX 6524 6390 512 512
ReadX 6524 6902 512 512
ReadX 6524 7414 42 42
ReadX 6524 963 512 512
ReadX 6524 2610 512 512
ReadX 6524 3812 512 512
ReadX 6524 3828 512 512
ReadX 6524 3969 512 512
ReadX 6524 3918 512 512
ReadX 6524 4430 512 512
ReadX 6524 4942 512 512
ReadX 6524 5454 512 512
ReadX 6524 5966 512 512
ReadX 6524 6478 512 512
ReadX 6524 6990 512 512
ReadX 6524 7502 424 424
ReadX 6524 3904 88 88
ReadX 6524 3992 512 512
ReadX 6524 4504 512 512
ReadX 6524 5016 512 512
ReadX 6524 5528 512 512
ReadX 6524 6040 512 512
ReadX 6524 6552 512 512
ReadX 6524 7064 424 424
ReadX 6524 3934 88 88
ReadX 6524 4022 512 512
ReadX 6524 4534 512 512
ReadX 6524 5046 512 512
ReadX 6524 5558 512 512
ReadX 6524 6070 512 512
ReadX 6524 6582 512 512
ReadX 6524 7094 512 512
ReadX 6524 7606 512 512
ReadX 6524 8118 512 512
ReadX 6524 8630 512 512
ReadX 6524 3953 512 512
ReadX 6524 4465 512 512
ReadX 6524 3956 512 512
ReadX 6524 3964 512 512
ReadX 6524 4476 512 512
ReadX 6524 4988 512 512
ReadX 6524 3970 512 512
ReadX 6524 4482 512 512
ReadX 6524 4994 512 512
ReadX 6524 5506 512 512
ReadX 6524 6018 512 512
ReadX 6524 6530 512 512
ReadX 6524 7042 512 512
ReadX 6524 7554 512 512
ReadX 6524 8066 512 512
ReadX 6524 8578 512 512
ReadX 6524 9090 512 512
ReadX 6524 9602 512 512
ReadX 6524 10114 512 512
ReadX 6524 10626 512 512
ReadX 6524 11138 512 512
ReadX 6524 11650 512 512
ReadX 6524 12162 512 512
ReadX 6524 12674 512 512
ReadX 6524 13186 512 512
ReadX 6524 13698 512 512
ReadX 6524 14210 134 134
ReadX 6524 3956 512 512
ReadX 6524 4468 512 512
ReadX 6524 4980 512 512
ReadX 6524 5492 512 512
ReadX 6524 3074 512 512
ReadX 6524 3246 512 512
ReadX 6524 3964 512 512
ReadX 6524 3330 512 512
ReadX 6524 3465 512 512
ReadX 6524 3246 512 512
ReadX 6524 3758 512 512
ReadX 6524 4270 512 512
ReadX 6524 4782 512 512
ReadX 6524 5294 512 512
ReadX 6524 5806 512 512
ReadX 6524 6318 512 512
ReadX 6524 6830 368 368
ReadX 6524 3232 144 144
ReadX 6524 3376 512 512
ReadX 6524 3888 512 512
ReadX 6524 4400 512 512
ReadX 6524 4912 512 512
ReadX 6524 5424 512 512
ReadX 6524 5936 512 512
ReadX 6524 6448 368 368
ReadX 6524 3262 144 144
ReadX 6524 3406 512 512
ReadX 6524 3918 512 512
ReadX 6524 4430 512 512
ReadX 6524 4942 512 512
ReadX 6524 5454 512 512
ReadX 6524 5966 512 512
ReadX 6524 6478 512 512
ReadX 6524 6990 512 512
ReadX 6524 7502 512 512
ReadX 6524 8014 512 512
ReadX 6524 8526 512 512
ReadX 6524 9038 512 512
ReadX 6524 9550 512 512
ReadX 6524 10062 512 512
ReadX 6524 10574 512 512
ReadX 6524 11086 512 512
ReadX 6524 11598 512 512
ReadX 6524 12110 512 512
ReadX 6524 12622 512 512
ReadX 6524 13134 512 512
ReadX 6524 13646 368 368
ReadX 6524 3332 144 144
ReadX 6524 3476 512 512
ReadX 6524 3988 512 512
ReadX 6524 4500 512 512
ReadX 6524 5012 512 512
ReadX 6524 5524 512 512
ReadX 6524 6036 512 512
ReadX 6524 6548 512 512
ReadX 6524 7060 512 512
ReadX 6524 7572 512 512
ReadX 6524 8084 512 512
ReadX 6524 8596 512 512
ReadX 6524 9108 512 512
ReadX 6524 9620 512 512
ReadX 6524 10132 512 512
ReadX 6524 10644 512 512
ReadX 6524 11156 512 512
ReadX 6524 11668 512 512
ReadX 6524 12180 512 512
ReadX 6524 12692 512 512
ReadX 6524 13204 512 512
ReadX 6524 3430 512 512
ReadX 6524 3942 512 512
ReadX 6524 3434 512 512
ReadX 6524 3435 512 512
ReadX 6524 3947 512 512
ReadX 6524 4459 512 512
ReadX 6524 4971 512 512
ReadX 6524 5483 512 512
ReadX 6524 5995 512 512
ReadX 6524 6507 512 512
ReadX 6524 7019 512 512
ReadX 6524 7531 512 512
ReadX 6524 8043 512 512
ReadX 6524 8555 512 512
ReadX 6524 9067 512 512
ReadX 6524 9579 512 512
ReadX 6524 10091 512 512
ReadX 6524 10603 512 512
ReadX 6524 11115 512 512
ReadX 6524 3467 512 512
ReadX 6524 3979 512 512
ReadX 6524 4491 512 512
ReadX 6524 5003 512 512
ReadX 6524 5515 512 512
ReadX 6524 6027 512 512
ReadX 6524 6539 512 512
ReadX 6524 7051 512 512
ReadX 6524 7563 512 512
ReadX 6524 8075 512 512
ReadX 6524 8587 512 512
ReadX 6524 9099 512 512
ReadX 6524 9611 512 512
ReadX 6524 10123 512 512
ReadX 6524 10635 512 512
ReadX 6524 11147 512 512
ReadX 6524 11659 512 512
ReadX 6524 12171 512 512
ReadX 6524 12683 512 512
ReadX 6524 13195 512 512
ReadX 6524 13707 56 56
ReadX 6524 13763 512 512
ReadX 6524 14275 456 456
ReadX 6524 14731 512 512
ReadX 6524 15243 512 512
ReadX 6524 15755 512 512
ReadX 6524 16267 512 512
ReadX 6524 16779 512 512
ReadX 6524 17291 512 512
ReadX 6524 17803 512 512
ReadX 6524 18315 512 512
ReadX 6524 18827 512 512
ReadX 6524 19339 512 512
ReadX 6524 19851 512 512
ReadX 6524 20363 512 512
ReadX 6524 20875 512 512
ReadX 6524 21387 512 512
ReadX 6524 21899 512 512
ReadX 6524 22411 512 512
ReadX 6524 22923 512 512
ReadX 6524 23435 512 512
ReadX 6524 23947 512 512
ReadX 6524 24459 512 512
ReadX 6524 24971 282 282
ReadX 6524 3434 512 512
ReadX 6524 2818 512 512
ReadX 6524 2870 512 512
ReadX 6524 3026 512 512
ReadX 6524 3538 512 512
ReadX 6524 2870 512 512
ReadX 6524 3382 512 512
ReadX 6524 3894 512 512
ReadX 6524 4406 512 512
ReadX 6524 4918 512 512
ReadX 6524 5430 512 512
ReadX 6524 5942 512 512
ReadX 6524 6454 374 374
ReadX 6524 2856 138 138
ReadX 6524 2994 512 512
ReadX 6524 3506 512 512
ReadX 6524 4018 512 512
ReadX 6524 4530 512 512
ReadX 6524 5042 512 512
ReadX 6524 5554 512 512
ReadX 6524 6066 374 374
ReadX 6524 2886 138 138
ReadX 6524 3024 512 512
ReadX 6524 3536 512 512
ReadX 6524 4048 512 512
ReadX 6524 4560 512 512
ReadX 6524 5072 512 512
ReadX 6524 5584 512 512
ReadX 6524 6096 512 512
ReadX 6524 6608 512 512
ReadX 6524 7120 512 512
ReadX 6524 7632 512 512
ReadX 6524 8144 512 512
ReadX 6524 8656 512 512
ReadX 6524 9168 512 512
ReadX 6524 9680 512 512
ReadX 6524 10192 512 512
ReadX 6524 10704 512 512
ReadX 6524 11216 512 512
ReadX 6524 11728 512 512
ReadX 6524 12240 512 512
ReadX 6524 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 6524 13264 512 512
ReadX 6524 13776 512 512
ReadX 6524 14288 512 512
ReadX 6524 14800 512 512
ReadX 6524 15312 512 512
ReadX 6524 15824 512 512
ReadX 6524 16336 512 512
ReadX 6524 16848 512 512
ReadX 6524 17360 512 512
ReadX 6524 17872 512 512
ReadX 6524 18384 512 512
ReadX 6524 18896 512 512
ReadX 6524 19408 512 512
ReadX 6524 19920 512 512
ReadX 6524 20432 512 512
ReadX 6524 20944 512 512
ReadX 6524 21456 512 512
ReadX 6524 21968 512 512
ReadX 6524 22480 512 512
ReadX 6524 22992 512 512
ReadX 6524 2998 512 512
ReadX 6524 3510 512 512
ReadX 6524 3001 512 512
ReadX 6524 3003 512 512
ReadX 6524 3515 512 512
ReadX 6524 4027 512 512
ReadX 6524 4539 512 512
ReadX 6524 5051 512 512
ReadX 6524 5563 512 512
ReadX 6524 6075 512 512
ReadX 6524 6587 512 512
ReadX 6524 7099 512 512
ReadX 6524 7611 512 512
ReadX 6524 8123 512 512
ReadX 6524 8635 512 512
ReadX 6524 3029 512 512
ReadX 6524 3541 512 512
ReadX 6524 4053 512 512
ReadX 6524 4565 512 512
ReadX 6524 5077 512 512
ReadX 6524 5589 512 512
ReadX 6524 6101 512 512
ReadX 6524 6613 512 512
ReadX 6524 7125 512 512
ReadX 6524 7637 512 512
ReadX 6524 8149 512 512
ReadX 6524 8661 512 512
ReadX 6524 9173 512 512
ReadX 6524 9685 512 512
ReadX 6524 10197 512 512
ReadX 6524 10709 512 512
ReadX 6524 11221 512 512
ReadX 6524 11733 512 512
ReadX 6524 12245 512 512
ReadX 6524 12757 512 512
ReadX 6524 13269 40 40
ReadX 6524 3076 472 472
ReadX 6524 3548 512 512
ReadX 6524 4060 512 512
ReadX 6524 4572 512 512
ReadX 6524 5084 512 512
ReadX 6524 5596 512 512
ReadX 6524 6108 512 512
ReadX 6524 6620 512 512
ReadX 6524 7132 512 512
ReadX 6524 7644 512 512
ReadX 6524 8156 512 512
ReadX 6524 8668 512 512
ReadX 6524 9180 512 512
ReadX 6524 9692 512 512
ReadX 6524 10204 512 512
ReadX 6524 10716 512 512
ReadX 6524 11228 512 512
ReadX 6524 11740 512 512
ReadX 6524 12252 512 512
ReadX 6524 12764 512 512
ReadX 6524 13276 310 310
ReadX 6524 3001 512 512
ReadX 6524 2562 512 512
ReadX 6524 2626 512 512
ReadX 6524 3003 512 512
ReadX 6524 2721 512 512
ReadX 6524 2626 512 512
ReadX 6524 3138 512 512
ReadX 6524 3650 512 512
ReadX 6524 4162 512 512
ReadX 6524 4674 512 512
ReadX 6524 5186 512 512
ReadX 6524 5698 512 512
ReadX 6524 6210 424 424
ReadX 6524 2612 88 88
ReadX 6524 2700 512 512
ReadX 6524 3212 512 512
ReadX 6524 3724 512 512
ReadX 6524 4236 512 512
ReadX 6524 4748 512 512
ReadX 6524 5260 512 512
ReadX 6524 5772 424 424
ReadX 6524 2642 88 88
ReadX 6524 2730 512 512
ReadX 6524 3242 512 512
ReadX 6524 3754 512 512
ReadX 6524 4266 512 512
ReadX 6524 4778 512 512
ReadX 6524 5290 512 512
ReadX 6524 5802 512 512
ReadX 6524 6314 512 512
ReadX 6524 6826 512 512
ReadX 6524 7338 512 512
ReadX 6524 7850 512 512
ReadX 6524 8362 512 512
ReadX 6524 8874 512 512
ReadX 6524 9386 512 512
ReadX 6524 9898 512 512
ReadX 6524 10410 512 512
ReadX 6524 10922 512 512
ReadX 6524 11434 512 512
ReadX 6524 11946 512 512
ReadX 6524 12458 512 512
ReadX 6524 2716 512 512
ReadX 6524 2717 512 512
ReadX 6524 2718 512 512
ReadX 6524 3230 512 512
ReadX 6524 2721 512 512
ReadX 6524 3233 512 512
ReadX 6524 3745 512 512
ReadX 6524 4257 512 512
ReadX 6524 4769 512 512
ReadX 6524 5281 512 512
ReadX 6524 5793 512 512
ReadX 6524 6305 512 512
ReadX 6524 6817 512 512
ReadX 6524 7329 512 512
ReadX 6524 7841 512 512
ReadX 6524 8353 512 512
ReadX 6524 8865 512 512
ReadX 6524 9377 512 512
ReadX 6524 9889 512 512
ReadX 6524 10401 512 512
ReadX 6524 10913 512 512
ReadX 6524 11425 512 512
ReadX 6524 11937 512 512
ReadX 6524 12449 512 512
ReadX 6524 12961 512 512
ReadX 6524 13473 512 512
ReadX 6524 13985 106 106
ReadX 6524 2820 406 406
ReadX 6524 3226 512 512
ReadX 6524 3738 512 512
ReadX 6524 4250 512 512
ReadX 6524 4762 512 512
ReadX 6524 5274 512 512
ReadX 6524 5786 512 512
ReadX 6524 6298 512 512
ReadX 6524 6810 512 512
ReadX 6524 7322 512 512
ReadX 6524 7834 512 512
ReadX 6524 8346 512 512
ReadX 6524 8858 512 512
ReadX 6524 9370 512 512
ReadX 6524 9882 512 512
ReadX 6524 10394 512 512
ReadX 6524 10906 512 512
ReadX 6524 11418 182 182
ReadX 6524 2717 512 512
ReadX 6524 258 512 512
ReadX 6524 470 512 512
ReadX 6524 376 512 512
ReadX 6524 888 512 512
ReadX 6524 1400 512 512
ReadX 6524 1912 512 512
ReadX 6524 2424 512 512
ReadX 6524 2936 512 512
ReadX 6524 3448 512 512
ReadX 6524 3960 424 424
ReadX 6524 362 88 88
ReadX 6524 450 512 512
ReadX 6524 962 512 512
ReadX 6524 1474 512 512
ReadX 6524 1986 512 512
ReadX 6524 2498 512 512
ReadX 6524 3010 512 512
ReadX 6524 3522 424 424
ReadX 6524 392 88 88
ReadX 6524 480 512 512
ReadX 6524 992 512 512
ReadX 6524 1504 512 512
ReadX 6524 2016 512 512
ReadX 6524 2528 512 512
ReadX 6524 3040 512 512
ReadX 6524 3552 512 512
ReadX 6524 4064 512 512
ReadX 6524 4576 512 512
ReadX 6524 5088 512 512
ReadX 6524 5600 512 512
ReadX 6524 6112 512 512
ReadX 6524 6624 512 512
ReadX 6524 7136 512 512
ReadX 6524 7648 512 512
ReadX 6524 8160 512 512
ReadX 6524 8672 512 512
ReadX 6524 9184 512 512
ReadX 6524 9696 512 512
ReadX 6524 10208 512 512
ReadX 6524 464 512 512
ReadX 6524 465 512 512
ReadX 6524 466 512 512
ReadX 6524 978 512 512
ReadX 6524 470 512 512
ReadX 6524 982 512 512
ReadX 6524 1494 512 512
ReadX 6524 2006 512 512
ReadX 6524 2518 512 512
ReadX 6524 3030 512 512
ReadX 6524 3542 512 512
ReadX 6524 4054 512 512
ReadX 6524 4566 512 512
ReadX 6524 5078 512 512
ReadX 6524 5590 512 512
ReadX 6524 6102 512 512
ReadX 6524 6614 512 512
ReadX 6524 7126 512 512
ReadX 6524 7638 512 512
ReadX 6524 8150 512 512
ReadX 6524 8662 512 512
ReadX 6524 9174 512 512
ReadX 6524 9686 512 512
ReadX 6524 10198 512 512
ReadX 6524 10710 333 333
ReadX 6524 11043 512 512
ReadX 6524 11555 179 179
ReadX 6524 11734 512 512
ReadX 6524 12246 512 512
ReadX 6524 12758 512 512
ReadX 6524 13270 512 512
ReadX 6524 13782 512 512
ReadX 6524 14294 512 512
ReadX 6524 14806 512 512
ReadX 6524 15318 512 512
ReadX 6524 15830 512 512
ReadX 6524 16342 512 512
ReadX 6524 16854 512 512
ReadX 6524 17366 512 512
ReadX 6524 17878 512 512
ReadX 6524 18390 512 512
ReadX 6524 18902 512 512
ReadX 6524 19414 512 512
ReadX 6524 19926 512 512
ReadX 6524 20438 512 512
ReadX 6524 20950 512 512
ReadX 6524 21462 512 512
ReadX 6524 21974 350 350
ReadX 6524 465 512 512
ReadX 6524 3812 512 512
ReadX 6524 4046 512 512
ReadX 6524 3828 512 512
ReadX 6524 256 512 512
ReadX 6524 260 512 512
ReadX 6524 4066 512 512
ReadX 6524 4578 512 512
ReadX 6524 5090 512 512
ReadX 6524 5602 512 512
ReadX 6524 6114 512 512
ReadX 6524 6626 512 512
ReadX 6524 7138 512 512
ReadX 6524 7650 394 394
ReadX 6524 4052 118 118
ReadX 6524 4170 512 512
ReadX 6524 4682 512 512
ReadX 6524 5194 512 512
ReadX 6524 5706 512 512
ReadX 6524 6218 512 512
ReadX 6524 6730 512 512
ReadX 6524 7242 394 394
ReadX 6524 4082 118 118
ReadX 6524 4200 512 512
ReadX 6524 4712 512 512
ReadX 6524 5224 512 512
ReadX 6524 5736 512 512
ReadX 6524 6248 512 512
ReadX 6524 6760 512 512
ReadX 6524 7272 512 512
ReadX 6524 7784 394 394
ReadX 6524 256 118 118
ReadX 6524 374 512 512
ReadX 6524 886 512 512
ReadX 6524 1398 512 512
ReadX 6524 1910 512 512
ReadX 6524 2422 512 512
ReadX 6524 2934 512 512
ReadX 6524 3446 512 512
ReadX 6524 3958 512 512
ReadX 6524 4470 512 512
ReadX 6524 4982 512 512
ReadX 6524 5494 512 512
ReadX 6524 6006 512 512
ReadX 6524 6518 512 512
ReadX 6524 7030 512 512
ReadX 6524 7542 512 512
ReadX 6524 8054 512 512
ReadX 6524 8566 512 512
ReadX 6524 9078 512 512
ReadX 6524 9590 512 512
ReadX 6524 10102 512 512
ReadX 6524 259 512 512
ReadX 6524 771 512 512
ReadX 6524 259 512 512
ReadX 6524 259 512 512
ReadX 6524 771 512 512
ReadX 6524 1283 512 512
ReadX 6524 1795 512 512
ReadX 6524 2307 512 512
ReadX 6524 2819 512 512
ReadX 6524 3331 512 512
ReadX 6524 3843 512 512
ReadX 6524 4355 512 512
ReadX 6524 4867 512 512
ReadX 6524 260 512 512
ReadX 6524 772 512 512
ReadX 6524 1284 512 512
ReadX 6524 1796 512 512
ReadX 6524 2308 512 512
ReadX 6524 2820 512 512
ReadX 6524 3332 512 512
ReadX 6524 3844 512 512
ReadX 6524 4356 512 512
ReadX 6524 4868 512 512
ReadX 6524 5380 512 512
ReadX 6524 5892 512 512
ReadX 6524 6404 512 512
ReadX 6524 6916 512 512
ReadX 6524 7428 512 512
ReadX 6524 7940 512 512
ReadX 6524 8452 512 512
ReadX 6524 8964 512 512
ReadX 6524 9476 512 512
ReadX 6524 9988 512 512
ReadX 6524 10500 378 378
ReadX 6524 10878 512 512
ReadX 6524 11390 134 134
ReadX 6524 11524 512 512
ReadX 6524 12036 512 512
ReadX 6524 12548 512 512
ReadX 6524 13060 512 512
ReadX 6524 13572 138 138
ReadX 6524 259 512 512
ReadX 6524 273 512 512
ReadX 6524 276 512 512
ReadX 6524 295 512 512
ReadX 6524 288 512 512
ReadX 6524 296 512 512
ReadX 6524 259 512 512
ReadX 6524 273 512 512
ReadX 6524 273 512 512
ReadX 6524 785 512 512
ReadX 6524 1297 512 512
ReadX 6524 1809 512 512
ReadX 6524 2321 512 512
ReadX 6524 274 512 512
ReadX 6524 274 512 512
ReadX 6524 274 497 497
ReadX 6524 272 15 15
ReadX 6524 287 512 512
ReadX 6524 799 512 512
ReadX 6524 273 512 512
ReadX 6524 785 512 512
ReadX 6524 1297 512 512
ReadX 6524 1809 512 512
ReadX 6524 2321 512 512
ReadX 6524 2833 317 317
ReadX 6524 274 195 195
ReadX 6524 469 512 512
ReadX 6524 981 512 512
ReadX 6524 1493 512 512
ReadX 6524 2005 512 512
ReadX 6524 2517 512 512
ReadX 6524 3029 512 512
ReadX 6524 3541 512 512
ReadX 6524 4053 512 512
ReadX 6524 4565 250 250
ReadX 6524 274 512 512
ReadX 6524 283 512 512
ReadX 6524 795 512 512
ReadX 6524 276 512 512
ReadX 6524 788 512 512
ReadX 6524 1300 512 512
ReadX 6524 1812 512 512
ReadX 6524 2324 512 512
ReadX 6524 2836 512 512
ReadX 6524 3348 512 512
ReadX 6524 3860 420 420
ReadX 6524 275 92 92
ReadX 6524 367 512 512
ReadX 6524 879 512 512
ReadX 6524 1391 512 512
ReadX 6524 1903 512 512
ReadX 6524 2415 512 512
ReadX 6524 2927 512 512
ReadX 6524 3439 420 420
ReadX 6524 277 92 92
ReadX 6524 369 512 512
ReadX 6524 881 512 512
ReadX 6524 1393 512 512
ReadX 6524 1905 512 512
ReadX 6524 2417 512 512
ReadX 6524 2929 512 512
ReadX 6524 3441 512 512
ReadX 6524 3953 512 512
ReadX 6524 4465 512 512
ReadX 6524 4977 512 512
ReadX 6524 5489 512 512
ReadX 6524 6001 512 512
ReadX 6524 6513 512 512
ReadX 6524 7025 512 512
ReadX 6524 7537 512 512
ReadX 6524 8049 512 512
ReadX 6524 8561 512 512
ReadX 6524 9073 512 512
ReadX 6524 9585 512 512
ReadX 6524 10097 512 512
ReadX 6524 282 512 512
ReadX 6524 794 512 512
ReadX 6524 1306 512 512
ReadX 6524 1818 512 512
ReadX 6524 2330 512 512
ReadX 6524 2842 512 512
ReadX 6524 3354 512 512
ReadX 6524 3866 512 512
ReadX 6524 4378 512 512
ReadX 6524 284 512 512
ReadX 6524 796 512 512
ReadX 6524 1308 512 512
ReadX 6524 1820 512 512
ReadX 6524 2332 512 512
ReadX 6524 2844 512 512
ReadX 6524 3356 512 512
ReadX 6524 3868 512 512
ReadX 6524 4380 512 512
ReadX 6524 4892 512 512
ReadX 6524 5404 512 512
ReadX 6524 5916 512 512
ReadX 6524 6428 512 512
ReadX 6524 6940 512 512
ReadX 6524 7452 512 512
ReadX 6524 7964 512 512
ReadX 6524 8476 512 512
ReadX 6524 8988 512 512
ReadX 6524 9500 512 512
ReadX 6524 10012 512 512
ReadX 6524 10524 472 472
ReadX 6524 288 40 40
ReadX 6524 328 512 512
ReadX 6524 840 512 512
ReadX 6524 1352 512 512
ReadX 6524 1864 512 512
ReadX 6524 2376 512 512
ReadX 6524 2888 512 512
ReadX 6524 3400 512 512
ReadX 6524 3912 512 512
ReadX 6524 4424 512 512
ReadX 6524 4936 512 512
ReadX 6524 5448 512 512
ReadX 6524 5960 512 512
ReadX 6524 6472 512 512
ReadX 6524 6984 512 512
ReadX 6524 7496 512 512
ReadX 6524 8008 512 512
ReadX 6524 8520 512 512
ReadX 6524 9032 512 512
ReadX 6524 9544 512 512
ReadX 6524 10056 512 512
ReadX 6524 10568 506 506
ReadX 6524 282 512 512
ReadX 6524 794 512 512
ReadX 6524 301 512 512
ReadX 6524 296 512 512
ReadX 6524 808 512 512
ReadX 6524 1320 512 512
ReadX 6524 1832 512 512
ReadX 6524 2344 512 512
ReadX 6524 2856 512 512
ReadX 6524 3368 512 512
ReadX 6524 3880 424 424
ReadX 6524 295 88 88
ReadX 6524 383 512 512
ReadX 6524 895 512 512
ReadX 6524 1407 512 512
ReadX 6524 1919 512 512
ReadX 6524 2431 512 512
ReadX 6524 2943 512 512
ReadX 6524 3455 424 424
ReadX 6524 297 88 88
ReadX 6524 385 512 512
ReadX 6524 897 512 512
ReadX 6524 1409 512 512
ReadX 6524 1921 512 512
ReadX 6524 2433 512 512
ReadX 6524 2945 512 512
ReadX 6524 3457 512 512
ReadX 6524 3969 512 512
ReadX 6524 4481 512 512
ReadX 6524 4993 512 512
ReadX 6524 5505 512 512
ReadX 6524 6017 512 512
ReadX 6524 6529 512 512
ReadX 6524 7041 512 512
ReadX 6524 7553 512 512
ReadX 6524 8065 512 512
ReadX 6524 8577 512 512
ReadX 6524 9089 512 512
ReadX 6524 9601 512 512
ReadX 6524 10113 512 512
ReadX 6524 301 512 512
ReadX 6524 301 512 512
ReadX 6524 301 512 512
ReadX 6524 813 512 512
ReadX 6524 301 512 512
ReadX 6524 813 512 512
ReadX 6524 1325 512 512
ReadX 6524 1837 512 512
ReadX 6524 2349 512 512
ReadX 6524 2861 512 512
ReadX 6524 3373 512 512
ReadX 6524 3885 512 512
ReadX 6524 4397 512 512
ReadX 6524 4909 512 512
ReadX 6524 5421 512 512
ReadX 6524 5933 512 512
ReadX 6524 6445 512 512
ReadX 6524 6957 512 512
ReadX 6524 7469 512 512
ReadX 6524 7981 512 512
ReadX 6524 8493 512 512
ReadX 6524 9005 512 512
ReadX 6524 9517 463 463
ReadX 6524 9980 512 512
ReadX 6524 10492 49 49
ReadX 6524 10541 512 512
ReadX 6524 11053 512 512
ReadX 6524 11565 512 512
ReadX 6524 12077 512 512
ReadX 6524 12589 512 512
ReadX 6524 13101 512 512
ReadX 6524 13613 512 512
ReadX 6524 14125 512 512
ReadX 6524 14637 512 512
ReadX 6524 15149 512 512
ReadX 6524 15661 512 512
ReadX 6524 16173 512 512
ReadX 6524 16685 512 512
ReadX 6524 17197 512 512
ReadX 6524 17709 512 512
ReadX 6524 18221 512 512
ReadX 6524 18733 512 512
ReadX 6524 19245 512 512
ReadX 6524 19757 512 512
ReadX 6524 20269 512 512
ReadX 6524 20781 326 326
ReadX 6524 301 512 512
QUERY_FS_INFORMATION 259
Close 6522
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6525
Close 6525
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6526
ReadX 6526 0 24 24
Close 6526
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6527
QUERY_FILE_INFORMATION 6527
ReadX 6527 0 512 512
ReadX 6527 476 512 512
ReadX 6527 510 512 512
ReadX 6527 484 512 512
ReadX 6527 474 512 512
ReadX 6527 478 512 512
ReadX 6527 990 512 512
ReadX 6527 509 57 57
Close 6527
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6528
QUERY_FILE_INFORMATION 6528
ReadX 6528 0 512 512
ReadX 6528 476 512 512
ReadX 6528 510 512 512
ReadX 6528 484 512 512
ReadX 6528 480 512 512
ReadX 6528 474 512 512
ReadX 6528 478 512 512
QUERY_FILE_INFORMATION 6528
WriteX 6528 494 60 60
WriteX 6528 494 4 4
QUERY_FILE_INFORMATION 6528
WriteX 6528 494 11 11
WriteX 6528 510 512 512
WriteX 6528 484 512 512
WriteX 6528 474 512 512
WriteX 6528 478 512 512
WriteX 6528 990 512 512
Close 6528
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 6529
Close 6529
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 6530
Close 6530
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 6532
WriteX 6532 4607 1 1
QUERY_FILE_INFORMATION 6532
WriteX 6532 0 65471 65471
WriteX 6532 65471 65 65
WriteX 6532 65536 19490 19490
Close 6532
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6533
QUERY_FILE_INFORMATION 6533
ReadX 6533 0 512 512
ReadX 6533 482 512 512
ReadX 6533 994 512 512
ReadX 6533 1506 512 512
ReadX 6533 480 512 512
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 490 448 448
QUERY_FILE_INFORMATION 6533
WriteX 6533 490 60 60
WriteX 6533 490 4 4
QUERY_FILE_INFORMATION 6533
WriteX 6533 490 11 11
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 484 512 512
WriteX 6533 996 512 512
WriteX 6533 1508 512 512
WriteX 6533 482 512 512
WriteX 6533 0 512 512
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
ReadX 6533 490 512 512
WriteX 6533 502 512 512
WriteX 6533 502 292 292
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 503 20 20
WriteX 6533 503 108 108
QUERY_FILE_INFORMATION 6533
WriteX 6533 504 448 448
QUERY_FILE_INFORMATION 6533
WriteX 6533 504 44 44
WriteX 6533 504 20 20
WriteX 6533 500 512 512
WriteX 6533 492 512 512
WriteX 6533 496 512 512
WriteX 6533 1008 512 512
WriteX 6533 494 512 512
Flush 6533
WriteX 6533 0 512 512
Flush 6533
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 500 512 512
WriteX 6533 492 512 512
WriteX 6533 496 512 512
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 518 320 320
QUERY_FILE_INFORMATION 6533
WriteX 6533 518 60 60
ReadX 6533 504 512 512
WriteX 6533 522 512 512
WriteX 6533 506 3204 3204
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 519 25 25
WriteX 6533 518 103 103
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 519 44 44
WriteX 6533 519 20 20
WriteX 6533 520 512 512
WriteX 6533 482 512 512
WriteX 6533 486 512 512
WriteX 6533 998 512 512
WriteX 6533 484 512 512
WriteX 6533 490 512 512
Flush 6533
WriteX 6533 0 512 512
Flush 6533
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
QUERY_FILE_INFORMATION 6533
WriteX 6533 519 7 7
WriteX 6533 519 57 57
WriteX 6533 520 512 512
WriteX 6533 492 512 512
WriteX 6533 482 512 512
WriteX 6533 486 512 512
WriteX 6533 998 512 512
Flush 6533
WriteX 6533 520 512 512
Flush 6533
Close 6533
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6534
Close 6534
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 6535
QUERY_FILE_INFORMATION 6535
ReadX 6535 0 512 512
ReadX 6535 490 512 512
ReadX 6535 484 512 512
ReadX 6535 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 6536
Close 6536
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 6535
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6537
Close 6537
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6538
ReadX 6538 0 24 24
Close 6538
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6539
QUERY_FILE_INFORMATION 6539
ReadX 6539 0 512 512
ReadX 6539 366 512 512
ReadX 6539 878 512 512
ReadX 6539 1390 512 512
ReadX 6539 1902 512 512
ReadX 6539 374 57 57
Close 6539
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6540
QUERY_FILE_INFORMATION 6540
ReadX 6540 0 512 512
ReadX 6540 366 512 512
ReadX 6540 878 512 512
ReadX 6540 1390 512 512
ReadX 6540 1902 512 512
QUERY_FILE_INFORMATION 6540
WriteX 6540 374 60 60
WriteX 6540 374 4 4
QUERY_FILE_INFORMATION 6540
WriteX 6540 374 11 11
ReadX 6540 374 57 57
ReadX 6540 374 57 57
ReadX 6540 292 4096 4096
ReadX 6540 364 512 512
ReadX 6540 512 4096 4096
ReadX 6540 4608 4096 4096
ReadX 6540 8704 4096 4096
ReadX 6540 12800 4096 4096
ReadX 6540 16896 4096 4096
ReadX 6540 20992 4096 4096
ReadX 6540 25088 4096 4096
ReadX 6540 29184 4096 4096
ReadX 6540 33280 4096 4096
ReadX 6540 37376 4096 4096
ReadX 6540 41472 4096 4096
ReadX 6540 45568 4096 4096
ReadX 6540 49664 4096 4096
ReadX 6540 53760 4096 4096
ReadX 6540 57856 4096 4096
ReadX 6540 61952 4096 4096
ReadX 6540 66048 4096 4096
ReadX 6540 70144 4096 4096
ReadX 6540 74240 162 162
ReadX 6540 308 4096 4096
ReadX 6540 4404 4096 4096
WriteX 6540 368 512 512
WriteX 6540 880 512 512
WriteX 6540 1392 512 512
Close 6540
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6541
Close 6541
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6542
QUERY_FILE_INFORMATION 6542
ReadX 6542 0 512 512
ReadX 6542 366 512 512
ReadX 6542 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 6543
Close 6543
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 6542
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 6545
WriteX 6545 4607 1 1
QUERY_FILE_INFORMATION 6545
WriteX 6545 0 65471 65471
WriteX 6545 65471 65 65
WriteX 6545 65536 8866 8866
Close 6545
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6546
QUERY_FILE_INFORMATION 6546
ReadX 6546 0 512 512
ReadX 6546 366 512 512
ReadX 6546 878 512 512
ReadX 6546 1390 512 512
ReadX 6546 364 512 512
QUERY_FILE_INFORMATION 6546
QUERY_FILE_INFORMATION 6546
QUERY_FILE_INFORMATION 6546
WriteX 6546 374 448 448
QUERY_FILE_INFORMATION 6546
WriteX 6546 374 60 60
WriteX 6546 374 4 4
QUERY_FILE_INFORMATION 6546
WriteX 6546 374 11 11
QUERY_FILE_INFORMATION 6546
QUERY_FILE_INFORMATION 6546
WriteX 6546 374 7 7
WriteX 6546 374 57 57
WriteX 6546 368 512 512
WriteX 6546 880 512 512
WriteX 6546 1392 512 512
WriteX 6546 366 512 512
WriteX 6546 0 512 512
Flush 6546
WriteX 6546 368 512 512
Flush 6546
Close 6546
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6547
QUERY_FILE_INFORMATION 6547
ReadX 6547 0 512 512
ReadX 6547 366 512 512
ReadX 6547 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 6547
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6548
Close 6548
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6549
ReadX 6549 0 24 24
Close 6549
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6550
QUERY_FILE_INFORMATION 6550
ReadX 6550 0 512 512
ReadX 6550 366 512 512
ReadX 6550 878 512 512
ReadX 6550 1390 512 512
ReadX 6550 1902 512 512
ReadX 6550 374 57 57
Close 6550
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6551
QUERY_FILE_INFORMATION 6551
ReadX 6551 0 512 512
ReadX 6551 366 512 512
ReadX 6551 878 512 512
ReadX 6551 1390 512 512
ReadX 6551 1902 512 512
QUERY_FILE_INFORMATION 6551
WriteX 6551 374 60 60
WriteX 6551 374 4 4
QUERY_FILE_INFORMATION 6551
WriteX 6551 374 11 11
WriteX 6551 368 512 512
WriteX 6551 880 512 512
WriteX 6551 1392 512 512
Close 6551
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 6552
Close 6552
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 6553
Close 6553
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 6555
WriteX 6555 4607 1 1
QUERY_FILE_INFORMATION 6555
WriteX 6555 0 65471 65471
WriteX 6555 65471 65 65
WriteX 6555 65536 9298 9298
Close 6555
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6556
QUERY_FILE_INFORMATION 6556
ReadX 6556 0 512 512
ReadX 6556 368 512 512
ReadX 6556 880 512 512
ReadX 6556 1392 512 512
ReadX 6556 366 512 512
QUERY_FILE_INFORMATION 6556
QUERY_FILE_INFORMATION 6556
QUERY_FILE_INFORMATION 6556
WriteX 6556 376 448 448
QUERY_FILE_INFORMATION 6556
WriteX 6556 376 60 60
WriteX 6556 376 4 4
QUERY_FILE_INFORMATION 6556
WriteX 6556 376 11 11
QUERY_FILE_INFORMATION 6556
QUERY_FILE_INFORMATION 6556
WriteX 6556 376 7 7
WriteX 6556 376 57 57
WriteX 6556 370 512 512
WriteX 6556 882 512 512
WriteX 6556 1394 512 512
WriteX 6556 368 512 512
WriteX 6556 0 512 512
Flush 6556
WriteX 6556 370 512 512
Flush 6556
Close 6556
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6557
Close 6557
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6558
QUERY_FILE_INFORMATION 6558
ReadX 6558 0 512 512
ReadX 6558 368 512 512
ReadX 6558 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 6559
Close 6559
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 6561
Close 6561
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 6562
ReadX 6562 0 24 24
Close 6562
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 6563
QUERY_FILE_INFORMATION 6563
ReadX 6563 0 512 512
ReadX 6563 512 512 512
ReadX 6563 1024 512 512
ReadX 6563 2016 512 512
ReadX 6563 1056 512 512
ReadX 6563 1096 57 57
Close 6563
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 6564
QUERY_FILE_INFORMATION 6564
ReadX 6564 0 512 512
ReadX 6564 512 512 512
ReadX 6564 1024 512 512
ReadX 6564 2016 512 512
ReadX 6564 1056 512 512
ReadX 6564 1096 57 57
ReadX 6564 1096 57 57
ReadX 6564 1088 62 62
ReadX 6564 1536 4096 4096
ReadX 6564 5632 4096 4096
ReadX 6564 9728 4096 4096
ReadX 6564 13824 2859 2859
ReadX 6564 1120 28 28
ReadX 6564 1148 20 20
ReadX 6564 1168 8 8
ReadX 6564 1176 88 88
ReadX 6564 1264 8 8
ReadX 6564 1272 4 4
ReadX 6564 1276 4 4
ReadX 6564 1280 1 1
ReadX 6564 1130 4 4
ReadX 6564 1134 4 4
ReadX 6564 1138 1 1
ReadX 6564 1131 4 4
ReadX 6564 1135 4 4
ReadX 6564 1139 1 1
ReadX 6564 1131 4 4
ReadX 6564 1135 4 4
ReadX 6564 1139 2 2
ReadX 6564 1132 4 4
ReadX 6564 1136 4 4
ReadX 6564 1140 25 25
ReadX 6564 1134 4 4
ReadX 6564 1138 8 8
ReadX 6564 1146 4 4
ReadX 6564 1150 8 8
ReadX 6564 1158 4 4
ReadX 6564 1162 8 8
ReadX 6564 1170 4 4
ReadX 6564 1174 4 4
ReadX 6564 1178 4 4
ReadX 6564 1182 4 4
ReadX 6564 1186 4 4
ReadX 6564 1190 4 4
ReadX 6564 1194 13900 13900
ReadX 6564 2048 4096 4096
Close 6564
QUERY_FS_INFORMATION 259
Close 6558
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6565
Close 6565
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6566
ReadX 6566 0 24 24
Close 6566
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6567
QUERY_FILE_INFORMATION 6567
ReadX 6567 0 512 512
ReadX 6567 368 512 512
ReadX 6567 880 512 512
ReadX 6567 1392 512 512
ReadX 6567 1904 512 512
ReadX 6567 376 57 57
Close 6567
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6568
QUERY_FILE_INFORMATION 6568
ReadX 6568 0 512 512
ReadX 6568 368 512 512
ReadX 6568 880 512 512
ReadX 6568 1392 512 512
ReadX 6568 1904 512 512
QUERY_FILE_INFORMATION 6568
WriteX 6568 376 60 60
WriteX 6568 376 4 4
QUERY_FILE_INFORMATION 6568
WriteX 6568 376 11 11
WriteX 6568 370 512 512
WriteX 6568 882 512 512
WriteX 6568 1394 512 512
Close 6568
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 6569
Close 6569
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 6570
Close 6570
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 6572
WriteX 6572 4607 1 1
QUERY_FILE_INFORMATION 6572
WriteX 6572 0 65471 65471
WriteX 6572 65471 65 65
WriteX 6572 65536 11540 11540
Close 6572
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6573
QUERY_FILE_INFORMATION 6573
ReadX 6573 0 512 512
ReadX 6573 398 512 512
ReadX 6573 910 512 512
ReadX 6573 1422 512 512
ReadX 6573 396 512 512
QUERY_FILE_INFORMATION 6573
QUERY_FILE_INFORMATION 6573
QUERY_FILE_INFORMATION 6573
WriteX 6573 406 448 448
QUERY_FILE_INFORMATION 6573
WriteX 6573 406 60 60
WriteX 6573 406 4 4
QUERY_FILE_INFORMATION 6573
WriteX 6573 406 11 11
QUERY_FILE_INFORMATION 6573
QUERY_FILE_INFORMATION 6573
WriteX 6573 406 7 7
WriteX 6573 406 57 57
WriteX 6573 400 512 512
WriteX 6573 912 512 512
WriteX 6573 1424 512 512
WriteX 6573 398 512 512
WriteX 6573 0 512 512
Flush 6573
WriteX 6573 400 512 512
Flush 6573
Close 6573
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6574
Close 6574
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 6575
QUERY_FILE_INFORMATION 6575
ReadX 6575 0 512 512
ReadX 6575 398 512 512
ReadX 6575 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 6576
Close 6576
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 6575
ReadX 6524 1434 512 512
Close 6524
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 6577
WriteX 6577 0 65471 65471
WriteX 6577 65471 63 63
WriteX 6577 65534 65471 65471
WriteX 6577 131005 63 63
Close 6577
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 6578
WriteX 6578 0 65471 65471
WriteX 6578 65471 63 63
WriteX 6578 65534 65471 65471
WriteX 6578 131005 63 63
WriteX 6578 131068 65471 65471
WriteX 6578 196539 63 63
WriteX 6578 196602 65471 65471
WriteX 6578 262073 63 63
Close 6578
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 6579
WriteX 6579 0 65471 65471
WriteX 6579 65471 63 63
WriteX 6579 65534 65471 65471
WriteX 6579 131005 63 63
WriteX 6579 131068 65471 65471
WriteX 6579 196539 63 63
WriteX 6579 196602 65471 65471
WriteX 6579 262073 63 63
WriteX 6579 262136 65471 65471
WriteX 6579 327607 63 63
WriteX 6579 327670 65471 65471
WriteX 6579 393141 63 63
WriteX 6579 393204 65471 65471
WriteX 6579 458675 63 63
WriteX 6579 458738 65471 65471
WriteX 6579 524209 63 63
Close 6579
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6580
Close 6580
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 6581
ReadX 6581 0 512 512
ReadX 6581 512 511 511
ReadX 6581 1023 512 512
ReadX 6581 1535 512 512
Close 6581
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 6582
ReadX 6582 0 512 512
ReadX 6582 512 510 510
ReadX 6582 1022 512 512
ReadX 6582 1534 510 510
ReadX 6582 2044 510 510
Close 6582
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 6583
ReadX 6583 0 512 512
ReadX 6583 512 512 512
ReadX 6583 1024 512 512
ReadX 6583 1536 512 512
ReadX 6583 2048 512 512
ReadX 6583 2560 512 512
ReadX 6583 3072 512 512
ReadX 6583 3584 512 512
ReadX 6583 4096 512 512
ReadX 6583 4608 512 512
ReadX 6583 5120 512 512
ReadX 6583 5632 512 512
ReadX 6583 6144 512 512
ReadX 6583 6656 512 512
ReadX 6583 7168 512 512
ReadX 6583 7680 512 512
ReadX 6583 8192 512 512
ReadX 6583 8704 512 512
Close 6583
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6584
Close 6584
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 6585
QUERY_FILE_INFORMATION 6585
Close 6585
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 6586
ReadX 6586 0 8192 8192
Close 6586
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 6587
Close 6587
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 6588
QUERY_FILE_INFORMATION 6588
Close 6588
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 6589
ReadX 6589 0 8192 8192
Close 6589
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6590
Close 6590
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 6591
QUERY_FILE_INFORMATION 6591
Close 6591
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 6592
ReadX 6592 0 8192 8192
Close 6592
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 6593
ReadX 6593 0 8192 8192
ReadX 6593 8192 8192 8192
ReadX 6593 16384 8192 8192
ReadX 6593 24576 8192 8192
Close 6593
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 6595
Close 6595
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 6597
WriteX 6597 8191 1 1
QUERY_FILE_INFORMATION 6597
WriteX 6597 0 10438 10438
Close 6597
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 6598
Close 6598
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 6599
QUERY_FILE_INFORMATION 6599
QUERY_FILE_INFORMATION 6599
Close 6599
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 6600
QUERY_FILE_INFORMATION 6600
QUERY_FILE_INFORMATION 6600
Close 6600
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 6601
Close 6601
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 6602
QUERY_FILE_INFORMATION 6602
QUERY_FILE_INFORMATION 6602
Close 6602
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 6603
QUERY_FILE_INFORMATION 6603
QUERY_FILE_INFORMATION 6603
Close 6603
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 6604
Close 6604
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 6605
QUERY_FILE_INFORMATION 6605
QUERY_FILE_INFORMATION 6605
Close 6605
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 6606
QUERY_FILE_INFORMATION 6606
QUERY_FILE_INFORMATION 6606
Close 6606
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 6607
Close 6607
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 6608
QUERY_FILE_INFORMATION 6608
QUERY_FILE_INFORMATION 6608
Close 6608
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 6609
ReadX 6609 0 8 8
ReadX 6609 8 4 4
ReadX 6609 12 8 8
ReadX 6609 22 8 8
ReadX 6609 520 8 8
ReadX 6609 525 8 8
ReadX 6609 533 4 4
ReadX 6609 543 8 8
ReadX 6609 551 4 4
ReadX 6609 1058 8 8
ReadX 6609 1066 4 4
ReadX 6609 1081 8 8
ReadX 6609 1089 4 4
ReadX 6609 660 8 8
Close 6609
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 6610
ReadX 6610 0 8192 8192
Close 6610
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 6611
ReadX 6611 0 8192 8192
ReadX 6611 520 8192 8192
ReadX 6611 8712 8192 8192
ReadX 6611 16904 8192 8192
ReadX 6611 25096 8192 8192
ReadX 6611 33288 8192 8192
ReadX 6611 41480 8192 8192
ReadX 6611 49672 8192 8192
ReadX 6611 57864 8192 8192
ReadX 6611 66056 8192 8192
ReadX 6611 74248 8192 8192
ReadX 6611 82440 8192 8192
ReadX 6611 90632 8192 8192
ReadX 6611 98824 8192 8192
ReadX 6611 107016 8192 8192
ReadX 6611 115208 8192 8192
ReadX 6611 123400 8192 8192
ReadX 6611 131592 8192 8192
ReadX 6611 139784 8192 8192
ReadX 6611 147976 8192 8192
ReadX 6611 156168 8192 8192
Close 6611
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 6612
QUERY_FILE_INFORMATION 6612
Close 6612
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 6613
Close 6613
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 6615
WriteX 6615 8191 1 1
QUERY_FILE_INFORMATION 6615
WriteX 6615 0 28489 28489
Close 6615
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 6616
Close 6616
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 6617
Close 6617
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 6618
QUERY_FILE_INFORMATION 6618
Close 6618
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 6619
ReadX 6619 0 8192 8192
Close 6619
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6620
Close 6620
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 6621
QUERY_FILE_INFORMATION 6621
Close 6621
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 6622
ReadX 6622 0 8192 8192
Close 6622
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 6623
ReadX 6623 0 8192 8192
ReadX 6623 8192 8192 8192
ReadX 6623 16384 8192 8192
ReadX 6623 24576 8192 8192
ReadX 6623 32768 16384 16384
ReadX 6623 49152 8192 8192
ReadX 6623 57344 8192 8192
ReadX 6623 65536 8192 8192
Close 6623
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 6625
Close 6625
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 6627
WriteX 6627 8191 1 1
QUERY_FILE_INFORMATION 6627
WriteX 6627 0 29253 29253
Close 6627
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 6628
Close 6628
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 6629
QUERY_FILE_INFORMATION 6629
QUERY_FILE_INFORMATION 6629
Close 6629
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 6630
QUERY_FILE_INFORMATION 6630
QUERY_FILE_INFORMATION 6630
Close 6630
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 6631
QUERY_FILE_INFORMATION 6631
Close 6631
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 6632
Close 6632
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 6634
WriteX 6634 8191 1 1
QUERY_FILE_INFORMATION 6634
WriteX 6634 0 30183 30183
Close 6634
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 6635
Close 6635
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 6636
WriteX 6636 0 510 510
WriteX 6636 510 512 512
WriteX 6636 1022 510 510
WriteX 6636 1532 510 510
WriteX 6636 2042 168 168
Close 6636
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6637
Close 6637
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 6638
WriteX 6638 0 511 511
WriteX 6638 511 512 512
WriteX 6638 1023 512 512
WriteX 6638 1535 488 488
Close 6638
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 6639
ReadX 6639 0 65471 65471
ReadX 6639 65471 63 63
ReadX 6639 65534 65471 65471
ReadX 6639 131005 63 63
ReadX 6639 131068 65471 65471
ReadX 6639 196539 63 63
ReadX 6639 196602 65471 65471
ReadX 6639 262073 63 63
ReadX 6639 262136 65471 65471
ReadX 6639 327607 63 63
ReadX 6639 327670 10 10
Close 6639
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 6640
ReadX 6640 0 65471 65471
ReadX 6640 65471 63 63
ReadX 6640 65534 65471 65471
ReadX 6640 131005 63 63
ReadX 6640 131068 65471 65471
ReadX 6640 196539 63 63
ReadX 6640 196602 65471 65471
ReadX 6640 262073 63 63
ReadX 6640 262136 65471 65471
ReadX 6640 327607 63 63
ReadX 6640 327670 65471 65471
ReadX 6640 393141 63 63
ReadX 6640 393204 65471 65471
ReadX 6640 458675 63 63
ReadX 6640 458738 65471 65471
ReadX 6640 524209 63 63
ReadX 6640 524272 65471 65471
ReadX 6640 589743 63 63
ReadX 6640 589806 65471 65471
ReadX 6640 655277 63 63
ReadX 6640 655340 32 32
Close 6640
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 6641
ReadX 6641 0 65471 65471
ReadX 6641 65471 63 63
ReadX 6641 65534 65471 65471
ReadX 6641 131005 63 63
ReadX 6641 131068 65471 65471
ReadX 6641 196539 63 63
ReadX 6641 196602 65471 65471
ReadX 6641 262073 63 63
ReadX 6641 262136 65471 65471
ReadX 6641 327607 63 63
ReadX 6641 327670 65471 65471
ReadX 6641 393141 63 63
ReadX 6641 393204 65471 65471
ReadX 6641 458675 63 63
ReadX 6641 458738 65471 65471
ReadX 6641 524209 63 63
ReadX 6641 524272 65471 65471
ReadX 6641 589743 63 63
ReadX 6641 589806 65471 65471
ReadX 6641 655277 63 63
ReadX 6641 655340 65471 65471
ReadX 6641 720811 63 63
ReadX 6641 720874 65471 65471
ReadX 6641 786345 63 63
ReadX 6641 786408 65471 65471
ReadX 6641 851879 63 63
ReadX 6641 851942 65471 65471
ReadX 6641 917413 63 63
ReadX 6641 917476 65471 65471
ReadX 6641 982947 63 63
ReadX 6641 983010 65471 65471
ReadX 6641 1048481 63 63
ReadX 6641 1048544 65471 65471
ReadX 6641 1114015 63 63
ReadX 6641 1114078 65471 65471
ReadX 6641 1179549 63 63
ReadX 6641 1179612 65471 65471
ReadX 6641 1245083 63 63
ReadX 6641 1245146 65471 65471
ReadX 6641 1310617 63 63
ReadX 6641 1310680 65471 65471
ReadX 6641 1376151 63 63
ReadX 6641 1376214 65471 65471
ReadX 6641 1441685 63 63
ReadX 6641 1441748 65471 65471
ReadX 6641 1507219 63 63
ReadX 6641 1507282 65471 65471
ReadX 6641 1572753 63 63
ReadX 6641 1572816 65471 65471
ReadX 6641 1638287 63 63
ReadX 6641 1638350 65471 65471
ReadX 6641 1703821 63 63
ReadX 6641 1703884 65471 65471
ReadX 6641 1769355 63 63
ReadX 6641 1769418 65471 65471
ReadX 6641 1834889 63 63
ReadX 6641 1834952 32824 32824
Close 6641
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 6642
QUERY_FILE_INFORMATION 6642
ReadX 6642 0 512 512
ReadX 6642 512 512 512
ReadX 6642 1024 512 512
QUERY_FILE_INFORMATION 6642
QUERY_FILE_INFORMATION 6642
ReadX 6642 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 6642
QUERY_FILE_INFORMATION 6642
ReadX 6642 512 4096 4096
QUERY_FILE_INFORMATION 6642
QUERY_FILE_INFORMATION 6642
QUERY_FILE_INFORMATION 6642
WriteX 6642 512 4096 4096
WriteX 6642 1024 512 512
ReadX 6642 502 512 512
QUERY_FILE_INFORMATION 6642
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6642 2560 512 512
ReadX 6642 1536 512 512
ReadX 6642 2176 384 384
ReadX 6642 3072 128 128
ReadX 6642 3107 512 512
ReadX 6642 3619 512 512
ReadX 6642 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6642 286 123 123
ReadX 6642 292 24 24
ReadX 6642 512 2048 2048
ReadX 6642 512 2048 2048
ReadX 6642 2560 2048 2048
ReadX 6642 416 1536 1536
ReadX 6642 768 512 512
ReadX 6642 1280 2048 2048
ReadX 6642 3328 2048 2048
ReadX 6642 5376 2048 2048
ReadX 6642 7424 2048 2048
ReadX 6642 9472 2048 2048
ReadX 6642 11520 2048 2048
ReadX 6642 13568 2048 2048
ReadX 6642 15616 2048 2048
ReadX 6642 17664 2048 2048
ReadX 6642 19712 2048 2048
ReadX 6642 21760 2048 2048
ReadX 6642 23808 2048 2048
ReadX 6642 25856 2048 2048
ReadX 6642 27904 2048 2048
ReadX 6642 29952 2048 2048
ReadX 6642 32000 2048 2048
ReadX 6642 34048 2048 2048
ReadX 6642 36096 2048 2048
ReadX 6642 38144 2048 2048
ReadX 6642 40192 2048 2048
ReadX 6642 42240 512 512
ReadX 6642 42752 2048 2048
ReadX 6642 44800 2048 2048
ReadX 6642 46848 2048 2048
ReadX 6642 48896 2048 2048
ReadX 6642 50944 2048 2048
ReadX 6642 52992 2048 2048
ReadX 6642 55040 2048 2048
ReadX 6642 57088 2048 2048
ReadX 6642 316 2048 2048
ReadX 6642 2364 2048 2048
ReadX 6642 4412 2048 2048
ReadX 6642 6460 2048 2048
ReadX 6642 8508 2048 2048
ReadX 6642 10556 2048 2048
ReadX 6642 12604 2048 2048
ReadX 6642 14652 2048 2048
ReadX 6642 16700 2048 2048
ReadX 6642 18748 2048 2048
ReadX 6642 20796 2048 2048
ReadX 6642 22844 2048 2048
ReadX 6642 24892 2048 2048
ReadX 6642 26940 2048 2048
ReadX 6642 28988 2048 2048
ReadX 6642 31036 2048 2048
ReadX 6642 436 2048 2048
ReadX 6642 2484 2048 2048
ReadX 6642 4532 2048 2048
ReadX 6642 6580 2048 2048
ReadX 6642 8628 2048 2048
ReadX 6642 10676 2048 2048
ReadX 6642 476 2048 2048
ReadX 6642 476 2048 2048
ReadX 6642 476 2048 2048
ReadX 6642 2524 2048 2048
ReadX 6642 484 2048 2048
ReadX 6642 484 2048 2048
ReadX 6642 484 2048 2048
ReadX 6642 2532 665 665
ReadX 6642 492 665 665
ReadX 6642 492 665 665
ReadX 6642 492 665 665
ReadX 6642 296 512 512
ReadX 6642 318 512 512
ReadX 6642 300 512 512
ReadX 6642 312 512 512
ReadX 6642 320 512 512
ReadX 6642 832 354 354
ReadX 6642 504 4096 4096
ReadX 6642 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 6643
Close 6643
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 6644
WriteX 6644 1535 1 1
QUERY_FILE_INFORMATION 6644
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6642 296 1251 1251
ReadX 6642 2176 384 384
ReadX 6642 3072 1634 1634
QUERY_FILE_INFORMATION 6644
WriteX 6644 0 57088 57088
WriteX 6644 0 4096 4096
Flush 6644
Close 6642
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 6645
Close 6645
WriteX 6644 0 4096 4096
Close 6644
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 6646
Close 6646
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 6647
QUERY_FILE_INFORMATION 6647
ReadX 6647 0 512 512
ReadX 6647 512 512 512
ReadX 6647 1024 512 512
QUERY_FILE_INFORMATION 6647
QUERY_FILE_INFORMATION 6647
ReadX 6647 512 2048 2048
QUERY_FILE_INFORMATION 6647
QUERY_FILE_INFORMATION 6647
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6647 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 6648
WriteX 6648 1535 1 1
QUERY_FILE_INFORMATION 6648
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6647 1536 512 512
ReadX 6647 288 1251 1251
ReadX 6647 2048 2018 2018
QUERY_FILE_INFORMATION 6648
WriteX 6648 0 51456 51456
WriteX 6648 0 4096 4096
Flush 6648
QUERY_FILE_INFORMATION 6647
QUERY_FILE_INFORMATION 6647
Close 6647
WriteX 6648 0 4096 4096
Close 6648
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 6649
Close 6649
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 6650
QUERY_FILE_INFORMATION 6650
ReadX 6650 0 512 512
ReadX 6650 512 512 512
ReadX 6650 1024 512 512
QUERY_FILE_INFORMATION 6650
QUERY_FILE_INFORMATION 6650
ReadX 6650 512 2048 2048
QUERY_FILE_INFORMATION 6650
QUERY_FILE_INFORMATION 6650
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6650 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 6652
Close 6652
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 6654
WriteX 6654 4045 1 1
QUERY_FILE_INFORMATION 6654
WriteX 6654 0 53077 53077
Close 6654
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 6655
WriteX 6655 1535 1 1
QUERY_FILE_INFORMATION 6655
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6650 1536 512 512
ReadX 6650 288 1251 1251
ReadX 6650 2048 2018 2018
QUERY_FILE_INFORMATION 6655
WriteX 6655 0 65471 65471
WriteX 6655 65471 65 65
WriteX 6655 65536 1856 1856
WriteX 6655 0 4096 4096
Flush 6655
QUERY_FILE_INFORMATION 6650
QUERY_FILE_INFORMATION 6650
Close 6650
WriteX 6655 0 4096 4096
Close 6655
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 6656
Close 6656
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 6657
QUERY_FILE_INFORMATION 6657
ReadX 6657 0 512 512
ReadX 6657 512 512 512
ReadX 6657 1024 512 512
QUERY_FILE_INFORMATION 6657
QUERY_FILE_INFORMATION 6657
ReadX 6657 576 2048 2048
QUERY_FILE_INFORMATION 6657
QUERY_FILE_INFORMATION 6657
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 6659
Close 6659
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 6661
WriteX 6661 4076 1 1
QUERY_FILE_INFORMATION 6661
WriteX 6661 0 7983 7983
Close 6661
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 6663
Close 6663
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 6665
WriteX 6665 4095 1 1
QUERY_FILE_INFORMATION 6665
WriteX 6665 0 65471 65471
WriteX 6665 65471 65 65
WriteX 6665 65536 65471 65471
WriteX 6665 131007 65 65
WriteX 6665 131072 65471 65471
WriteX 6665 196543 65 65
WriteX 6665 196608 65471 65471
WriteX 6665 262079 65 65
WriteX 6665 262144 65471 65471
WriteX 6665 327615 65 65
WriteX 6665 327680 65471 65471
WriteX 6665 393151 65 65
WriteX 6665 393216 65471 65471
WriteX 6665 458687 65 65
WriteX 6665 458752 46731 46731
Close 6665
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 6666
WriteX 6666 1535 1 1
QUERY_FILE_INFORMATION 6666
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6657 1536 512 512
ReadX 6657 2048 2018 2018
ReadX 6657 4096 512 512
ReadX 6657 4608 2197 2197
QUERY_FILE_INFORMATION 6666
WriteX 6666 0 65471 65471
WriteX 6666 65471 65 65
WriteX 6666 65536 22848 22848
WriteX 6666 0 4096 4096
Flush 6666
QUERY_FILE_INFORMATION 6657
QUERY_FILE_INFORMATION 6657
Close 6657
WriteX 6666 0 4096 4096
Close 6666
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 6667
Close 6667
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 6668
QUERY_FILE_INFORMATION 6668
ReadX 6668 0 512 512
ReadX 6668 512 512 512
ReadX 6668 1024 512 512
QUERY_FILE_INFORMATION 6668
QUERY_FILE_INFORMATION 6668
ReadX 6668 576 2048 2048
QUERY_FILE_INFORMATION 6668
QUERY_FILE_INFORMATION 6668
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6668 4096 512 512
Close 6668
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 6669
QUERY_FILE_INFORMATION 6669
ReadX 6669 0 512 512
ReadX 6669 512 512 512
ReadX 6669 1024 512 512
QUERY_FILE_INFORMATION 6669
QUERY_FILE_INFORMATION 6669
ReadX 6669 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 6669
QUERY_FILE_INFORMATION 6669
ReadX 6669 288 4096 4096
QUERY_FILE_INFORMATION 6669
QUERY_FILE_INFORMATION 6669
QUERY_FILE_INFORMATION 6669
WriteX 6669 288 4096 4096
WriteX 6669 1024 512 512
ReadX 6669 1536 512 512
QUERY_FILE_INFORMATION 6669
ReadX 6669 288 2048 2048
ReadX 6669 2336 2048 2048
ReadX 6669 3072 1536 1536
ReadX 6669 544 512 512
ReadX 6669 1056 2048 2048
ReadX 6669 3104 2048 2048
ReadX 6669 5152 2048 2048
ReadX 6669 7200 2048 2048
ReadX 6669 9248 2048 2048
ReadX 6669 11296 2048 2048
ReadX 6669 13344 2048 2048
ReadX 6669 15392 2048 2048
ReadX 6669 17440 2048 2048
ReadX 6669 19488 2048 2048
ReadX 6669 21536 2048 2048
ReadX 6669 23584 2048 2048
ReadX 6669 25632 2048 2048
ReadX 6669 27680 2048 2048
ReadX 6669 29728 2048 2048
ReadX 6669 31776 2048 2048
ReadX 6669 33824 2048 2048
ReadX 6669 35872 2048 2048
ReadX 6669 37920 2048 2048
ReadX 6669 39968 2048 2048
ReadX 6669 42016 512 512
ReadX 6669 42528 512 512
ReadX 6669 43040 1536 1536
ReadX 6669 44576 2048 2048
ReadX 6669 46624 2048 2048
ReadX 6669 48672 2048 2048
ReadX 6669 50720 2048 2048
ReadX 6669 52768 2048 2048
ReadX 6669 54816 2048 2048
ReadX 6669 56864 2048 2048
ReadX 6669 58912 2048 2048
ReadX 6669 60960 2048 2048
ReadX 6669 63008 2048 2048
ReadX 6669 65056 2048 2048
ReadX 6669 67104 2048 2048
ReadX 6669 69152 2048 2048
ReadX 6669 71200 2048 2048
ReadX 6669 73248 2048 2048
ReadX 6669 75296 2048 2048
ReadX 6669 77344 2048 2048
ReadX 6669 79392 2048 2048
ReadX 6669 81440 2048 2048
ReadX 6669 83488 2048 2048
ReadX 6669 85536 512 512
ReadX 6669 86048 512 512
ReadX 6669 86560 1536 1536
ReadX 6669 88096 2048 2048
ReadX 6669 90144 2048 2048
ReadX 6669 92192 2048 2048
ReadX 6669 94240 2048 2048
ReadX 6669 96288 2048 2048
ReadX 6669 552 2048 2048
ReadX 6669 2600 2048 2048
ReadX 6669 4648 2048 2048
ReadX 6669 6696 2048 2048
ReadX 6669 8744 2048 2048
ReadX 6669 10792 2048 2048
ReadX 6669 12840 2048 2048
ReadX 6669 14888 2048 2048
ReadX 6669 16936 2048 2048
ReadX 6669 18984 2048 2048
ReadX 6669 21032 2048 2048
ReadX 6669 23080 2048 2048
ReadX 6669 25128 2048 2048
ReadX 6669 27176 2048 2048
ReadX 6669 29224 2048 2048
ReadX 6669 31272 2048 2048
ReadX 6669 33320 2048 2048
ReadX 6669 35368 2048 2048
ReadX 6669 37416 2048 2048
ReadX 6669 39464 2048 2048
ReadX 6669 41512 512 512
ReadX 6669 42024 512 512
ReadX 6669 42536 1536 1536
ReadX 6669 44072 2048 2048
ReadX 6669 46120 2048 2048
ReadX 6669 48168 2048 2048
ReadX 6669 50216 2048 2048
ReadX 6669 52264 2048 2048
ReadX 6669 54312 2048 2048
ReadX 6669 56360 2048 2048
ReadX 6669 58408 2048 2048
ReadX 6669 60456 2048 2048
ReadX 6669 62504 2048 2048
ReadX 6669 64552 2048 2048
ReadX 6669 66600 2048 2048
ReadX 6669 68648 2048 2048
ReadX 6669 70696 2048 2048
ReadX 6669 72744 2048 2048
ReadX 6669 74792 2048 2048
ReadX 6669 76840 2048 2048
ReadX 6669 78888 2048 2048
ReadX 6669 80936 2048 2048
ReadX 6669 82984 2048 2048
ReadX 6669 85032 512 512
ReadX 6669 85544 2048 2048
ReadX 6669 87592 2048 2048
ReadX 6669 89640 2048 2048
ReadX 6669 91688 2048 2048
ReadX 6669 93736 2048 2048
ReadX 6669 95784 2048 2048
ReadX 6669 97832 2048 2048
ReadX 6669 99880 2048 2048
ReadX 6669 101928 2048 2048
ReadX 6669 103976 2048 2048
ReadX 6669 106024 2048 2048
ReadX 6669 108072 2048 2048
ReadX 6669 110120 2048 2048
ReadX 6669 112168 2048 2048
ReadX 6669 114216 2048 2048
ReadX 6669 116264 2048 2048
ReadX 6669 118312 2048 2048
ReadX 6669 120360 2048 2048
ReadX 6669 122408 2048 2048
ReadX 6669 124456 512 512
ReadX 6669 124968 512 512
ReadX 6669 125480 1536 1536
ReadX 6669 127016 2048 2048
ReadX 6669 129064 2048 2048
ReadX 6669 131112 2048 2048
ReadX 6669 133160 2048 2048
ReadX 6669 135208 2048 2048
ReadX 6669 137256 2048 2048
ReadX 6669 139304 2048 2048
ReadX 6669 141352 2048 2048
ReadX 6669 143400 2048 2048
ReadX 6669 145448 2048 2048
ReadX 6669 147496 2048 2048
ReadX 6669 149544 2048 2048
ReadX 6669 151592 2048 2048
ReadX 6669 153640 2048 2048
ReadX 6669 155688 2048 2048
ReadX 6669 157736 2048 2048
ReadX 6669 159784 2048 2048
ReadX 6669 161832 2048 2048
ReadX 6669 163880 2048 2048
ReadX 6669 165928 2048 2048
ReadX 6669 167976 2048 2048
ReadX 6669 170024 512 512
ReadX 6669 1538 1536 1536
ReadX 6669 3074 2048 2048
ReadX 6669 5122 2048 2048
ReadX 6669 7170 2048 2048
ReadX 6669 9218 2048 2048
ReadX 6669 11266 2048 2048
ReadX 6669 13314 2048 2048
ReadX 6669 15362 2048 2048
ReadX 6669 17410 2048 2048
ReadX 6669 19458 2048 2048
ReadX 6669 21506 2048 2048
ReadX 6669 23554 2048 2048
ReadX 6669 25602 2048 2048
ReadX 6669 27650 2048 2048
ReadX 6669 29698 2048 2048
ReadX 6669 31746 2048 2048
ReadX 6669 33794 2048 2048
ReadX 6669 35842 2048 2048
ReadX 6669 37890 2048 2048
ReadX 6669 39938 2048 2048
ReadX 6669 41986 2048 2048
ReadX 6669 44034 875 875
ReadX 6669 1730 4096 4096
ReadX 6669 1724 1536 1536
ReadX 6669 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 6670
Close 6670
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 6671
WriteX 6671 2047 1 1
QUERY_FILE_INFORMATION 6671
Close 6669
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 6672
Close 6672
WriteX 6671 0 42388 42388
Close 6671
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 6673
Close 6673
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 6674
QUERY_FILE_INFORMATION 6674
ReadX 6674 0 512 512
ReadX 6674 1756 512 512
ReadX 6674 2268 512 512
QUERY_FILE_INFORMATION 6674
QUERY_FILE_INFORMATION 6674
ReadX 6674 1744 512 512
ReadX 6674 2256 512 512
ReadX 6674 2768 512 512
ReadX 6674 3280 512 512
ReadX 6674 3792 512 512
ReadX 6674 4304 512 512
ReadX 6674 512 2048 2048
QUERY_FILE_INFORMATION 6674
QUERY_FILE_INFORMATION 6674
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 6675
WriteX 6675 2047 1 1
QUERY_FILE_INFORMATION 6675
QUERY_FILE_INFORMATION 6674
QUERY_FILE_INFORMATION 6674
Close 6674
WriteX 6675 0 42652 42652
Close 6675
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 6676
Close 6676
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 6677
QUERY_FILE_INFORMATION 6677
ReadX 6677 0 512 512
ReadX 6677 1762 512 512
ReadX 6677 2274 512 512
QUERY_FILE_INFORMATION 6677
QUERY_FILE_INFORMATION 6677
ReadX 6677 1750 512 512
ReadX 6677 2262 512 512
ReadX 6677 2774 512 512
ReadX 6677 3286 512 512
ReadX 6677 3798 512 512
ReadX 6677 4310 512 512
ReadX 6677 512 2048 2048
QUERY_FILE_INFORMATION 6677
QUERY_FILE_INFORMATION 6677
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 6679
Close 6679
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 6681
WriteX 6681 4080 1 1
QUERY_FILE_INFORMATION 6681
WriteX 6681 0 65471 65471
WriteX 6681 65471 65 65
WriteX 6681 65536 49 49
Close 6681
Close 6677
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 6682
WriteX 6682 0 65471 65471
WriteX 6682 65471 63 63
WriteX 6682 65534 65471 65471
WriteX 6682 131005 63 63
Close 6682
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 6683
WriteX 6683 0 65471 65471
WriteX 6683 65471 63 63
WriteX 6683 65534 65471 65471
WriteX 6683 131005 63 63
WriteX 6683 131068 65471 65471
WriteX 6683 196539 63 63
WriteX 6683 196602 65471 65471
WriteX 6683 262073 63 63
Close 6683
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 6684
WriteX 6684 0 65471 65471
WriteX 6684 65471 63 63
WriteX 6684 65534 65471 65471
WriteX 6684 131005 63 63
WriteX 6684 131068 65471 65471
WriteX 6684 196539 63 63
WriteX 6684 196602 65471 65471
WriteX 6684 262073 63 63
WriteX 6684 262136 65471 65471
WriteX 6684 327607 63 63
WriteX 6684 327670 65471 65471
WriteX 6684 393141 63 63
WriteX 6684 393204 65471 65471
WriteX 6684 458675 63 63
WriteX 6684 458738 65471 65471
WriteX 6684 524209 63 63
Close 6684
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 6685
Close 6685
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 6686
Close 6686
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 6689
Close 6689
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 6691
Close 6691
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 6692
Close 6692
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 6695
Close 6695
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 6697
Close 6697
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 6698
Close 6698
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6701
Close 6701
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6705
Close 6705
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6709
Close 6709
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6713
Close 6713
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6717
Close 6717
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6721
Close 6721
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6725
Close 6725
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 6729
Close 6729
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 6731
Close 6731
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 6733
Close 6733
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 6735
WriteX 6735 4095 1 1
QUERY_FILE_INFORMATION 6735
QUERY_FS_INFORMATION 259
WriteX 6735 0 65471 65471
WriteX 6735 65471 65 65
WriteX 6735 65536 65471 65471
WriteX 6735 131007 65 65
WriteX 6735 131072 65471 65471
WriteX 6735 196543 65 65
WriteX 6735 196608 65471 65471
WriteX 6735 262079 65 65
WriteX 6735 262144 26634 26634
Close 6735
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 6740
QUERY_FILE_INFORMATION 6740
QUERY_FILE_INFORMATION 6740
Close 6740
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 6741
Close 6741
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 6742
Close 6742
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 6743
QUERY_FILE_INFORMATION 6743
ReadX 6743 0 512 512
ReadX 6743 288 512 512
ReadX 6743 800 512 512
Close 6743
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 6744
ReadX 6744 0 24 24
Close 6744
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 6745
ReadX 6745 0 24 24
Close 6745
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 6746
QUERY_FILE_INFORMATION 6746
ReadX 6746 0 512 512
ReadX 6746 288 512 512
ReadX 6746 800 512 512
ReadX 6746 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 6746 1759 2849 2849
Close 6746
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 6747
Close 6747
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 6750
Close 6750
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 6752
Close 6752
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 6753
Close 6753
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 6756
Close 6756
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 6758
Close 6758
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6759
Close 6759
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6762
Close 6762
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6766
Close 6766
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6770
Close 6770
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6774
Close 6774
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 6778
Close 6778
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 6782
Close 6782
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6785
Close 6785
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6789
Close 6789
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6793
Close 6793
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 6795
Close 6795
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 6796
Close 6796
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 6805
QUERY_FILE_INFORMATION 6805
QUERY_FILE_INFORMATION 6805
Close 6805
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 6806
Close 6806
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 6807
Close 6807
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 6808
QUERY_FILE_INFORMATION 6808
ReadX 6808 0 512 512
ReadX 6808 288 512 512
ReadX 6808 800 512 512
Close 6808
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 6809
ReadX 6809 0 24 24
Close 6809
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 6810
QUERY_FILE_INFORMATION 6810
ReadX 6810 0 512 512
ReadX 6810 288 512 512
ReadX 6810 800 512 512
ReadX 6810 512 36 36
Close 6810
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 6811
QUERY_FILE_INFORMATION 6811
ReadX 6811 0 512 512
ReadX 6811 288 512 512
ReadX 6811 800 512 512
ReadX 6811 512 682 682
ReadX 6811 3584 106 106
ReadX 6811 3712 10 10
ReadX 6811 3722 10 10
ReadX 6811 512 2048 2048
ReadX 6811 3072 512 512
ReadX 6811 276 84 84
ReadX 6811 273 49 49
ReadX 6811 2560 512 512
Close 6811
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 6821
QUERY_FILE_INFORMATION 6821
QUERY_FILE_INFORMATION 6821
Close 6821
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 6822
Close 6822
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 6823
Close 6823
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 6824
QUERY_FILE_INFORMATION 6824
ReadX 6824 0 512 512
ReadX 6824 288 512 512
ReadX 6824 800 512 512
Close 6824
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 6825
ReadX 6825 0 24 24
Close 6825
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 6826
QUERY_FILE_INFORMATION 6826
ReadX 6826 0 512 512
ReadX 6826 288 512 512
ReadX 6826 800 512 512
ReadX 6826 512 36 36
Close 6826
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 6827
QUERY_FILE_INFORMATION 6827
ReadX 6827 0 512 512
ReadX 6827 288 512 512
ReadX 6827 800 512 512
ReadX 6827 512 682 682
ReadX 6827 3072 106 106
ReadX 6827 3200 10 10
ReadX 6827 3210 10 10
ReadX 6827 512 2048 2048
ReadX 6827 2560 512 512
ReadX 6827 3887 84 84
ReadX 6827 3838 49 49
ReadX 6827 2048 512 512
Close 6827
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 6828
Close 6828
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 6829
QUERY_FILE_INFORMATION 6829
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 6829
QUERY_FILE_INFORMATION 6829
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 6830
QUERY_FILE_INFORMATION 6830
QUERY_FILE_INFORMATION 6830
QUERY_FILE_INFORMATION 6830
ReadX 6830 2156 24 24
ReadX 6830 2139 276 276
ReadX 6830 2136 14 14
ReadX 6830 2136 7 7
ReadX 6830 2138 12 12
ReadX 6830 2137 8 8
ReadX 6830 2135 15 15
ReadX 6830 0 16 16
ReadX 6830 16 2048 2048
ReadX 6830 2064 2048 2048
ReadX 6830 257 2048 2048
ReadX 6830 385 2048 2048
ReadX 6830 513 2048 2048
ReadX 6830 641 2048 2048
ReadX 6830 769 2048 2048
ReadX 6830 897 2048 2048
ReadX 6830 1025 2048 2048
ReadX 6830 1153 2048 2048
ReadX 6830 1281 2048 2048
ReadX 6830 1409 2048 2048
ReadX 6830 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 6832
Close 6832
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6834
WriteX 6834 15 1 1
QUERY_FILE_INFORMATION 6834
WriteX 6834 0 10575 10575
Flush 6834
Close 6834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6835
Close 6835
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 6836
QUERY_FILE_INFORMATION 6836
QUERY_FILE_INFORMATION 6836
QUERY_FILE_INFORMATION 6836
ReadX 6836 2157 24 24
ReadX 6836 2139 276 276
ReadX 6836 2137 14 14
ReadX 6836 2137 7 7
ReadX 6836 2139 12 12
ReadX 6836 2138 8 8
ReadX 6836 2136 15 15
Close 6830
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 6837
Close 6837
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 6838
QUERY_FILE_INFORMATION 6838
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 6839
QUERY_FILE_INFORMATION 6839
ReadX 6839 0 512 512
ReadX 6839 512 512 512
ReadX 6839 1024 512 512
QUERY_FILE_INFORMATION 6839
QUERY_FILE_INFORMATION 6839
Close 6839
QUERY_FILE_INFORMATION 6838
ReadX 6838 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 6840
QUERY_FILE_INFORMATION 6840
ReadX 6840 0 512 512
ReadX 6840 512 512 512
ReadX 6840 1024 512 512
ReadX 6840 288 20 20
ReadX 6840 308 2084 2084
ReadX 6840 388 2084 2084
ReadX 6840 388 2084 2084
ReadX 6829 2157 1386 1386
ReadX 6840 2472 399 399
ReadX 6840 3072 1536 1536
ReadX 6840 544 149 149
ReadX 6840 693 485 485
Close 6840
ReadX 6829 2157 4096 4096
ReadX 6829 6253 4096 4096
ReadX 6829 10349 4096 4096
ReadX 6829 14445 4096 4096
ReadX 6829 18541 4096 4096
ReadX 6829 22637 256 256
ReadX 6829 22893 4096 4096
ReadX 6829 26989 4096 4096
ReadX 6829 31085 4096 4096
ReadX 6829 35181 4096 4096
ReadX 6829 39277 4096 4096
ReadX 6829 43373 4096 4096
ReadX 6829 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 6829 2157 1024 1024
ReadX 6829 1667 4688 4688
ReadX 6829 6355 3516 3516
ReadX 6829 9871 16384 16384
ReadX 6829 26255 3771 3771
ReadX 6829 30026 2048 2048
ReadX 6829 32074 1024 1024
ReadX 6829 33098 6652 6652
ReadX 6829 39750 16384 16384
ReadX 6829 56134 10496 10496
ReadX 6829 66630 1784 1784
ReadX 6829 68414 90 90
ReadX 6829 68504 273 273
ReadX 6829 68777 1600 1600
ReadX 6829 70377 640 640
ReadX 6829 71017 1280 1280
ReadX 6829 72297 8464 8464
ReadX 6829 80761 158 158
ReadX 6829 80919 912 912
ReadX 6829 81831 1980 1980
ReadX 6829 83811 2256 2256
ReadX 6829 86067 400 400
ReadX 6829 86467 252 252
ReadX 6829 86719 42 42
ReadX 6829 86761 725 725
ReadX 6829 2009 512 512
ReadX 6829 3895 9 9
ReadX 6829 3781 46 46
ReadX 6829 4059 92 92
ReadX 6829 3781 92 92
ReadX 6829 3986 184 184
ReadX 6829 3987 16384 16384
ReadX 6829 3902 16384 16384
ReadX 6829 3781 10240 10240
ReadX 6829 3821 16384 16384
ReadX 6829 3891 935 935
ReadX 6829 4060 10240 10240
ReadX 6829 4059 184 184
ReadX 6829 256 184 184
ReadX 6829 256 1026 1026
ReadX 6829 3901 326 326
ReadX 6829 3899 652 652
ReadX 6829 256 2 2
ReadX 6829 258 4948 4948
Close 6829
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 6842
Close 6842
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 6844
WriteX 6844 4055 1 1
QUERY_FILE_INFORMATION 6844
WriteX 6844 0 65471 65471
WriteX 6844 65471 65 65
WriteX 6844 65536 65471 65471
WriteX 6844 131007 65 65
WriteX 6844 131072 65471 65471
WriteX 6844 196543 65 65
WriteX 6844 196608 65471 65471
WriteX 6844 262079 65 65
WriteX 6844 262144 65471 65471
WriteX 6844 327615 65 65
WriteX 6844 327680 65471 65471
WriteX 6844 393151 65 65
WriteX 6844 393216 65471 65471
WriteX 6844 458687 65 65
WriteX 6844 458752 65471 65471
WriteX 6844 524223 65 65
WriteX 6844 524288 65471 65471
WriteX 6844 589759 65 65
WriteX 6844 589824 35257 35257
Close 6844
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 6846
Close 6846
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 6848
WriteX 6848 4055 1 1
QUERY_FILE_INFORMATION 6848
WriteX 6848 0 65471 65471
WriteX 6848 65471 65 65
WriteX 6848 65536 65471 65471
WriteX 6848 131007 65 65
WriteX 6848 131072 65471 65471
WriteX 6848 196543 65 65
WriteX 6848 196608 65471 65471
WriteX 6848 262079 65 65
WriteX 6848 262144 65471 65471
WriteX 6848 327615 65 65
WriteX 6848 327680 65471 65471
WriteX 6848 393151 65 65
WriteX 6848 393216 65471 65471
WriteX 6848 458687 65 65
WriteX 6848 458752 65471 65471
WriteX 6848 524223 65 65
WriteX 6848 524288 65471 65471
WriteX 6848 589759 65 65
WriteX 6848 589824 57598 57598
Close 6848
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6850
WriteX 6850 15 1 1
QUERY_FILE_INFORMATION 6850
WriteX 6850 0 12543 12543
Flush 6850
Close 6850
Close 6836
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6851
Close 6851
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 6852
QUERY_FILE_INFORMATION 6852
QUERY_FILE_INFORMATION 6852
QUERY_FILE_INFORMATION 6852
ReadX 6852 288 24 24
ReadX 6852 287 276 276
ReadX 6852 286 14 14
ReadX 6852 286 7 7
ReadX 6852 287 12 12
ReadX 6852 287 8 8
ReadX 6852 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 6853
Close 6853
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 6854
QUERY_FILE_INFORMATION 6854
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 6854
QUERY_FILE_INFORMATION 6854
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 6855
QUERY_FILE_INFORMATION 6855
QUERY_FILE_INFORMATION 6855
QUERY_FILE_INFORMATION 6855
ReadX 6855 1938 24 24
ReadX 6855 1920 276 276
ReadX 6855 1918 14 14
ReadX 6855 1918 7 7
ReadX 6855 1919 12 12
ReadX 6855 1919 8 8
ReadX 6855 1917 15 15
ReadX 6855 0 16 16
ReadX 6855 16 2048 2048
ReadX 6855 2064 2048 2048
ReadX 6855 257 2048 2048
ReadX 6855 385 2048 2048
ReadX 6855 513 2048 2048
ReadX 6855 641 2048 2048
ReadX 6855 769 2048 2048
ReadX 6855 897 2048 2048
ReadX 6855 1025 2048 2048
ReadX 6855 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 6857
Close 6857
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6859
WriteX 6859 15 1 1
QUERY_FILE_INFORMATION 6859
WriteX 6859 0 11588 11588
Flush 6859
Close 6859
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6860
Close 6860
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 6861
QUERY_FILE_INFORMATION 6861
QUERY_FILE_INFORMATION 6861
QUERY_FILE_INFORMATION 6861
ReadX 6861 1909 24 24
ReadX 6861 1892 276 276
ReadX 6861 1889 14 14
ReadX 6861 1889 7 7
ReadX 6861 1891 12 12
ReadX 6861 1890 8 8
ReadX 6861 1888 15 15
Close 6855
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6863
WriteX 6863 15 1 1
QUERY_FILE_INFORMATION 6863
WriteX 6863 0 11615 11615
Flush 6863
Close 6863
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 6861
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6864
Close 6864
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 6865
QUERY_FILE_INFORMATION 6865
QUERY_FILE_INFORMATION 6865
QUERY_FILE_INFORMATION 6865
ReadX 6865 1947 24 24
ReadX 6865 1929 276 276
ReadX 6865 1927 14 14
ReadX 6865 1927 7 7
ReadX 6865 1929 12 12
ReadX 6865 1928 8 8
ReadX 6865 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 6867
Close 6867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 6869
WriteX 6869 4088 1 1
QUERY_FILE_INFORMATION 6869
WriteX 6869 0 65471 65471
WriteX 6869 65471 65 65
WriteX 6869 65536 16050 16050
Close 6869
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6854 1939 64 64
ReadX 6854 128 248 248
ReadX 6854 128 568 568
ReadX 6854 3872 1536 1536
ReadX 6854 3456 2560 2560
ReadX 6854 3136 512 512
ReadX 6854 2880 4096 4096
ReadX 6854 3264 3072 3072
ReadX 6854 320 4096 4096
ReadX 6854 1024 4096 4096
ReadX 6854 3616 4096 4096
ReadX 6854 1939 64 64
ReadX 6854 128 248 248
ReadX 6854 128 608 608
ReadX 6854 2858 1024 1024
ReadX 6854 2810 4096 4096
ReadX 6854 2826 4096 4096
ReadX 6854 2580 2048 2048
ReadX 6854 2800 2560 2560
ReadX 6854 2100 4096 4096
ReadX 6854 2084 4096 4096
ReadX 6854 868 4096 4096
ReadX 6854 2324 4096 4096
ReadX 6854 884 4096 4096
ReadX 6854 2604 1024 1024
ReadX 6854 580 4096 4096
ReadX 6854 596 4096 4096
ReadX 6854 2752 4096 4096
ReadX 6854 2842 1024 1024
ReadX 6854 660 4096 4096
ReadX 6854 2720 4096 4096
ReadX 6854 2736 4096 4096
ReadX 6854 628 4096 4096
ReadX 6854 2704 4096 4096
ReadX 6854 1556 4096 4096
ReadX 6854 576 4096 4096
ReadX 6854 3168 1536 1536
ReadX 6854 832 4096 4096
ReadX 6854 1088 4096 4096
ReadX 6854 1344 4096 4096
ReadX 6854 1600 4096 4096
ReadX 6854 1856 4096 4096
ReadX 6854 2112 4096 4096
ReadX 6854 1892 4096 4096
ReadX 6854 820 4096 4096
ReadX 6854 788 4096 4096
ReadX 6854 1604 4096 4096
ReadX 6854 3648 4096 4096
ReadX 6854 2608 4096 4096
ReadX 6854 548 4096 4096
ReadX 6854 740 4096 4096
ReadX 6854 1344 4096 4096
ReadX 6854 3392 4096 4096
ReadX 6854 3904 4096 4096
ReadX 6854 644 4096 4096
ReadX 6854 676 4096 4096
ReadX 6854 2688 4096 4096
ReadX 6854 320 4096 4096
ReadX 6854 900 4096 4096
ReadX 6854 1908 4096 4096
ReadX 6854 852 4096 4096
ReadX 6854 724 4096 4096
ReadX 6854 2292 4096 4096
ReadX 6854 612 4096 4096
ReadX 6854 388 4096 4096
ReadX 6854 2368 4096 4096
ReadX 6854 2624 4096 4096
ReadX 6854 500 4096 4096
ReadX 6854 356 4096 4096
ReadX 6854 1024 4096 4096
ReadX 6854 576 4096 4096
ReadX 6854 340 4096 4096
ReadX 6854 420 4096 4096
ReadX 6854 1600 4096 4096
ReadX 6854 404 4096 4096
ReadX 6854 1428 4096 4096
ReadX 6854 2656 4096 4096
ReadX 6854 2624 4096 4096
ReadX 6854 452 4096 4096
ReadX 6854 692 4096 4096
ReadX 6854 564 4096 4096
ReadX 6854 372 4096 4096
ReadX 6854 468 4096 4096
ReadX 6854 484 4096 4096
ReadX 6854 1088 4096 4096
ReadX 6854 1924 4096 4096
ReadX 6854 2768 4096 4096
ReadX 6854 832 4096 4096
ReadX 6854 836 4096 4096
ReadX 6854 1856 4096 4096
ReadX 6854 2640 4096 4096
ReadX 6854 436 4096 4096
ReadX 6854 1828 4096 4096
ReadX 6854 804 4096 4096
ReadX 6854 1860 4096 4096
ReadX 6854 1812 4096 4096
ReadX 6854 756 4096 4096
ReadX 6854 1636 4096 4096
ReadX 6854 772 4096 4096
ReadX 6854 2036 4096 4096
ReadX 6854 1220 4096 4096
ReadX 6854 1652 4096 4096
ReadX 6854 2588 4096 4096
ReadX 6854 916 4096 4096
ReadX 6854 260 4096 4096
ReadX 6854 932 4096 4096
ReadX 6854 2624 4096 4096
ReadX 6854 308 4096 4096
ReadX 6854 292 4096 4096
ReadX 6854 1140 4096 4096
ReadX 6854 276 4096 4096
ReadX 6854 2020 4096 4096
ReadX 6854 2880 4096 4096
ReadX 6854 516 4096 4096
ReadX 6854 1844 4096 4096
ReadX 6854 1124 4096 4096
ReadX 6854 3136 4096 4096
ReadX 6854 324 4096 4096
ReadX 6854 1156 4096 4096
ReadX 6854 1172 4096 4096
ReadX 6854 2112 4096 4096
ReadX 6854 2368 4096 4096
ReadX 6854 964 4096 4096
ReadX 6854 980 4096 4096
ReadX 6854 1012 4096 4096
ReadX 6854 532 4096 4096
ReadX 6854 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 6854 1620 4096 4096
ReadX 6854 1604 4096 4096
ReadX 6854 2116 4096 4096
ReadX 6854 2132 4096 4096
ReadX 6854 2148 4096 4096
ReadX 6854 2276 4096 4096
ReadX 6854 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 6871
Close 6871
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 6873
QUERY_FILE_INFORMATION 6838
WriteX 6873 4088 1 1
QUERY_FILE_INFORMATION 6873
QUERY_FILE_INFORMATION 6838
Close 6838
WriteX 6873 0 65471 65471
WriteX 6873 65471 65 65
WriteX 6873 65536 64850 64850
Close 6873
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6875
WriteX 6875 15 1 1
QUERY_FILE_INFORMATION 6875
ReadX 6854 2068 4096 4096
ReadX 6854 1588 4096 4096
ReadX 6854 1572 4096 4096
WriteX 6875 0 18630 18630
Flush 6875
Close 6875
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 6865
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6876
Close 6876
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 6877
QUERY_FILE_INFORMATION 6877
QUERY_FILE_INFORMATION 6877
QUERY_FILE_INFORMATION 6877
ReadX 6877 661 24 24
ReadX 6877 659 356 356
ReadX 6877 659 14 14
ReadX 6877 659 7 7
ReadX 6877 659 12 12
ReadX 6877 659 8 8
ReadX 6877 659 15 15
ReadX 6877 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 6854 612 4096 4096
ReadX 6854 564 4096 4096
ReadX 6854 1876 4096 4096
ReadX 6854 628 4096 4096
ReadX 6854 740 4096 4096
ReadX 6854 724 4096 4096
ReadX 6854 644 4096 4096
ReadX 6854 2324 4096 4096
ReadX 6854 660 4096 4096
ReadX 6854 852 4096 4096
ReadX 6854 868 4096 4096
Close 6877
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 6852
ReadX 6854 2368 4096 4096
ReadX 6854 1024 4096 4096
ReadX 6854 320 4096 4096
ReadX 6854 580 4096 4096
ReadX 6854 3136 512 512
ReadX 6854 2880 4096 4096
Close 6854
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 6878
WriteX 6878 0 65471 65471
WriteX 6878 65471 63 63
WriteX 6878 65534 65471 65471
WriteX 6878 131005 63 63
Close 6878
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 6879
WriteX 6879 0 65471 65471
WriteX 6879 65471 63 63
WriteX 6879 65534 65471 65471
WriteX 6879 131005 63 63
WriteX 6879 131068 65471 65471
WriteX 6879 196539 63 63
WriteX 6879 196602 65471 65471
WriteX 6879 262073 63 63
Close 6879
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 6880
WriteX 6880 0 65471 65471
WriteX 6880 65471 63 63
WriteX 6880 65534 65471 65471
WriteX 6880 131005 63 63
WriteX 6880 131068 65471 65471
WriteX 6880 196539 63 63
WriteX 6880 196602 65471 65471
WriteX 6880 262073 63 63
WriteX 6880 262136 65471 65471
WriteX 6880 327607 63 63
WriteX 6880 327670 65471 65471
WriteX 6880 393141 63 63
WriteX 6880 393204 65471 65471
WriteX 6880 458675 63 63
WriteX 6880 458738 65471 65471
WriteX 6880 524209 63 63
Close 6880
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6881
Close 6881
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6882
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6882 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6883
ReadX 6883 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6884
ReadX 6884 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6885
ReadX 6885 0 511 511
ReadX 6882 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6882
Close 6883
Close 6884
Close 6885
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6886
ReadX 6886 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6887
ReadX 6887 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6888
ReadX 6888 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6889
ReadX 6889 0 511 511
ReadX 6886 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 6890
FIND_FIRST \clients\client1\~dmtmp\*
Close 6890
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 6891
QUERY_FILE_INFORMATION 6891
WriteX 6891 2047 1 1
QUERY_FILE_INFORMATION 6891
WriteX 6891 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 6892
Close 6892
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 6893
WriteX 6893 52 1 1
QUERY_FILE_INFORMATION 6893
WriteX 6893 0 53 53
WriteX 6893 53 28 28
WriteX 6893 81 4 4
WriteX 6893 85 28 28
WriteX 6893 113 38 38
WriteX 6893 151 28 28
WriteX 6893 179 2 2
WriteX 6893 181 28 28
WriteX 6893 209 3 3
WriteX 6893 212 279 279
WriteX 6893 9 4 4
Close 6893
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 6894
ReadX 6894 0 53 53
ReadX 6894 53 28 28
ReadX 6894 81 4 4
ReadX 6894 85 28 28
ReadX 6894 113 38 38
ReadX 6894 151 28 28
ReadX 6894 179 2 2
ReadX 6894 181 28 28
ReadX 6894 209 3 3
Close 6894
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 6886
Close 6887
Close 6888
Close 6889
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6895
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6895 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6896
ReadX 6896 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6897
ReadX 6897 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6898
ReadX 6898 0 511 511
ReadX 6895 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 6900
Close 6900
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6901
WriteX 6901 52 1 1
QUERY_FILE_INFORMATION 6901
WriteX 6901 0 53 53
WriteX 6901 53 28 28
WriteX 6901 81 28 28
WriteX 6901 109 28 28
WriteX 6901 137 28 28
WriteX 6901 165 28 28
WriteX 6901 193 28 28
WriteX 6901 221 28 28
WriteX 6901 249 4 4
WriteX 6901 253 4 4
WriteX 6901 257 4 4
WriteX 6901 261 28 28
WriteX 6901 289 2 2
WriteX 6901 291 2 2
WriteX 6901 293 2 2
WriteX 6901 295 248 248
WriteX 6901 9 4 4
Close 6901
Close 6895
Close 6896
Close 6897
Close 6898
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6902
ReadX 6902 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6903
ReadX 6903 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6904
ReadX 6904 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6905
ReadX 6905 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6906
ReadX 6906 0 53 53
ReadX 6906 53 28 28
ReadX 6906 81 28 28
ReadX 6906 109 28 28
ReadX 6906 137 28 28
ReadX 6906 165 28 28
ReadX 6906 193 28 28
ReadX 6906 221 28 28
ReadX 6906 249 4 4
ReadX 6906 253 4 4
ReadX 6906 257 4 4
ReadX 6906 261 28 28
ReadX 6906 289 2 2
ReadX 6906 291 2 2
ReadX 6906 293 2 2
Close 6906
ReadX 6902 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6902
Close 6903
Close 6904
Close 6905
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 6891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6907
Close 6907
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6908
ReadX 6908 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6909
ReadX 6909 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6910
ReadX 6910 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6911
ReadX 6911 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6912
ReadX 6912 0 53 53
ReadX 6912 53 28 28
ReadX 6912 81 28 28
ReadX 6912 109 28 28
ReadX 6912 137 28 28
ReadX 6912 165 28 28
ReadX 6912 193 28 28
ReadX 6912 221 28 28
ReadX 6912 249 4 4
ReadX 6912 253 4 4
ReadX 6912 257 4 4
ReadX 6912 261 28 28
ReadX 6912 289 2 2
ReadX 6912 291 2 2
ReadX 6912 293 2 2
Close 6912
ReadX 6908 2048 2048 2048
Close 6908
Close 6909
Close 6910
Close 6911
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6913
ReadX 6913 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6914
ReadX 6914 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6915
ReadX 6915 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6916
ReadX 6916 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6917
ReadX 6917 0 53 53
ReadX 6917 53 28 28
ReadX 6917 81 28 28
ReadX 6917 109 28 28
ReadX 6917 137 28 28
ReadX 6917 165 28 28
ReadX 6917 193 28 28
ReadX 6917 221 28 28
ReadX 6917 249 4 4
ReadX 6917 253 4 4
ReadX 6917 257 4 4
ReadX 6917 261 28 28
ReadX 6917 289 2 2
ReadX 6917 291 2 2
ReadX 6917 293 2 2
Close 6917
ReadX 6913 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 6921
FIND_FIRST \clients\client1\~dmtmp\*
Close 6921
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6922
QUERY_FILE_INFORMATION 6922
WriteX 6922 2047 1 1
QUERY_FILE_INFORMATION 6922
WriteX 6922 0 2048 2048
Close 6922
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6923
ReadX 6923 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 6923
Close 6913
Close 6914
Close 6915
Close 6916
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6924
ReadX 6924 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 6924 4095 1 1
QUERY_FILE_INFORMATION 6924
WriteX 6924 2048 2048 2048
QUERY_FILE_INFORMATION 6924
Flush 6924
WriteX 6924 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6925
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6925 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6926
ReadX 6926 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6927
ReadX 6927 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6928
ReadX 6928 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6929
ReadX 6929 0 53 53
ReadX 6929 53 28 28
ReadX 6929 81 28 28
ReadX 6929 109 28 28
ReadX 6929 137 28 28
ReadX 6929 165 28 28
ReadX 6929 193 28 28
ReadX 6929 221 28 28
ReadX 6929 249 4 4
ReadX 6929 253 4 4
ReadX 6929 257 4 4
ReadX 6929 261 28 28
ReadX 6929 289 2 2
ReadX 6929 291 2 2
ReadX 6929 293 2 2
Close 6929
ReadX 6925 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 6933
FIND_FIRST \clients\client1\~dmtmp\*
Close 6933
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6934
QUERY_FILE_INFORMATION 6934
WriteX 6934 2047 1 1
QUERY_FILE_INFORMATION 6934
WriteX 6934 0 2048 2048
Close 6934
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6935
ReadX 6935 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 6939
Close 6939
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6940
QUERY_FILE_INFORMATION 6940
WriteX 6940 2047 1 1
QUERY_FILE_INFORMATION 6940
WriteX 6940 0 2048 2048
Close 6940
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6941
ReadX 6941 0 511 511
ReadX 6925 384 2048 2048
ReadX 6925 768 16384 16384
ReadX 6925 1792 14336 14336
Close 6941
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6942
ReadX 6942 0 511 511
Close 6942
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 6944
Close 6944
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 6935 4095 1 1
QUERY_FILE_INFORMATION 6935
WriteX 6935 2048 2048 2048
WriteX 6935 0 88 88
Close 6935
WriteX 6925 1152 2048 2048
WriteX 6925 1408 6144 6144
WriteX 6925 1920 2048 2048
WriteX 6925 0 88 88
Close 6925
WriteX 6926 0 88 88
Close 6926
WriteX 6927 0 88 88
Close 6927
Close 6928
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6945
ReadX 6945 0 511 511
ReadX 6945 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 6945
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6946
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6946 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6947
ReadX 6947 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 6948
ReadX 6948 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6949
ReadX 6949 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 6950
ReadX 6950 0 53 53
ReadX 6950 53 28 28
ReadX 6950 81 28 28
ReadX 6950 109 28 28
ReadX 6950 137 28 28
ReadX 6950 165 28 28
ReadX 6950 193 28 28
ReadX 6950 221 28 28
ReadX 6950 249 4 4
ReadX 6950 253 4 4
ReadX 6950 257 4 4
ReadX 6950 261 28 28
ReadX 6950 289 2 2
ReadX 6950 291 2 2
ReadX 6950 293 2 2
Close 6950
ReadX 6946 2048 2048 2048
Close 6946
Close 6947
Close 6948
Close 6949
Close 6924
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 6951
QUERY_FILE_INFORMATION 6951
Close 6951
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6952
Close 6952
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6953
ReadX 6953 0 511 511
ReadX 6953 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6954
ReadX 6954 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6955
ReadX 6955 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6956
ReadX 6956 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6957
ReadX 6957 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6958
ReadX 6958 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6959
ReadX 6959 0 53 53
ReadX 6959 53 2 2
ReadX 6959 55 2 2
ReadX 6959 57 184 184
ReadX 6959 241 298 298
Close 6959
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6960
ReadX 6960 0 41 41
ReadX 6953 2048 2048 2048
Close 6960
Close 6953
Close 6954
Close 6957
Close 6958
Close 6955
Close 6956
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6961
ReadX 6961 0 511 511
ReadX 6961 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6962
ReadX 6962 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6963
ReadX 6963 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6964
ReadX 6964 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6965
ReadX 6965 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6966
ReadX 6966 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6967
ReadX 6967 0 53 53
ReadX 6967 53 2 2
ReadX 6967 55 2 2
ReadX 6967 57 184 184
ReadX 6967 241 298 298
Close 6967
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6968
ReadX 6968 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6969
ReadX 6969 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6970
ReadX 6970 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6971
ReadX 6971 0 511 511
ReadX 6970 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6972
ReadX 6972 0 53 53
ReadX 6972 53 2 2
ReadX 6972 55 480 480
ReadX 6972 535 2 2
Close 6972
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6973
ReadX 6973 0 41 41
ReadX 6961 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 6977
FIND_FIRST \clients\client1\~dmtmp\*
Close 6977
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 6978
QUERY_FILE_INFORMATION 6978
WriteX 6978 2047 1 1
QUERY_FILE_INFORMATION 6978
WriteX 6978 0 2048 2048
Close 6978
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 6979
ReadX 6979 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 6979
Close 6968
Close 6969
Close 6970
Close 6971
Close 6973
Close 6961
Close 6962
Close 6965
Close 6966
Close 6963
Close 6964
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 6980
ReadX 6980 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6981
Close 6981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6982
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6982 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6983
ReadX 6983 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6984
ReadX 6984 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6985
ReadX 6985 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6986
ReadX 6986 0 53 53
ReadX 6986 53 2 2
ReadX 6986 55 480 480
ReadX 6986 535 2 2
Close 6986
ReadX 6982 2048 2048 2048
Close 6982
Close 6983
Close 6984
Close 6985
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6987
ReadX 6987 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6988
ReadX 6988 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 6989
ReadX 6989 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 6990
ReadX 6990 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 6991
ReadX 6991 0 53 53
ReadX 6991 53 2 2
ReadX 6991 55 480 480
ReadX 6991 535 2 2
Close 6991
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6992
ReadX 6992 0 511 511
ReadX 6992 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 6993
ReadX 6993 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 6994
ReadX 6994 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 6995
ReadX 6995 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 6996
ReadX 6996 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 6997
ReadX 6997 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6998
ReadX 6998 0 41 41
ReadX 6992 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 6999
ReadX 6999 0 53 53
ReadX 6999 53 2 2
ReadX 6999 55 2 2
ReadX 6999 57 184 184
ReadX 6999 241 298 298
Close 6999
ReadX 6987 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 7003
FIND_FIRST \clients\client1\~dmtmp\*
Close 7003
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7004
QUERY_FILE_INFORMATION 7004
WriteX 7004 2047 1 1
QUERY_FILE_INFORMATION 7004
WriteX 7004 0 2048 2048
Close 7004
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7005
ReadX 7005 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 7005
Close 6998
Close 6992
Close 6993
Close 6996
Close 6997
Close 6994
Close 6995
Close 6987
Close 6988
Close 6989
Close 6990
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7006
ReadX 7006 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 6980 4095 1 1
QUERY_FILE_INFORMATION 6980
WriteX 6980 2048 2048 2048
QUERY_FILE_INFORMATION 6980
Flush 6980
WriteX 6980 0 88 88
WriteX 7006 4095 1 1
QUERY_FILE_INFORMATION 7006
WriteX 7006 2048 2048 2048
QUERY_FILE_INFORMATION 7006
Flush 7006
WriteX 7006 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7007
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7007 0 511 511
ReadX 7007 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7008
ReadX 7008 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7009
ReadX 7009 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7010
ReadX 7010 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7011
ReadX 7011 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7012
ReadX 7012 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7013
ReadX 7013 0 53 53
ReadX 7013 53 2 2
ReadX 7013 55 2 2
ReadX 7013 57 184 184
ReadX 7013 241 298 298
Close 7013
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7014
ReadX 7014 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7015
ReadX 7015 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7016
ReadX 7016 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7017
ReadX 7017 0 511 511
ReadX 7016 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7018
ReadX 7018 0 53 53
ReadX 7018 53 2 2
ReadX 7018 55 480 480
ReadX 7018 535 2 2
Close 7018
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7019
ReadX 7019 0 41 41
ReadX 7007 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7020
ReadX 7020 0 53 53
ReadX 7020 53 2 2
ReadX 7020 55 480 480
ReadX 7020 535 2 2
Close 7020
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7021
ReadX 7021 0 53 53
ReadX 7021 53 2 2
ReadX 7021 55 2 2
ReadX 7021 57 184 184
ReadX 7021 241 298 298
Close 7021
ReadX 7014 2048 2048 2048
ReadX 7015 2048 2048 2048
ReadX 7014 320 16384 16384
ReadX 7014 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 7022
FIND_FIRST \clients\client1\~dmtmp\*
Close 7022
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 7023
QUERY_FILE_INFORMATION 7023
WriteX 7023 4095 1 1
QUERY_FILE_INFORMATION 7023
WriteX 7023 0 4096 4096
Close 7023
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 7024
ReadX 7024 0 41 41
Close 7014
Close 7015
Close 7016
Close 7017
Close 7019
Close 7007
Close 7008
Close 7011
Close 7012
Close 7009
Close 7010
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 7025
Close 7025
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 7026
QUERY_FILE_INFORMATION 7026
WriteX 7026 4095 1 1
QUERY_FILE_INFORMATION 7026
WriteX 7026 0 4096 4096
Close 7026
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 7027
ReadX 7027 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 7024
ReadX 7024 0 4096 4096
WriteX 7027 0 4096 4096
Close 7027
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 7029
ReadX 7029 0 41 41
Close 7024
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 7029
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 7030
Close 7030
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 7031
ReadX 7031 0 41 41
Close 7031
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 7032
Close 7032
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7033
QUERY_FILE_INFORMATION 7033
WriteX 7033 2047 1 1
QUERY_FILE_INFORMATION 7033
WriteX 7033 0 2048 2048
Close 7033
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7034
ReadX 7034 0 511 511
ReadX 7034 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 7035
ReadX 7035 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7035
Close 7034
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7036
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7036 0 511 511
ReadX 7036 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7037
ReadX 7037 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7038
ReadX 7038 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7039
ReadX 7039 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7040
ReadX 7040 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7041
ReadX 7041 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7042
ReadX 7042 0 53 53
ReadX 7042 53 2 2
ReadX 7042 55 2 2
ReadX 7042 57 184 184
ReadX 7042 241 298 298
Close 7042
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7043
ReadX 7043 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7044
ReadX 7044 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7045
ReadX 7045 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7046
ReadX 7046 0 511 511
ReadX 7045 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7047
ReadX 7047 0 53 53
ReadX 7047 53 2 2
ReadX 7047 55 480 480
ReadX 7047 535 2 2
Close 7047
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7048
ReadX 7048 0 41 41
ReadX 7036 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7049
ReadX 7049 0 53 53
ReadX 7049 53 2 2
ReadX 7049 55 480 480
ReadX 7049 535 2 2
Close 7049
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7050
ReadX 7050 0 53 53
ReadX 7050 53 2 2
ReadX 7050 55 2 2
ReadX 7050 57 184 184
ReadX 7050 241 298 298
Close 7050
ReadX 7043 2048 2048 2048
Close 7043
Close 7044
Close 7045
Close 7046
Close 7048
Close 7036
Close 7037
Close 7040
Close 7041
Close 7038
Close 7039
Close 6980
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 7051
QUERY_FILE_INFORMATION 7051
Close 7051
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 7006
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7052
QUERY_FILE_INFORMATION 7052
Close 7052
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7053
Close 7053
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7054
ReadX 7054 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7055
ReadX 7055 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7056
ReadX 7056 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7057
ReadX 7057 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7058
ReadX 7058 0 53 53
ReadX 7058 53 2 2
ReadX 7058 55 480 480
ReadX 7058 535 2 2
Close 7058
ReadX 7054 2048 2048 2048
Close 7054
Close 7055
Close 7056
Close 7057
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7059
ReadX 7059 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7060
ReadX 7060 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7061
ReadX 7061 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7062
ReadX 7062 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7063
ReadX 7063 0 53 53
ReadX 7063 53 2 2
ReadX 7063 55 480 480
ReadX 7063 535 2 2
Close 7063
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7064
ReadX 7064 0 511 511
ReadX 7064 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7065
ReadX 7065 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7066
ReadX 7066 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7067
ReadX 7067 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7068
ReadX 7068 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7069
ReadX 7069 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7070
ReadX 7070 0 41 41
ReadX 7064 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7071
ReadX 7071 0 53 53
ReadX 7071 53 2 2
ReadX 7071 55 2 2
ReadX 7071 57 184 184
ReadX 7071 241 298 298
Close 7071
ReadX 7059 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 7075
FIND_FIRST \clients\client1\~dmtmp\*
Close 7075
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 7076
QUERY_FILE_INFORMATION 7076
WriteX 7076 2047 1 1
QUERY_FILE_INFORMATION 7076
WriteX 7076 0 2048 2048
Close 7076
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 7077
ReadX 7077 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 7077
Close 7070
Close 7064
Close 7065
Close 7068
Close 7069
Close 7066
Close 7067
Close 7059
Close 7060
Close 7061
Close 7062
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 7078
ReadX 7078 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7079
Close 7079
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7080
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7080 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7081
ReadX 7081 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7082
ReadX 7082 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7083
ReadX 7083 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7084
ReadX 7084 0 53 53
ReadX 7084 53 28 28
ReadX 7084 81 28 28
ReadX 7084 109 28 28
ReadX 7084 137 28 28
ReadX 7084 165 28 28
ReadX 7084 193 28 28
ReadX 7084 221 28 28
ReadX 7084 249 4 4
ReadX 7084 253 4 4
ReadX 7084 257 4 4
ReadX 7084 261 28 28
ReadX 7084 289 2 2
ReadX 7084 291 2 2
ReadX 7084 293 2 2
Close 7084
ReadX 7080 2048 2048 2048
Close 7080
Close 7081
Close 7082
Close 7083
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7085
ReadX 7085 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7086
ReadX 7086 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7087
ReadX 7087 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7088
ReadX 7088 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7089
ReadX 7089 0 53 53
ReadX 7089 53 28 28
ReadX 7089 81 28 28
ReadX 7089 109 28 28
ReadX 7089 137 28 28
ReadX 7089 165 28 28
ReadX 7089 193 28 28
ReadX 7089 221 28 28
ReadX 7089 249 4 4
ReadX 7089 253 4 4
ReadX 7089 257 4 4
ReadX 7089 261 28 28
ReadX 7089 289 2 2
ReadX 7089 291 2 2
ReadX 7089 293 2 2
Close 7089
ReadX 7085 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 7093
FIND_FIRST \clients\client1\~dmtmp\*
Close 7093
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 7094
QUERY_FILE_INFORMATION 7094
WriteX 7094 2047 1 1
QUERY_FILE_INFORMATION 7094
WriteX 7094 0 2048 2048
Close 7094
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 7095
ReadX 7095 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 7095
Close 7085
Close 7086
Close 7087
Close 7088
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 7096
ReadX 7096 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7097
Close 7097
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7098
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7098 0 511 511
ReadX 7098 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7099
ReadX 7099 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7100
ReadX 7100 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7101
ReadX 7101 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7102
ReadX 7102 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7103
ReadX 7103 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7104
ReadX 7104 0 53 53
ReadX 7104 53 2 2
ReadX 7104 55 2 2
ReadX 7104 57 184 184
ReadX 7104 241 298 298
Close 7104
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7105
ReadX 7105 0 41 41
ReadX 7098 2048 2048 2048
Close 7105
Close 7098
Close 7099
Close 7102
Close 7103
Close 7100
Close 7101
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7106
ReadX 7106 0 511 511
ReadX 7106 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7107
ReadX 7107 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7108
ReadX 7108 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7109
ReadX 7109 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7110
ReadX 7110 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7111
ReadX 7111 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7112
ReadX 7112 0 53 53
ReadX 7112 53 2 2
ReadX 7112 55 2 2
ReadX 7112 57 184 184
ReadX 7112 241 298 298
Close 7112
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7113
ReadX 7113 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7114
ReadX 7114 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7115
ReadX 7115 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7116
ReadX 7116 0 511 511
ReadX 7115 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7117
ReadX 7117 0 53 53
ReadX 7117 53 2 2
ReadX 7117 55 480 480
ReadX 7117 535 2 2
Close 7117
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7118
ReadX 7118 0 41 41
ReadX 7106 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 7122
FIND_FIRST \clients\client1\~dmtmp\*
Close 7122
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 7123
QUERY_FILE_INFORMATION 7123
WriteX 7123 2047 1 1
QUERY_FILE_INFORMATION 7123
WriteX 7123 0 2048 2048
Close 7123
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 7124
ReadX 7124 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 7124
Close 7113
Close 7114
Close 7115
Close 7116
Close 7118
Close 7106
Close 7107
Close 7110
Close 7111
Close 7108
Close 7109
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 7125
ReadX 7125 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 7078 4095 1 1
QUERY_FILE_INFORMATION 7078
WriteX 7078 2048 2048 2048
QUERY_FILE_INFORMATION 7078
Flush 7078
WriteX 7078 0 88 88
WriteX 7096 4095 1 1
QUERY_FILE_INFORMATION 7096
WriteX 7096 2048 2048 2048
QUERY_FILE_INFORMATION 7096
Flush 7096
WriteX 7096 0 88 88
WriteX 7125 4095 1 1
QUERY_FILE_INFORMATION 7125
WriteX 7125 2048 2048 2048
QUERY_FILE_INFORMATION 7125
Flush 7125
WriteX 7125 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7126
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7126 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7127
ReadX 7127 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7128
ReadX 7128 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7129
ReadX 7129 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7130
ReadX 7130 0 53 53
ReadX 7130 53 2 2
ReadX 7130 55 480 480
ReadX 7130 535 2 2
Close 7130
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7131
ReadX 7131 0 511 511
ReadX 7131 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7132
ReadX 7132 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7133
ReadX 7133 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7134
ReadX 7134 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7135
ReadX 7135 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7136
ReadX 7136 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7137
ReadX 7137 0 41 41
ReadX 7131 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7138
ReadX 7138 0 53 53
ReadX 7138 53 2 2
ReadX 7138 55 2 2
ReadX 7138 57 184 184
ReadX 7138 241 298 298
Close 7138
ReadX 7126 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7139
ReadX 7139 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7140
ReadX 7140 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7141
ReadX 7141 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7142
ReadX 7142 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7143
ReadX 7143 0 53 53
ReadX 7143 53 28 28
ReadX 7143 81 28 28
ReadX 7143 109 28 28
ReadX 7143 137 28 28
ReadX 7143 165 28 28
ReadX 7143 193 28 28
ReadX 7143 221 28 28
ReadX 7143 249 4 4
ReadX 7143 253 4 4
ReadX 7143 257 4 4
ReadX 7143 261 28 28
ReadX 7143 289 2 2
ReadX 7143 291 2 2
ReadX 7143 293 2 2
Close 7143
ReadX 7139 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7144
ReadX 7144 0 53 53
ReadX 7144 53 2 2
ReadX 7144 55 2 2
ReadX 7144 57 184 184
ReadX 7144 241 298 298
Close 7144
ReadX 7128 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7145
ReadX 7145 0 53 53
ReadX 7145 53 2 2
ReadX 7145 55 480 480
ReadX 7145 535 2 2
Close 7145
ReadX 7139 4096 16384 16384
ReadX 7139 1280 16384 16384
ReadX 7139 2304 6144 6144
ReadX 7139 2688 2048 2048
ReadX 7126 4096 16384 16384
ReadX 7126 1280 16384 16384
ReadX 7126 2304 16384 16384
ReadX 7126 3328 16384 16384
ReadX 7126 272 16384 16384
ReadX 7126 336 16384 16384
ReadX 7126 400 16384 16384
ReadX 7126 464 16384 16384
ReadX 7126 528 16384 16384
ReadX 7126 592 16384 16384
ReadX 7126 656 16384 16384
ReadX 7126 720 16384 16384
ReadX 7126 784 16384 16384
ReadX 7126 848 16384 16384
ReadX 7126 912 16384 16384
ReadX 7132 2048 2048 2048
ReadX 7131 760 2048 2048
ReadX 7131 1144 2048 2048
ReadX 7131 408 2048 2048
ReadX 7131 912 2048 2048
ReadX 7131 1096 2048 2048
ReadX 7131 776 2048 2048
ReadX 7131 560 2048 2048
ReadX 7131 376 2048 2048
ReadX 7131 320 2048 2048
ReadX 7131 3072 2048 2048
ReadX 7131 784 2048 2048
ReadX 7131 2176 2048 2048
ReadX 7131 792 2048 2048
ReadX 7131 576 2048 2048
ReadX 7131 600 2048 2048
ReadX 7131 728 2048 2048
ReadX 7131 1112 2048 2048
ReadX 7131 664 2048 2048
ReadX 7131 976 2048 2048
ReadX 7131 3840 2048 2048
ReadX 7131 296 2048 2048
ReadX 7131 480 2048 2048
ReadX 7131 680 2048 2048
ReadX 7131 696 2048 2048
ReadX 7131 832 2048 2048
ReadX 7131 1016 2048 2048
ReadX 7131 1104 2048 2048
ReadX 7131 3200 2048 2048
ReadX 7131 264 2048 2048
ReadX 7131 448 2048 2048
ReadX 7131 648 2048 2048
ReadX 7131 1136 2048 2048
ReadX 7131 288 2048 2048
ReadX 7131 352 2048 2048
ReadX 7131 536 2048 2048
ReadX 7131 800 2048 2048
ReadX 7131 736 2048 2048
ReadX 7131 392 2048 2048
ReadX 7131 752 2048 2048
ReadX 7131 880 2048 2048
ReadX 7131 1064 2048 2048
ReadX 7131 1128 2048 2048
ReadX 7131 1536 2048 2048
ReadX 7131 2432 2048 2048
ReadX 7131 688 2048 2048
ReadX 7131 872 2048 2048
ReadX 7131 1072 2048 2048
ReadX 7131 984 2048 2048
ReadX 7131 704 2048 2048
ReadX 7131 3328 2048 2048
ReadX 7131 888 2048 2048
ReadX 7131 496 2048 2048
ReadX 7131 624 2048 2048
ReadX 7131 808 2048 2048
ReadX 7131 1008 2048 2048
ReadX 7131 1152 2048 2048
ReadX 7131 416 2048 2048
ReadX 7131 584 2048 2048
ReadX 7131 384 2048 2048
ReadX 7131 568 2048 2048
ReadX 7131 512 2048 2048
ReadX 7131 1408 2048 2048
ReadX 7131 472 2048 2048
ReadX 7131 672 2048 2048
ReadX 7131 2560 2048 2048
ReadX 7131 544 2048 2048
ReadX 7131 920 2048 2048
ReadX 7131 1120 2048 2048
ReadX 7131 2304 2048 2048
ReadX 7131 1080 2048 2048
ReadX 7131 1664 2048 2048
ReadX 7131 608 2048 2048
ReadX 7131 2688 2048 2048
ReadX 7131 3712 2048 2048
ReadX 7131 616 2048 2048
ReadX 7131 632 2048 2048
ReadX 7131 944 2048 2048
ReadX 7131 856 2048 2048
ReadX 7131 768 2048 2048
ReadX 7131 720 2048 2048
ReadX 7131 640 2048 2048
ReadX 7131 1048 2048 2048
ReadX 7131 1040 2048 2048
ReadX 7131 1032 2048 2048
ReadX 7131 1000 2048 2048
ReadX 7131 992 2048 2048
ReadX 7131 968 2048 2048
ReadX 7131 952 2048 2048
ReadX 7131 1056 2048 2048
ReadX 7131 816 2048 2048
ReadX 7131 864 2048 2048
ReadX 7131 2816 2048 2048
ReadX 7131 640 2048 2048
ReadX 7131 1024 2048 2048
ReadX 7131 504 2048 2048
ReadX 7131 424 2048 2048
ReadX 7131 840 2048 2048
ReadX 7131 896 2048 2048
ReadX 7131 520 2048 2048
ReadX 7131 960 2048 2048
ReadX 7131 552 2048 2048
ReadX 7131 488 2048 2048
ReadX 7131 824 2048 2048
ReadX 7131 304 2048 2048
ReadX 7131 768 2048 2048
ReadX 7131 712 2048 2048
ReadX 7131 512 2048 2048
ReadX 7131 432 2048 2048
ReadX 7131 384 2048 2048
ReadX 7131 2944 2048 2048
ReadX 7131 1088 2048 2048
ReadX 7131 928 2048 2048
ReadX 7131 280 2048 2048
ReadX 7131 744 2048 2048
ReadX 7131 3968 2048 2048
ReadX 7131 336 2048 2048
ReadX 7131 592 2048 2048
ReadX 7131 312 2048 2048
ReadX 7131 400 2048 2048
ReadX 7131 904 2048 2048
ReadX 7131 464 2048 2048
ReadX 7131 3456 2048 2048
ReadX 7131 848 2048 2048
ReadX 7131 936 2048 2048
ReadX 7131 656 2048 2048
ReadX 7131 344 2048 2048
ReadX 7131 440 2048 2048
ReadX 7131 4096 2048 2048
ReadX 7131 528 2048 2048
ReadX 7131 2048 2048 2048
ReadX 7131 1024 2048 2048
ReadX 7131 456 2048 2048
ReadX 7131 1792 2048 2048
ReadX 7131 1152 2048 2048
ReadX 7131 3584 2048 2048
ReadX 7131 1920 2048 2048
ReadX 7131 1280 2048 2048
ReadX 7131 896 2048 2048
ReadX 7131 328 2048 2048
Close 7139
Close 7140
Close 7141
Close 7142
Close 7137
Close 7131
Close 7132
Close 7135
Close 7136
Close 7133
Close 7134
Close 7126
Close 7127
Close 7128
Close 7129
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7146
FIND_FIRST \clients\client1\~dmtmp\*
Close 7146
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7147
QUERY_FILE_INFORMATION 7147
WriteX 7147 0 2048 2048
WriteX 7147 18431 1 1
QUERY_FILE_INFORMATION 7147
WriteX 7147 2048 16384 16384
WriteX 7147 1152 16384 16384
WriteX 7147 2176 16384 16384
WriteX 7147 3200 16384 16384
WriteX 7147 264 16384 16384
WriteX 7147 328 16384 16384
WriteX 7147 392 16384 16384
WriteX 7147 456 16384 16384
WriteX 7147 520 16384 16384
WriteX 7147 584 16384 16384
WriteX 7147 648 16384 16384
WriteX 7147 712 16384 16384
WriteX 7147 776 16384 16384
WriteX 7147 840 16384 16384
WriteX 7147 904 16384 16384
WriteX 7147 968 16384 16384
WriteX 7147 1032 16384 16384
WriteX 7147 1096 16384 16384
WriteX 7147 1160 16384 16384
WriteX 7147 1224 16384 16384
WriteX 7147 1288 16384 16384
WriteX 7147 1352 16384 16384
WriteX 7147 1416 16384 16384
WriteX 7147 1480 16384 16384
WriteX 7147 1544 16384 16384
WriteX 7147 1608 16384 16384
WriteX 7147 1672 16384 16384
WriteX 7147 1736 16384 16384
WriteX 7147 1800 16384 16384
WriteX 7147 1864 16384 16384
WriteX 7147 1928 16384 16384
WriteX 7147 1992 16384 16384
WriteX 7147 2056 16384 16384
WriteX 7147 2120 16384 16384
WriteX 7147 2184 16384 16384
WriteX 7147 2248 16384 16384
WriteX 7147 2312 16384 16384
WriteX 7147 2376 16384 16384
WriteX 7147 2440 16384 16384
WriteX 7147 0 88 88
Close 7147
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7148
ReadX 7148 0 511 511
ReadX 7148 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7148
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7149
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7149 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7150
ReadX 7150 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7151
ReadX 7151 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7152
ReadX 7152 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7153
ReadX 7153 0 53 53
ReadX 7153 53 2 2
ReadX 7153 55 480 480
ReadX 7153 535 2 2
Close 7153
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7154
ReadX 7154 0 511 511
ReadX 7154 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7155
ReadX 7155 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7156
ReadX 7156 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7157
ReadX 7157 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7158
ReadX 7158 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7159
ReadX 7159 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7160
ReadX 7160 0 41 41
ReadX 7154 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7161
ReadX 7161 0 53 53
ReadX 7161 53 2 2
ReadX 7161 55 2 2
ReadX 7161 57 184 184
ReadX 7161 241 298 298
Close 7161
ReadX 7149 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7162
ReadX 7162 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7163
ReadX 7163 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7164
ReadX 7164 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7165
ReadX 7165 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7166
ReadX 7166 0 53 53
ReadX 7166 53 28 28
ReadX 7166 81 28 28
ReadX 7166 109 28 28
ReadX 7166 137 28 28
ReadX 7166 165 28 28
ReadX 7166 193 28 28
ReadX 7166 221 28 28
ReadX 7166 249 4 4
ReadX 7166 253 4 4
ReadX 7166 257 4 4
ReadX 7166 261 28 28
ReadX 7166 289 2 2
ReadX 7166 291 2 2
ReadX 7166 293 2 2
Close 7166
ReadX 7162 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7167
ReadX 7167 0 53 53
ReadX 7167 53 2 2
ReadX 7167 55 2 2
ReadX 7167 57 184 184
ReadX 7167 241 298 298
Close 7167
ReadX 7151 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7168
ReadX 7168 0 53 53
ReadX 7168 53 2 2
ReadX 7168 55 480 480
ReadX 7168 535 2 2
Close 7168
Close 7162
Close 7163
Close 7164
Close 7165
Close 7160
Close 7154
Close 7155
Close 7158
Close 7159
Close 7156
Close 7157
Close 7149
Close 7150
Close 7151
Close 7152
Close 7078
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 7169
QUERY_FILE_INFORMATION 7169
Close 7169
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 7096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 7170
QUERY_FILE_INFORMATION 7170
Close 7170
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 7125
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 7171
QUERY_FILE_INFORMATION 7171
Close 7171
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7172
Close 7172
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7173
ReadX 7173 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7174
ReadX 7174 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7175
ReadX 7175 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7176
ReadX 7176 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7177
ReadX 7177 0 53 53
ReadX 7177 53 28 28
ReadX 7177 81 28 28
ReadX 7177 109 28 28
ReadX 7177 137 28 28
ReadX 7177 165 28 28
ReadX 7177 193 28 28
ReadX 7177 221 28 28
ReadX 7177 249 4 4
ReadX 7177 253 4 4
ReadX 7177 257 4 4
ReadX 7177 261 28 28
ReadX 7177 289 2 2
ReadX 7177 291 2 2
ReadX 7177 293 2 2
Close 7177
ReadX 7173 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 7173 384 2048 2048
ReadX 7173 768 16384 16384
ReadX 7173 1792 14336 14336
ReadX 7176 2048 2048 2048
ReadX 7175 2048 2048 2048
WriteX 7173 1152 2048 2048
WriteX 7176 2048 2048 2048
WriteX 7175 2048 2048 2048
WriteX 7173 0 88 88
WriteX 7174 0 88 88
WriteX 7175 0 88 88
WriteX 7176 0 88 88
Close 7173
Close 7174
Close 7175
Close 7176
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7178
Close 7178
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7179
ReadX 7179 0 511 511
ReadX 7179 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7180
ReadX 7180 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7181
ReadX 7181 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7182
ReadX 7182 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7183
ReadX 7183 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7184
ReadX 7184 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7185
ReadX 7185 0 53 53
ReadX 7185 53 2 2
ReadX 7185 55 2 2
ReadX 7185 57 184 184
ReadX 7185 241 298 298
Close 7185
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7186
ReadX 7186 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7187
ReadX 7187 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7188
ReadX 7188 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7189
ReadX 7189 0 511 511
ReadX 7188 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7190
ReadX 7190 0 53 53
ReadX 7190 53 2 2
ReadX 7190 55 480 480
ReadX 7190 535 2 2
Close 7190
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7191
ReadX 7191 0 41 41
ReadX 7179 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 7192
QUERY_FILE_INFORMATION 7192
QUERY_FILE_INFORMATION 7192
ReadX 7192 0 8192 8192
Close 7192
ReadX 7179 1152 2048 2048
ReadX 7179 4096 16384 16384
Close 7186
Close 7187
Close 7188
Close 7189
Close 7191
Close 7179
Close 7180
Close 7183
Close 7184
Close 7181
Close 7182
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7193
Close 7193
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7194
QUERY_FILE_INFORMATION 7194
ReadX 7194 0 64 64
ReadX 7194 144 64 64
ReadX 7194 224 156 156
ReadX 7194 1193 128 128
ReadX 7194 1201 128 128
ReadX 7194 1072 4 4
ReadX 7194 1076 1925 1925
ReadX 7194 758 4 4
ReadX 7194 762 4557 4557
ReadX 7194 1052 4 4
ReadX 7194 1056 314 314
ReadX 7194 1056 11056 11056
Close 7194
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7195
ReadX 7195 0 511 511
ReadX 7195 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7196
ReadX 7196 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7197
ReadX 7197 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7198
ReadX 7198 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7199
ReadX 7199 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7200
ReadX 7200 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7201
ReadX 7201 0 53 53
ReadX 7201 53 2 2
ReadX 7201 55 2 2
ReadX 7201 57 184 184
ReadX 7201 241 298 298
Close 7201
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7202
ReadX 7202 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7203
ReadX 7203 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7204
ReadX 7204 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7205
ReadX 7205 0 511 511
ReadX 7204 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7206
ReadX 7206 0 53 53
ReadX 7206 53 2 2
ReadX 7206 55 480 480
ReadX 7206 535 2 2
Close 7206
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7207
ReadX 7207 0 41 41
ReadX 7195 2048 2048 2048
ReadX 7196 2048 2048 2048
ReadX 7195 1144 2048 2048
ReadX 7195 1152 2048 2048
ReadX 7195 4096 16384 16384
WriteX 7195 2048 2048 2048
WriteX 7196 2048 2048 2048
WriteX 7195 0 88 88
WriteX 7196 0 88 88
Close 7202
Close 7203
Close 7204
Close 7205
Close 7207
Close 7195
Close 7196
Close 7199
Close 7200
Close 7197
Close 7198
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 7208
Close 7208
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 7209
QUERY_FILE_INFORMATION 7209
ReadX 7209 0 64 64
ReadX 7209 144 64 64
ReadX 7209 224 84 84
ReadX 7209 478 16 16
ReadX 7209 1056 6176 6176
Close 7209
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7210
ReadX 7210 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7211
ReadX 7211 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7212
ReadX 7212 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7213
ReadX 7213 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7214
ReadX 7214 0 53 53
ReadX 7214 53 28 28
ReadX 7214 81 28 28
ReadX 7214 109 28 28
ReadX 7214 137 28 28
ReadX 7214 165 28 28
ReadX 7214 193 28 28
ReadX 7214 221 28 28
ReadX 7214 249 4 4
ReadX 7214 253 4 4
ReadX 7214 257 4 4
ReadX 7214 261 28 28
ReadX 7214 289 2 2
ReadX 7214 291 2 2
ReadX 7214 293 2 2
Close 7214
ReadX 7210 2048 2048 2048
ReadX 7211 2048 2048 2048
ReadX 7210 1280 2048 2048
ReadX 7213 2048 2048 2048
ReadX 7212 2048 2048 2048
WriteX 7210 1280 2048 2048
WriteX 7213 2048 2048 2048
WriteX 7212 2048 2048 2048
WriteX 7211 2048 2048 2048
WriteX 7210 0 88 88
WriteX 7211 0 88 88
WriteX 7212 0 88 88
WriteX 7213 0 88 88
WriteX 7210 1280 2048 2048
WriteX 7213 2048 2048 2048
WriteX 7212 2048 2048 2048
WriteX 7211 2048 2048 2048
WriteX 7210 0 88 88
WriteX 7211 0 88 88
WriteX 7212 0 88 88
WriteX 7213 0 88 88
WriteX 7210 1280 2048 2048
WriteX 7213 2048 2048 2048
WriteX 7212 2048 2048 2048
WriteX 7211 2048 2048 2048
WriteX 7210 0 88 88
WriteX 7211 0 88 88
WriteX 7212 0 88 88
WriteX 7213 0 88 88
Close 7210
Close 7211
Close 7212
Close 7213
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7215
ReadX 7215 0 511 511
ReadX 7215 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7216
ReadX 7216 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7217
ReadX 7217 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7218
ReadX 7218 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7219
ReadX 7219 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7220
ReadX 7220 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7221
ReadX 7221 0 53 53
ReadX 7221 53 2 2
ReadX 7221 55 2 2
ReadX 7221 57 184 184
ReadX 7221 241 298 298
Close 7221
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7222
ReadX 7222 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7223
ReadX 7223 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7224
ReadX 7224 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7225
ReadX 7225 0 511 511
ReadX 7224 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7226
ReadX 7226 0 53 53
ReadX 7226 53 2 2
ReadX 7226 55 480 480
ReadX 7226 535 2 2
Close 7226
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7227
ReadX 7227 0 41 41
ReadX 7215 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 7231
FIND_FIRST \clients\client1\~dmtmp\*
Close 7231
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 7232
QUERY_FILE_INFORMATION 7232
WriteX 7232 2047 1 1
QUERY_FILE_INFORMATION 7232
WriteX 7232 0 2048 2048
Close 7232
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 7233
ReadX 7233 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 7233 4095 1 1
QUERY_FILE_INFORMATION 7233
WriteX 7233 2048 2048 2048
WriteX 7233 0 88 88
Close 7233
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 7234
ReadX 7234 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 7234 2048 2048 2048
Close 7222
Close 7223
Close 7224
Close 7225
Close 7227
Close 7215
Close 7216
Close 7219
Close 7220
Close 7217
Close 7218
WriteX 7234 2048 2048 2048
WriteX 7234 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7235
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7235 0 511 511
ReadX 7235 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7236
ReadX 7236 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7237
ReadX 7237 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7238
ReadX 7238 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7239
ReadX 7239 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7240
ReadX 7240 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7241
ReadX 7241 0 53 53
ReadX 7241 53 2 2
ReadX 7241 55 2 2
ReadX 7241 57 184 184
ReadX 7241 241 298 298
Close 7241
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7242
ReadX 7242 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7243
ReadX 7243 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7244
ReadX 7244 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7245
ReadX 7245 0 511 511
ReadX 7244 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7246
ReadX 7246 0 53 53
ReadX 7246 53 2 2
ReadX 7246 55 480 480
ReadX 7246 535 2 2
Close 7246
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7247
ReadX 7247 0 41 41
ReadX 7235 2048 2048 2048
ReadX 7235 1152 2048 2048
ReadX 7235 4096 16384 16384
ReadX 7235 1280 16384 16384
ReadX 7235 2304 16384 16384
ReadX 7235 3328 16384 16384
ReadX 7235 272 16384 16384
ReadX 7235 336 16384 16384
ReadX 7235 400 16384 16384
ReadX 7235 464 16384 16384
ReadX 7235 528 16384 16384
ReadX 7235 592 16384 16384
ReadX 7235 656 16384 16384
ReadX 7235 720 16384 16384
ReadX 7235 784 16384 16384
ReadX 7235 848 16384 16384
ReadX 7235 912 16384 16384
ReadX 7235 976 16384 16384
ReadX 7235 1040 16384 16384
ReadX 7235 1104 12288 12288
Close 7242
Close 7243
Close 7244
Close 7245
Close 7247
Close 7235
Close 7236
Close 7239
Close 7240
Close 7237
Close 7238
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7248
FIND_FIRST \clients\client1\~dmtmp\*
Close 7248
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7249
QUERY_FILE_INFORMATION 7249
WriteX 7249 0 2048 2048
WriteX 7249 2048 4096 4096
WriteX 7249 0 88 88
Close 7249
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7250
ReadX 7250 0 511 511
ReadX 7250 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7250
WriteX 7234 2048 2048 2048
WriteX 7234 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7251
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7251 0 511 511
ReadX 7251 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7252
ReadX 7252 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7253
ReadX 7253 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7254
ReadX 7254 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7255
ReadX 7255 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7256
ReadX 7256 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7257
ReadX 7257 0 53 53
ReadX 7257 53 2 2
ReadX 7257 55 2 2
ReadX 7257 57 184 184
ReadX 7257 241 298 298
Close 7257
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7258
ReadX 7258 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7259
ReadX 7259 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7260
ReadX 7260 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7261
ReadX 7261 0 511 511
ReadX 7260 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7262
ReadX 7262 0 53 53
ReadX 7262 53 2 2
ReadX 7262 55 480 480
ReadX 7262 535 2 2
Close 7262
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7263
ReadX 7263 0 41 41
ReadX 7251 2048 2048 2048
ReadX 7251 1152 2048 2048
ReadX 7251 4096 16384 16384
ReadX 7251 1280 16384 16384
ReadX 7251 2304 16384 16384
ReadX 7251 3328 16384 16384
ReadX 7251 272 16384 16384
ReadX 7251 336 16384 16384
ReadX 7251 400 16384 16384
ReadX 7251 464 16384 16384
ReadX 7251 528 16384 16384
ReadX 7251 592 16384 16384
ReadX 7251 656 16384 16384
ReadX 7251 720 16384 16384
ReadX 7251 784 16384 16384
ReadX 7251 848 16384 16384
ReadX 7251 912 16384 16384
ReadX 7251 976 16384 16384
ReadX 7251 1040 16384 16384
ReadX 7251 1104 12288 12288
Close 7258
Close 7259
Close 7260
Close 7261
Close 7263
Close 7251
Close 7252
Close 7255
Close 7256
Close 7253
Close 7254
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7264
FIND_FIRST \clients\client1\~dmtmp\*
Close 7264
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7265
QUERY_FILE_INFORMATION 7265
WriteX 7265 0 2048 2048
WriteX 7265 2048 4096 4096
WriteX 7265 0 88 88
Close 7265
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7266
ReadX 7266 0 511 511
ReadX 7266 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7266
Close 7234
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 7267
QUERY_FILE_INFORMATION 7267
Close 7267
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7268
Close 7268
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7269
QUERY_FILE_INFORMATION 7269
ReadX 7269 0 64 64
ReadX 7269 144 64 64
ReadX 7269 224 156 156
ReadX 7269 1193 128 128
ReadX 7269 1201 128 128
ReadX 7269 1072 4 4
ReadX 7269 1076 1925 1925
ReadX 7269 758 4 4
ReadX 7269 762 4557 4557
ReadX 7269 1052 4 4
ReadX 7269 1056 314 314
ReadX 7269 1056 11056 11056
Close 7269
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7270
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7270 0 511 511
ReadX 7270 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7271
ReadX 7271 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7272
ReadX 7272 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7273
ReadX 7273 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7274
ReadX 7274 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7275
ReadX 7275 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7276
ReadX 7276 0 53 53
ReadX 7276 53 2 2
ReadX 7276 55 2 2
ReadX 7276 57 184 184
ReadX 7276 241 298 298
Close 7276
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7277
ReadX 7277 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7278
ReadX 7278 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7279
ReadX 7279 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7280
ReadX 7280 0 511 511
ReadX 7279 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7281
ReadX 7281 0 53 53
ReadX 7281 53 2 2
ReadX 7281 55 480 480
ReadX 7281 535 2 2
Close 7281
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7282
ReadX 7282 0 41 41
ReadX 7270 2048 2048 2048
ReadX 7270 1152 2048 2048
ReadX 7270 4096 16384 16384
Close 7277
Close 7278
Close 7279
Close 7280
Close 7282
Close 7270
Close 7271
Close 7274
Close 7275
Close 7272
Close 7273
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7283
ReadX 7283 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7284
ReadX 7284 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7285
ReadX 7285 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7286
ReadX 7286 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7287
ReadX 7287 0 53 53
ReadX 7287 53 2 2
ReadX 7287 55 480 480
ReadX 7287 535 2 2
Close 7287
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7288
ReadX 7288 0 511 511
ReadX 7288 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7289
ReadX 7289 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7290
ReadX 7290 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7291
ReadX 7291 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7292
ReadX 7292 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7293
ReadX 7293 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7294
ReadX 7294 0 41 41
ReadX 7288 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7295
ReadX 7295 0 53 53
ReadX 7295 53 2 2
ReadX 7295 55 2 2
ReadX 7295 57 184 184
ReadX 7295 241 298 298
Close 7295
ReadX 7283 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 7299
FIND_FIRST \clients\client1\~dmtmp\*
Close 7299
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 7300
QUERY_FILE_INFORMATION 7300
WriteX 7300 2047 1 1
QUERY_FILE_INFORMATION 7300
WriteX 7300 0 2048 2048
Close 7300
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 7301
ReadX 7301 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 7301 4095 1 1
QUERY_FILE_INFORMATION 7301
WriteX 7301 2048 2048 2048
WriteX 7301 0 88 88
Close 7301
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 7302
ReadX 7302 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 7302 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 7306
Close 7306
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 7307
QUERY_FILE_INFORMATION 7307
WriteX 7307 2047 1 1
QUERY_FILE_INFORMATION 7307
WriteX 7307 0 2048 2048
Close 7307
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 7308
ReadX 7308 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 7308 4095 1 1
QUERY_FILE_INFORMATION 7308
WriteX 7308 2048 2048 2048
WriteX 7308 0 88 88
Close 7308
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 7309
ReadX 7309 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 7309 2048 2048 2048
Close 7294
Close 7288
Close 7289
Close 7292
Close 7293
Close 7290
Close 7291
Close 7283
Close 7284
Close 7285
Close 7286
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7310
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7310 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7311
ReadX 7311 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7312
ReadX 7312 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7313
ReadX 7313 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7314
ReadX 7314 0 53 53
ReadX 7314 53 2 2
ReadX 7314 55 480 480
ReadX 7314 535 2 2
Close 7314
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7315
ReadX 7315 0 511 511
ReadX 7315 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7316
ReadX 7316 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7317
ReadX 7317 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7318
ReadX 7318 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7319
ReadX 7319 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7320
ReadX 7320 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7321
ReadX 7321 0 41 41
ReadX 7315 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7322
ReadX 7322 0 53 53
ReadX 7322 53 2 2
ReadX 7322 55 2 2
ReadX 7322 57 184 184
ReadX 7322 241 298 298
Close 7322
ReadX 7310 2048 2048 2048
ReadX 7310 384 16384 16384
ReadX 7310 1408 16384 16384
ReadX 7310 2560 16384 16384
ReadX 7310 3584 16384 16384
ReadX 7310 288 16384 16384
ReadX 7310 352 16384 16384
ReadX 7310 416 16384 16384
ReadX 7310 480 16384 16384
ReadX 7310 552 16384 16384
ReadX 7310 616 16384 16384
ReadX 7310 680 16384 16384
ReadX 7310 744 16384 16384
ReadX 7310 808 16384 16384
ReadX 7310 872 16384 16384
ReadX 7310 936 10240 10240
Close 7321
Close 7315
Close 7316
Close 7319
Close 7320
Close 7317
Close 7318
Close 7310
Close 7311
Close 7312
Close 7313
Close 7302
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 7323
QUERY_FILE_INFORMATION 7323
Close 7323
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 7309
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 7324
QUERY_FILE_INFORMATION 7324
Close 7324
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 7325
ReadX 7325 0 65471 65471
ReadX 7325 65471 63 63
ReadX 7325 65534 65471 65471
ReadX 7325 131005 63 63
ReadX 7325 131068 65471 65471
ReadX 7325 196539 63 63
ReadX 7325 196602 65471 65471
ReadX 7325 262073 63 63
ReadX 7325 262136 65471 65471
ReadX 7325 327607 63 63
ReadX 7325 327670 10 10
Close 7325
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 7326
ReadX 7326 0 65471 65471
ReadX 7326 65471 63 63
ReadX 7326 65534 65471 65471
ReadX 7326 131005 63 63
ReadX 7326 131068 65471 65471
ReadX 7326 196539 63 63
ReadX 7326 196602 65471 65471
ReadX 7326 262073 63 63
ReadX 7326 262136 65471 65471
ReadX 7326 327607 63 63
ReadX 7326 327670 65471 65471
ReadX 7326 393141 63 63
ReadX 7326 393204 65471 65471
ReadX 7326 458675 63 63
ReadX 7326 458738 65471 65471
ReadX 7326 524209 63 63
ReadX 7326 524272 65471 65471
ReadX 7326 589743 63 63
ReadX 7326 589806 65471 65471
ReadX 7326 655277 63 63
ReadX 7326 655340 32 32
Close 7326
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 7327
ReadX 7327 0 65471 65471
ReadX 7327 65471 63 63
ReadX 7327 65534 65471 65471
ReadX 7327 131005 63 63
ReadX 7327 131068 65471 65471
ReadX 7327 196539 63 63
ReadX 7327 196602 65471 65471
ReadX 7327 262073 63 63
ReadX 7327 262136 65471 65471
ReadX 7327 327607 63 63
ReadX 7327 327670 65471 65471
ReadX 7327 393141 63 63
ReadX 7327 393204 65471 65471
ReadX 7327 458675 63 63
ReadX 7327 458738 65471 65471
ReadX 7327 524209 63 63
ReadX 7327 524272 65471 65471
ReadX 7327 589743 63 63
ReadX 7327 589806 65471 65471
ReadX 7327 655277 63 63
ReadX 7327 655340 65471 65471
ReadX 7327 720811 63 63
ReadX 7327 720874 65471 65471
ReadX 7327 786345 63 63
ReadX 7327 786408 65471 65471
ReadX 7327 851879 63 63
ReadX 7327 851942 65471 65471
ReadX 7327 917413 63 63
ReadX 7327 917476 65471 65471
ReadX 7327 982947 63 63
ReadX 7327 983010 65471 65471
ReadX 7327 1048481 63 63
ReadX 7327 1048544 65471 65471
ReadX 7327 1114015 63 63
ReadX 7327 1114078 65471 65471
ReadX 7327 1179549 63 63
ReadX 7327 1179612 65471 65471
ReadX 7327 1245083 63 63
ReadX 7327 1245146 65471 65471
ReadX 7327 1310617 63 63
ReadX 7327 1310680 65471 65471
ReadX 7327 1376151 63 63
ReadX 7327 1376214 65471 65471
ReadX 7327 1441685 63 63
ReadX 7327 1441748 65471 65471
ReadX 7327 1507219 63 63
ReadX 7327 1507282 65471 65471
ReadX 7327 1572753 63 63
ReadX 7327 1572816 65471 65471
ReadX 7327 1638287 63 63
ReadX 7327 1638350 65471 65471
ReadX 7327 1703821 63 63
ReadX 7327 1703884 65471 65471
ReadX 7327 1769355 63 63
ReadX 7327 1769418 65471 65471
ReadX 7327 1834889 63 63
ReadX 7327 1834952 32824 32824
Close 7327
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 7328
QUERY_FILE_INFORMATION 7328
ReadX 7328 0 512 512
ReadX 7328 512 512 512
ReadX 7328 1024 512 512
QUERY_FILE_INFORMATION 7328
QUERY_FILE_INFORMATION 7328
ReadX 7328 2560 2048 2048
ReadX 7328 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 7329
WriteX 7329 52 1 1
QUERY_FILE_INFORMATION 7329
WriteX 7329 0 53 53
Close 7329
ReadX 7328 2208 650 650
ReadX 7328 1920 2048 2048
ReadX 7328 2112 2048 2048
ReadX 7328 1856 2048 2048
ReadX 7328 1824 2048 2048
ReadX 7328 1536 512 512
ReadX 7328 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 7330
Close 7330
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 7328 1568 512 512
ReadX 7328 1536 512 512
ReadX 7328 2176 384 384
ReadX 7328 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 7331
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 7328 288 2048 2048
ReadX 7328 2336 2048 2048
ReadX 7328 4384 2048 2048
ReadX 7328 6432 2048 2048
ReadX 7328 8480 2048 2048
ReadX 7328 10528 2048 2048
ReadX 7328 12576 2048 2048
WriteX 7331 15359 1 1
QUERY_FILE_INFORMATION 7331
ReadX 7328 14624 2048 2048
ReadX 7328 16672 2048 2048
ReadX 7328 18720 2048 2048
ReadX 7328 1728 2048 2048
WriteX 7331 0 15360 15360
Close 7331
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 7332
QUERY_FILE_INFORMATION 7332
ReadX 7332 0 512 512
ReadX 7332 2048 512 512
ReadX 7332 2560 512 512
QUERY_FILE_INFORMATION 7332
QUERY_FILE_INFORMATION 7332
QUERY_FILE_INFORMATION 7332
QUERY_FILE_INFORMATION 7332
QUERY_FILE_INFORMATION 7332
WriteX 7332 2152 384 384
QUERY_FILE_INFORMATION 7332
WriteX 7332 2150 22 22
WriteX 7332 2144 106 106
QUERY_FILE_INFORMATION 7332
WriteX 7332 2176 496 496
ReadX 7332 2176 496 496
QUERY_FILE_INFORMATION 7332
WriteX 7332 2440 384 384
QUERY_FILE_INFORMATION 7332
WriteX 7332 2152 384 384
WriteX 7332 2432 112 112
QUERY_FILE_INFORMATION 7332
WriteX 7332 2439 16 16
QUERY_FILE_INFORMATION 7332
WriteX 7332 2208 220 220
ReadX 7332 2208 220 220
QUERY_FILE_INFORMATION 7332
QUERY_FILE_INFORMATION 7332
WriteX 7332 2440 220 220
QUERY_FILE_INFORMATION 7332
WriteX 7332 2453 36 36
WriteX 7332 2080 512 512
WriteX 7332 2176 512 512
WriteX 7332 2112 512 512
WriteX 7332 2048 512 512
WriteX 7332 0 512 512
QUERY_FILE_INFORMATION 7328
QUERY_FILE_INFORMATION 7328
WriteX 7332 2080 512 512
Close 7332
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 7333
Close 7333
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 7334
QUERY_FILE_INFORMATION 7334
ReadX 7334 0 512 512
ReadX 7334 2048 512 512
ReadX 7334 2560 512 512
QUERY_FILE_INFORMATION 7334
QUERY_FILE_INFORMATION 7334
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 7335
Close 7335
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 7328
ReadX 7334 1408 512 512
ReadX 7334 2048 512 512
ReadX 7334 1536 512 512
ReadX 7334 2560 512 512
ReadX 7334 3072 512 512
ReadX 7334 3584 512 512
ReadX 7334 4096 512 512
ReadX 7334 4608 512 512
ReadX 7334 5120 512 512
ReadX 7334 5632 512 512
ReadX 7334 6144 512 512
ReadX 7334 6656 512 512
ReadX 7334 7168 512 512
ReadX 7334 7680 512 512
ReadX 7334 8192 512 512
ReadX 7334 8704 512 512
ReadX 7334 9216 512 512
ReadX 7334 9728 512 512
ReadX 7334 10240 512 512
ReadX 7334 10752 512 512
ReadX 7334 11264 512 512
ReadX 7334 11776 512 512
ReadX 7334 12288 512 512
ReadX 7334 12800 512 512
ReadX 7334 13312 512 512
ReadX 7334 13824 512 512
ReadX 7334 14336 512 512
ReadX 7334 14848 512 512
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 15360 512 0
ReadX 7334 2560 2048 2048
ReadX 7334 4608 2048 2048
ReadX 7334 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 7336
QUERY_FILE_INFORMATION 7336
ReadX 7336 0 512 512
ReadX 7336 512 512 512
ReadX 7336 1024 512 512
QUERY_FILE_INFORMATION 7336
QUERY_FILE_INFORMATION 7336
ReadX 7336 352 2048 2048
ReadX 7336 608 1097 1097
ReadX 7336 576 1609 1609
ReadX 7336 4096 512 512
ReadX 7336 1536 512 512
ReadX 7336 3840 256 256
ReadX 7336 288 576 576
ReadX 7336 512 512 512
ReadX 7336 480 512 512
ReadX 7336 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 7337
ReadX 7337 0 4096 4096
ReadX 7337 4096 4096 4096
ReadX 7337 8192 4096 4096
Close 7336
Close 7337
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 7338
WriteX 7338 15359 1 1
QUERY_FILE_INFORMATION 7338
WriteX 7338 0 15360 15360
Close 7338
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 7339
QUERY_FILE_INFORMATION 7339
ReadX 7339 0 512 512
ReadX 7339 2048 512 512
ReadX 7339 2560 512 512
QUERY_FILE_INFORMATION 7339
QUERY_FILE_INFORMATION 7339
QUERY_FILE_INFORMATION 7339
QUERY_FILE_INFORMATION 7339
QUERY_FILE_INFORMATION 7339
WriteX 7339 2152 384 384
QUERY_FILE_INFORMATION 7339
WriteX 7339 2150 22 22
WriteX 7339 2144 106 106
QUERY_FILE_INFORMATION 7339
WriteX 7339 2176 476 476
ReadX 7339 2176 476 476
QUERY_FILE_INFORMATION 7339
WriteX 7339 2440 384 384
QUERY_FILE_INFORMATION 7339
WriteX 7339 2152 384 384
WriteX 7339 2432 92 92
QUERY_FILE_INFORMATION 7339
WriteX 7339 2437 36 36
QUERY_FILE_INFORMATION 7339
WriteX 7339 2208 220 220
ReadX 7339 2208 220 220
QUERY_FILE_INFORMATION 7339
QUERY_FILE_INFORMATION 7339
WriteX 7339 2440 220 220
QUERY_FILE_INFORMATION 7339
WriteX 7339 2453 36 36
WriteX 7339 2080 512 512
WriteX 7339 2176 512 512
WriteX 7339 2112 512 512
WriteX 7339 2048 512 512
WriteX 7339 0 512 512
QUERY_FILE_INFORMATION 7334
QUERY_FILE_INFORMATION 7334
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 7334
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 7340
Close 7340
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 7341
QUERY_FILE_INFORMATION 7341
ReadX 7341 0 512 512
ReadX 7341 2048 512 512
ReadX 7341 2560 512 512
QUERY_FILE_INFORMATION 7341
QUERY_FILE_INFORMATION 7341
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 7342
Close 7342
WriteX 7339 2080 512 512
Close 7339
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 7343
Close 7343
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 7344
QUERY_FILE_INFORMATION 7344
ReadX 7344 0 512 512
ReadX 7344 2048 512 512
ReadX 7344 2560 512 512
QUERY_FILE_INFORMATION 7344
QUERY_FILE_INFORMATION 7344
ReadX 7344 1312 512 512
ReadX 7344 1536 512 512
ReadX 7344 2048 512 512
ReadX 7344 576 512 512
ReadX 7344 1088 512 512
ReadX 7344 1056 512 512
ReadX 7344 1120 512 512
ReadX 7344 1184 512 512
ReadX 7344 2560 2048 2048
ReadX 7344 4608 2048 2048
ReadX 7344 6656 2048 2048
ReadX 7344 8704 2048 2048
ReadX 7344 10752 2048 2048
ReadX 7344 12800 2048 2048
ReadX 7344 14848 2048 512
ReadX 7344 15360 1536 0
ReadX 7344 1088 2048 2048
ReadX 7344 3136 2048 2048
ReadX 7344 1665 5835 5835
ReadX 7344 1856 2048 2048
ReadX 7344 2112 512 512
ReadX 7344 2152 384 384
ReadX 7344 2432 92 92
ReadX 7344 2176 512 512
ReadX 7344 2440 220 220
QUERY_FILE_INFORMATION 7344
QUERY_FILE_INFORMATION 7344
ReadX 7344 2432 512 512
WriteX 7344 2272 512 512
ReadX 7344 2144 512 512
WriteX 7344 2304 512 512
WriteX 7344 2272 92 92
WriteX 7344 2208 512 512
WriteX 7344 2720 512 512
WriteX 7344 0 512 512
QUERY_FILE_INFORMATION 7344
QUERY_FILE_INFORMATION 7344
ReadX 7344 1312 4096 4096
ReadX 7344 5408 4096 4096
ReadX 7344 9504 3305 3305
ReadX 7344 512 4096 4096
QUERY_FILE_INFORMATION 7344
QUERY_FILE_INFORMATION 7344
QUERY_FILE_INFORMATION 7344
WriteX 7344 3132 50 50
WriteX 7344 3182 4096 4096
WriteX 7344 7278 4096 4096
WriteX 7344 15469 1 1
QUERY_FILE_INFORMATION 7344
WriteX 7344 11374 4096 4096
WriteX 7344 15470 3584 3584
WriteX 7344 2144 512 512
WriteX 7344 2336 4096 4096
WriteX 7344 6432 4096 4096
WriteX 7344 10528 4096 4096
WriteX 7344 14624 462 462
WriteX 7344 2048 512 512
WriteX 7344 2560 512 512
WriteX 7344 0 512 512
QUERY_FILE_INFORMATION 7344
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 7345
QUERY_FILE_INFORMATION 7345
ReadX 7345 0 512 512
ReadX 7345 1152 512 512
ReadX 7345 1664 512 512
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
ReadX 7345 512 2048 2048
ReadX 7345 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 7346
WriteX 7346 52 1 1
QUERY_FILE_INFORMATION 7346
WriteX 7346 0 53 53
Close 7346
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
ReadX 7345 1120 504 504
ReadX 7345 896 2048 2048
ReadX 7345 1056 1528 1528
ReadX 7345 864 2048 2048
ReadX 7345 832 2048 2048
ReadX 7345 736 2048 2048
ReadX 7345 1216 512 512
ReadX 7345 1256 384 384
ReadX 7345 1536 140 140
ReadX 7345 1280 512 512
ReadX 7345 1548 252 252
ReadX 7344 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 7347
Close 7347
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 7348
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 7345 2560 2048 2048
ReadX 7345 4608 2048 2048
ReadX 7345 6656 2048 2048
ReadX 7345 8704 2048 2048
ReadX 7345 10752 2048 2048
WriteX 7348 12005 1 1
QUERY_FILE_INFORMATION 7348
WriteX 7348 0 12006 12006
Close 7348
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 7349
QUERY_FILE_INFORMATION 7349
ReadX 7349 0 512 512
ReadX 7349 1152 512 512
ReadX 7349 1664 512 512
QUERY_FILE_INFORMATION 7349
QUERY_FILE_INFORMATION 7349
QUERY_FILE_INFORMATION 7349
QUERY_FILE_INFORMATION 7349
QUERY_FILE_INFORMATION 7349
QUERY_FILE_INFORMATION 7349
QUERY_FILE_INFORMATION 7349
WriteX 7349 1256 384 384
QUERY_FILE_INFORMATION 7349
WriteX 7349 1254 22 22
WriteX 7349 1248 106 106
QUERY_FILE_INFORMATION 7349
WriteX 7349 1280 508 508
ReadX 7349 1280 508 508
QUERY_FILE_INFORMATION 7349
WriteX 7349 1544 384 384
QUERY_FILE_INFORMATION 7349
WriteX 7349 1256 384 384
WriteX 7349 1536 124 124
QUERY_FILE_INFORMATION 7349
WriteX 7349 1543 4 4
QUERY_FILE_INFORMATION 7349
WriteX 7349 1312 252 252
ReadX 7349 1312 252 252
QUERY_FILE_INFORMATION 7349
QUERY_FILE_INFORMATION 7349
WriteX 7349 1544 252 252
QUERY_FILE_INFORMATION 7349
WriteX 7349 1559 4 4
WriteX 7349 1184 512 512
WriteX 7349 1280 512 512
WriteX 7349 1216 512 512
WriteX 7349 1152 512 512
WriteX 7349 0 512 512
QUERY_FILE_INFORMATION 7345
QUERY_FILE_INFORMATION 7345
WriteX 7349 1184 512 512
Close 7349
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 7350
Close 7350
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 7351
QUERY_FILE_INFORMATION 7351
ReadX 7351 0 512 512
ReadX 7351 1152 512 512
ReadX 7351 1664 512 512
QUERY_FILE_INFORMATION 7351
QUERY_FILE_INFORMATION 7351
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 7352
Close 7352
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 7345
ReadX 7351 736 512 512
ReadX 7351 1536 2048 2048
ReadX 7351 3584 2048 2048
ReadX 7351 5632 2048 2048
ReadX 7351 7680 2048 2048
ReadX 7351 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 7353
WriteX 7353 11990 1 1
QUERY_FILE_INFORMATION 7353
WriteX 7353 0 11991 11991
Close 7353
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 7354
QUERY_FILE_INFORMATION 7354
ReadX 7354 0 512 512
ReadX 7354 1184 512 512
ReadX 7354 1696 512 512
QUERY_FILE_INFORMATION 7354
QUERY_FILE_INFORMATION 7354
QUERY_FILE_INFORMATION 7354
QUERY_FILE_INFORMATION 7354
QUERY_FILE_INFORMATION 7354
QUERY_FILE_INFORMATION 7354
QUERY_FILE_INFORMATION 7354
WriteX 7354 1288 384 384
QUERY_FILE_INFORMATION 7354
WriteX 7354 1286 22 22
WriteX 7354 1280 106 106
QUERY_FILE_INFORMATION 7354
WriteX 7354 1312 508 508
ReadX 7354 1312 508 508
QUERY_FILE_INFORMATION 7354
WriteX 7354 1576 384 384
QUERY_FILE_INFORMATION 7354
WriteX 7354 1288 384 384
WriteX 7354 1568 124 124
QUERY_FILE_INFORMATION 7354
WriteX 7354 1575 4 4
QUERY_FILE_INFORMATION 7354
WriteX 7354 1344 252 252
ReadX 7354 1344 252 252
QUERY_FILE_INFORMATION 7354
QUERY_FILE_INFORMATION 7354
WriteX 7354 1576 252 252
QUERY_FILE_INFORMATION 7354
WriteX 7354 1591 4 4
WriteX 7354 1216 512 512
WriteX 7354 1312 512 512
WriteX 7354 1248 512 512
WriteX 7354 1184 512 512
WriteX 7354 0 512 512
QUERY_FILE_INFORMATION 7351
QUERY_FILE_INFORMATION 7351
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 7351
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 7355
Close 7355
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 7356
QUERY_FILE_INFORMATION 7356
ReadX 7356 0 512 512
ReadX 7356 1152 512 512
ReadX 7356 1664 512 512
QUERY_FILE_INFORMATION 7356
QUERY_FILE_INFORMATION 7356
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 7357
Close 7357
WriteX 7354 1216 512 512
Close 7354
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 7358
Close 7358
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 7359
QUERY_FILE_INFORMATION 7359
ReadX 7359 0 512 512
ReadX 7359 1184 512 512
ReadX 7359 1696 512 512
QUERY_FILE_INFORMATION 7359
QUERY_FILE_INFORMATION 7359
ReadX 7359 1536 512 512
ReadX 7359 736 512 512
ReadX 7359 2048 512 512
ReadX 7359 2560 512 512
ReadX 7359 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 7360
Close 7360
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 7359 914 3899 3899
ReadX 7359 1248 512 512
ReadX 7359 1288 384 384
ReadX 7359 1568 124 124
ReadX 7359 1312 512 512
ReadX 7359 1576 252 252
QUERY_FILE_INFORMATION 7359
QUERY_FILE_INFORMATION 7359
ReadX 7359 1568 512 512
WriteX 7359 1408 512 512
ReadX 7359 1280 512 512
WriteX 7359 1440 512 512
WriteX 7359 1408 124 124
WriteX 7359 1344 512 512
WriteX 7359 1856 512 512
WriteX 7359 0 512 512
QUERY_FILE_INFORMATION 7359
QUERY_FILE_INFORMATION 7359
ReadX 7359 544 4096 4096
ReadX 7359 4640 4096 4096
ReadX 7359 8736 1637 1637
ReadX 7359 512 4096 4096
QUERY_FILE_INFORMATION 7359
QUERY_FILE_INFORMATION 7359
WriteX 7359 1280 512 512
WriteX 7359 1472 3584 3584
WriteX 7359 5056 4096 4096
WriteX 7359 13247 1 1
QUERY_FILE_INFORMATION 7359
WriteX 7359 9152 4096 4096
WriteX 7359 13248 1736 1736
WriteX 7359 1184 512 512
WriteX 7359 1696 512 512
WriteX 7359 0 512 512
QUERY_FILE_INFORMATION 7359
ReadX 7359 1632 1024 1024
ReadX 7359 288 1024 1024
ReadX 7359 1312 2048 2048
ReadX 7359 3360 1024 1024
ReadX 7359 1696 1024 1024
ReadX 7359 2720 512 512
ReadX 7359 3232 512 512
ReadX 7359 3744 512 512
ReadX 7359 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 7359 2066 3998 3998
ReadX 7359 1448 384 384
ReadX 7359 1408 124 124
ReadX 7359 1416 252 252
QUERY_FILE_INFORMATION 7359
QUERY_FILE_INFORMATION 7359
ReadX 7359 1408 512 512
WriteX 7359 1536 512 512
ReadX 7359 1440 512 512
WriteX 7359 2048 512 512
WriteX 7359 1536 124 124
WriteX 7359 512 512 512
WriteX 7359 1024 512 512
WriteX 7359 0 512 512
QUERY_FILE_INFORMATION 7359
ReadX 7359 1696 4096 4096
ReadX 7359 5792 4096 4096
ReadX 7359 9888 1736 1736
ReadX 7359 1280 512 512
ReadX 7359 1472 3584 3584
QUERY_FILE_INFORMATION 7359
QUERY_FILE_INFORMATION 7359
WriteX 7359 3940 156 156
WriteX 7359 4096 512 512
WriteX 7359 544 3584 3584
WriteX 7359 4128 4096 4096
WriteX 7359 8224 3584 3584
WriteX 7359 1344 512 512
WriteX 7359 1856 1536 1536
WriteX 7359 2336 512 512
WriteX 7359 3584 356 356
WriteX 7359 2560 512 512
WriteX 7359 3072 512 512
WriteX 7359 0 512 512
QUERY_FILE_INFORMATION 7359
Close 7341
Close 7344
Close 7359
Close 7356
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 7361
Close 7361
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 7362
Close 7362
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 7363
WriteX 7363 0 65471 65471
WriteX 7363 65471 63 63
WriteX 7363 65534 65471 65471
WriteX 7363 131005 63 63
Close 7363
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 7364
WriteX 7364 0 65471 65471
WriteX 7364 65471 63 63
WriteX 7364 65534 65471 65471
WriteX 7364 131005 63 63
WriteX 7364 131068 65471 65471
WriteX 7364 196539 63 63
WriteX 7364 196602 65471 65471
WriteX 7364 262073 63 63
Close 7364
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 7365
WriteX 7365 0 65471 65471
WriteX 7365 65471 63 63
WriteX 7365 65534 65471 65471
WriteX 7365 131005 63 63
WriteX 7365 131068 65471 65471
WriteX 7365 196539 63 63
WriteX 7365 196602 65471 65471
WriteX 7365 262073 63 63
WriteX 7365 262136 65471 65471
WriteX 7365 327607 63 63
WriteX 7365 327670 65471 65471
WriteX 7365 393141 63 63
WriteX 7365 393204 65471 65471
WriteX 7365 458675 63 63
WriteX 7365 458738 65471 65471
WriteX 7365 524209 63 63
Close 7365
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 7366
QUERY_FILE_INFORMATION 7366
QUERY_FILE_INFORMATION 7366
ReadX 7366 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 7367
Close 7367
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 7368
WriteX 7368 63 1 1
QUERY_FILE_INFORMATION 7368
WriteX 7368 0 64 64
ReadX 7366 992 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 344 2048 2048
ReadX 7366 1344 2048 2048
ReadX 7366 1352 2048 2048
ReadX 7366 1320 2048 2048
ReadX 7366 1360 2048 2048
ReadX 7366 1344 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2304 2048 2048
ReadX 7366 1472 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 1480 2048 2048
ReadX 7366 1488 2048 2048
ReadX 7366 1496 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 1504 2048 2048
ReadX 7366 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 1000 2048 2048
ReadX 7366 1416 2048 2048
ReadX 7366 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 7366 360 2048 2048
ReadX 7366 368 2048 2048
ReadX 7366 360 2048 2048
ReadX 7366 376 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 1232 2048 2048
ReadX 7366 2432 6144 6144
ReadX 7366 2376 2048 2048
ReadX 7366 2360 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 2376 2048 2048
ReadX 7366 2384 2048 2048
ReadX 7366 2368 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 1296 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 7366 0 2048 2048
ReadX 7366 2688 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 2688 2048 2048
WriteX 7366 2688 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 2688 2048 2048
ReadX 7366 2688 2048 2048
ReadX 7366 2688 2048 2048
WriteX 7366 2688 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 7366 2688 2048 2048
ReadX 7366 2688 2048 2048
WriteX 7366 2688 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 320 4096 4096
ReadX 7366 0 2048 2048
ReadX 7366 3584 2048 2048
ReadX 7366 3584 2048 2048
ReadX 7366 3584 2048 2048
ReadX 7366 0 2048 2048
WriteX 7366 3584 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2688 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 2688 2048 2048
ReadX 7366 2688 2048 2048
WriteX 7366 2688 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 3200 2048 2048
ReadX 7366 3200 2048 2048
ReadX 7366 3200 2048 2048
WriteX 7366 3200 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 3456 2048 2048
ReadX 7366 3456 2048 2048
ReadX 7366 3456 2048 2048
WriteX 7366 3456 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2496 2048 2048
ReadX 7366 2472 2048 2048
ReadX 7366 2456 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 2472 2048 2048
ReadX 7366 2480 2048 2048
ReadX 7366 2464 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 2488 2048 2048
ReadX 7366 2568 8192 8192
ReadX 7366 1000 2048 2048
ReadX 7366 328 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 2048 2048 2048
ReadX 7366 2560 2048 2048
ReadX 7366 920 2048 2048
WriteX 7366 2048 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 312 2048 2048
WriteX 7366 336 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 328 2048 2048
WriteX 7366 2560 2048 2048
WriteX 7366 3840 2048 2048
WriteX 7366 920 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2432 2048 2048
WriteX 7366 2432 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2456 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 328 2048 2048
ReadX 7366 2560 2048 2048
ReadX 7366 2048 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 336 2048 2048
ReadX 7366 920 2048 2048
WriteX 7366 1536 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 2048 2048 2048
WriteX 7366 2560 2048 2048
WriteX 7366 336 2048 2048
WriteX 7366 920 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2048 2048 2048
ReadX 7366 2432 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 2048 2048 2048
WriteX 7366 2432 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2456 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1536 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 336 2048 2048
ReadX 7366 920 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 1536 2048 2048
WriteX 7366 336 2048 2048
WriteX 7366 920 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2432 2048 2048
WriteX 7366 2432 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2456 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1536 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 336 2048 2048
ReadX 7366 920 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 1536 2048 2048
WriteX 7366 336 2048 2048
WriteX 7366 920 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2432 2048 2048
WriteX 7366 2432 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2456 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1536 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 336 2048 2048
ReadX 7366 920 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 1536 2048 2048
WriteX 7366 336 2048 2048
WriteX 7366 920 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2432 2048 2048
WriteX 7366 2432 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2456 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1536 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 336 2048 2048
ReadX 7366 920 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 1536 2048 2048
WriteX 7366 336 2048 2048
WriteX 7366 920 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2432 2048 2048
WriteX 7366 2432 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
Flush 7366
ReadX 7366 2456 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1536 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 336 2048 2048
ReadX 7366 920 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 1536 2048 2048
WriteX 7366 336 2048 2048
WriteX 7366 920 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2432 2048 2048
WriteX 7366 2432 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2624 6144 6144
ReadX 7366 2616 2048 2048
ReadX 7366 2688 2048 2048
ReadX 7366 2600 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 2616 2048 2048
ReadX 7366 2608 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 344 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 520 2048 2048
ReadX 7366 1392 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 400 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 536 2048 2048
ReadX 7366 824 2048 2048
ReadX 7366 832 2048 2048
ReadX 7366 384 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 408 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 552 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 824 2048 2048
ReadX 7366 840 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 768 2048 2048
ReadX 7366 2048 2048 2048
WriteX 7366 1415 1 1
WriteX 7366 352 2048 2048
WriteX 7366 1112 2048 2048
WriteX 7366 1400 2048 2048
WriteX 7366 1408 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 2048 2048 2048
WriteX 7366 768 2048 2048
WriteX 7366 344 2048 2048
WriteX 7366 1000 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 416 2048 2048
ReadX 7366 424 2048 2048
ReadX 7366 432 2048 2048
ReadX 7366 440 2048 2048
ReadX 7366 576 16384 16384
ReadX 7366 448 2048 2048
ReadX 7366 456 2048 2048
ReadX 7366 464 2048 2048
ReadX 7366 640 16384 16384
ReadX 7366 704 16384 16384
ReadX 7366 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 7366 848 2048 2048
ReadX 7366 560 2048 2048
ReadX 7366 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 2600 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 352 2048 2048
ReadX 7366 1928 8192 8192
ReadX 7366 528 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 824 2048 2048
ReadX 7366 0 2048 2048
Flush 7366
ReadX 7366 2600 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 352 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 824 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 856 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 392 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 472 2048 2048
ReadX 7366 480 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 488 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 928 2048 2048
ReadX 7366 936 2048 2048
ReadX 7366 976 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 392 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 952 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 528 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 528 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 816 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 7366 1336 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 528 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 528 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1240 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2200 4096 4096
ReadX 7366 2152 2048 2048
ReadX 7366 2160 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1312 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 1928 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 824 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1416 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 352 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 824 2048 2048
ReadX 7366 384 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 7366 352 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 768 2048 2048
ReadX 7366 2048 2048 2048
ReadX 7366 352 2048 2048
WriteX 7366 1551 1 1
WriteX 7366 1512 2048 2048
WriteX 7366 1520 2048 2048
WriteX 7366 1528 2048 2048
WriteX 7366 1544 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 2048 2048 2048
WriteX 7366 768 2048 2048
WriteX 7366 344 2048 2048
WriteX 7366 1000 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2048 2048 2048
WriteX 7366 2048 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 1000 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1240 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 344 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 384 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 768 2048 2048
WriteX 7366 1567 1 1
WriteX 7366 1552 2048 2048
WriteX 7366 1560 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 768 2048 2048
WriteX 7366 344 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 1328 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1240 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2200 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1240 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 344 2048 2048
ReadX 7366 384 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 2048 2048 2048
ReadX 7366 768 2048 2048
WriteX 7366 1583 1 1
WriteX 7366 1568 2048 2048
WriteX 7366 1576 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 2048 2048 2048
WriteX 7366 768 2048 2048
WriteX 7366 344 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 864 2048 2048
ReadX 7366 872 2048 2048
ReadX 7366 912 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 2688 2048 2048
ReadX 7366 1000 2048 2048
WriteX 7366 2688 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 2944 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 0 2048 2048
Flush 7366
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 2688 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 2688 2048 2048
WriteX 7366 2688 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 392 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 416 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 416 2048 2048
ReadX 7366 864 2048 2048
ReadX 7366 872 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 312 2048 2048
ReadX 7366 888 2048 2048
ReadX 7366 400 2048 2048
ReadX 7366 896 2048 2048
WriteX 7366 1584 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 400 2048 2048
WriteX 7366 416 2048 2048
WriteX 7366 864 2048 2048
WriteX 7366 872 2048 2048
WriteX 7366 888 2048 2048
WriteX 7366 896 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 584 2048 2048
ReadX 7366 392 2048 2048
WriteX 7366 392 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 1328 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 0 2048 2048
ReadX 7366 408 2048 2048
ReadX 7366 1328 2048 2048
ReadX 7366 864 2048 2048
ReadX 7366 912 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 3840 2048 2048
ReadX 7366 312 2048 2048
ReadX 7366 1584 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 408 2048 2048
WriteX 7366 912 2048 2048
WriteX 7366 1584 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 408 2048 2048
ReadX 7366 392 2048 2048
WriteX 7366 392 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 528 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 528 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 552 2048 2048
ReadX 7366 1336 2048 2048
WriteX 7366 552 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 0 2048 2048
ReadX 7366 552 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 2664 2048 2048
ReadX 7366 2648 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 2672 2048 2048
ReadX 7366 2656 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7366 528 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 1336 2048 2048
ReadX 7366 2680 2048 2048
ReadX 7366 2760 8192 8192
ReadX 7366 544 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 568 2048 2048
ReadX 7366 544 2048 2048
ReadX 7366 0 2048 2048
Flush 7366
ReadX 7366 2816 6144 6144
ReadX 7366 2760 2048 2048
ReadX 7366 2744 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 2752 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 528 2048 2048
ReadX 7366 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 7370
Close 7370
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 7372
WriteX 7372 4065 1 1
QUERY_FILE_INFORMATION 7372
WriteX 7372 0 62591 62591
Close 7372
ReadX 7366 0 2048 2048
ReadX 7366 2808 2048 2048
ReadX 7366 2792 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 2800 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 384 2048 2048
ReadX 7366 392 2048 2048
ReadX 7366 1384 2048 2048
ReadX 7366 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 7374
Close 7374
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 7376
WriteX 7376 4094 1 1
QUERY_FILE_INFORMATION 7376
WriteX 7376 0 10845 10845
Close 7376
ReadX 7366 1432 2048 2048
ReadX 7366 1304 2048 2048
ReadX 7366 1368 2048 2048
ReadX 7366 2304 2048 2048
ReadX 7366 1440 2048 2048
ReadX 7366 1424 2048 2048
ReadX 7366 1448 2048 2048
ReadX 7366 1456 2048 2048
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 7378
Close 7378
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 7380
ReadX 7366 0 2048 2048
WriteX 7380 4081 1 1
QUERY_FILE_INFORMATION 7380
WriteX 7380 0 30118 30118
Close 7380
ReadX 7366 1344 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1152 2048 2048
ReadX 7366 1152 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 1000 2048 2048
ReadX 7366 768 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 344 2048 2048
WriteX 7366 1000 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 1416 2048 2048
ReadX 7366 1416 2048 2048
ReadX 7366 344 2048 2048
ReadX 7366 896 2048 2048
WriteX 7366 1538 2 2
WriteX 7366 344 2048 2048
WriteX 7366 1416 2048 2048
WriteX 7366 1538 2 2
ReadX 7366 2048 2048 2048
WriteX 7366 2048 2048 2048
WriteX 7366 1538 2 2
Close 7366
Close 7368
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 7381
ReadX 7381 0 65471 65471
ReadX 7381 65471 63 63
ReadX 7381 65534 65471 65471
ReadX 7381 131005 63 63
ReadX 7381 131068 65471 65471
ReadX 7381 196539 63 63
ReadX 7381 196602 65471 65471
ReadX 7381 262073 63 63
ReadX 7381 262136 65471 65471
ReadX 7381 327607 63 63
ReadX 7381 327670 10 10
Close 7381
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 7382
ReadX 7382 0 65471 65471
ReadX 7382 65471 63 63
ReadX 7382 65534 65471 65471
ReadX 7382 131005 63 63
ReadX 7382 131068 65471 65471
ReadX 7382 196539 63 63
ReadX 7382 196602 65471 65471
ReadX 7382 262073 63 63
ReadX 7382 262136 65471 65471
ReadX 7382 327607 63 63
ReadX 7382 327670 65471 65471
ReadX 7382 393141 63 63
ReadX 7382 393204 65471 65471
ReadX 7382 458675 63 63
ReadX 7382 458738 65471 65471
ReadX 7382 524209 63 63
ReadX 7382 524272 65471 65471
ReadX 7382 589743 63 63
ReadX 7382 589806 65471 65471
ReadX 7382 655277 63 63
ReadX 7382 655340 32 32
Close 7382
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 7383
ReadX 7383 0 65471 65471
ReadX 7383 65471 63 63
ReadX 7383 65534 65471 65471
ReadX 7383 131005 63 63
ReadX 7383 131068 65471 65471
ReadX 7383 196539 63 63
ReadX 7383 196602 65471 65471
ReadX 7383 262073 63 63
ReadX 7383 262136 65471 65471
ReadX 7383 327607 63 63
ReadX 7383 327670 65471 65471
ReadX 7383 393141 63 63
ReadX 7383 393204 65471 65471
ReadX 7383 458675 63 63
ReadX 7383 458738 65471 65471
ReadX 7383 524209 63 63
ReadX 7383 524272 65471 65471
ReadX 7383 589743 63 63
ReadX 7383 589806 65471 65471
ReadX 7383 655277 63 63
ReadX 7383 655340 65471 65471
ReadX 7383 720811 63 63
ReadX 7383 720874 65471 65471
ReadX 7383 786345 63 63
ReadX 7383 786408 65471 65471
ReadX 7383 851879 63 63
ReadX 7383 851942 65471 65471
ReadX 7383 917413 63 63
ReadX 7383 917476 65471 65471
ReadX 7383 982947 63 63
ReadX 7383 983010 65471 65471
ReadX 7383 1048481 63 63
ReadX 7383 1048544 65471 65471
ReadX 7383 1114015 63 63
ReadX 7383 1114078 65471 65471
ReadX 7383 1179549 63 63
ReadX 7383 1179612 65471 65471
ReadX 7383 1245083 63 63
ReadX 7383 1245146 65471 65471
ReadX 7383 1310617 63 63
ReadX 7383 1310680 65471 65471
ReadX 7383 1376151 63 63
ReadX 7383 1376214 65471 65471
ReadX 7383 1441685 63 63
ReadX 7383 1441748 65471 65471
ReadX 7383 1507219 63 63
ReadX 7383 1507282 65471 65471
ReadX 7383 1572753 63 63
ReadX 7383 1572816 65471 65471
ReadX 7383 1638287 63 63
ReadX 7383 1638350 65471 65471
ReadX 7383 1703821 63 63
ReadX 7383 1703884 65471 65471
ReadX 7383 1769355 63 63
ReadX 7383 1769418 65471 65471
ReadX 7383 1834889 63 63
ReadX 7383 1834952 32824 32824
Close 7383
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 7384
Close 7384
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 7385
ReadX 7385 0 24 24
Close 7385
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 7386
QUERY_FILE_INFORMATION 7386
ReadX 7386 0 512 512
ReadX 7386 464 512 512
ReadX 7386 498 512 512
ReadX 7386 472 512 512
ReadX 7386 466 512 512
ReadX 7386 978 512 512
ReadX 7386 497 57 57
Close 7386
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 7387
QUERY_FILE_INFORMATION 7387
ReadX 7387 0 512 512
ReadX 7387 464 512 512
ReadX 7387 498 512 512
ReadX 7387 472 512 512
ReadX 7387 462 512 512
ReadX 7387 468 512 512
ReadX 7387 466 512 512
QUERY_FILE_INFORMATION 7387
WriteX 7387 482 60 60
WriteX 7387 482 4 4
QUERY_FILE_INFORMATION 7387
WriteX 7387 482 11 11
ReadX 7387 497 57 57
ReadX 7387 497 57 57
ReadX 7387 368 4096 4096
ReadX 7387 460 512 512
ReadX 7387 512 4096 4096
ReadX 7387 4608 4096 4096
ReadX 7387 8704 4096 4096
ReadX 7387 12800 4096 4096
ReadX 7387 16896 4096 4096
ReadX 7387 20992 4096 4096
ReadX 7387 25088 4096 4096
ReadX 7387 29184 4096 4096
ReadX 7387 33280 4096 4096
ReadX 7387 37376 4096 4096
ReadX 7387 41472 4096 4096
ReadX 7387 45568 4096 4096
ReadX 7387 49664 4096 4096
ReadX 7387 53760 4096 4096
ReadX 7387 57856 4096 4096
ReadX 7387 61952 4096 4096
ReadX 7387 66048 4096 4096
ReadX 7387 70144 4096 4096
ReadX 7387 497 20 20
ReadX 7387 496 103 103
ReadX 7387 500 448 448
ReadX 7387 470 512 512
ReadX 7387 486 2692 2692
ReadX 7387 290 4096 4096
ReadX 7387 4386 4096 4096
ReadX 7387 8482 4096 4096
ReadX 7387 500 20 20
ReadX 7387 483 108 108
ReadX 7387 482 292 292
ReadX 7387 338 4096 4096
ReadX 7387 4434 3103 3103
ReadX 7387 384 28 28
ReadX 7387 412 20 20
ReadX 7387 432 8 8
ReadX 7387 440 136 136
ReadX 7387 576 8 8
ReadX 7387 584 4 4
ReadX 7387 588 4 4
ReadX 7387 592 39 39
ReadX 7387 384 4 4
ReadX 7387 388 4 4
ReadX 7387 392 23 23
ReadX 7387 385 4 4
ReadX 7387 389 4 4
ReadX 7387 393 12 12
ReadX 7387 405 4 4
ReadX 7387 409 4 4
ReadX 7387 413 1 1
ReadX 7387 385 4 4
ReadX 7387 389 4 4
ReadX 7387 393 1 1
ReadX 7387 385 4 4
ReadX 7387 389 4 4
ReadX 7387 393 12 12
ReadX 7387 405 4 4
ReadX 7387 409 4 4
ReadX 7387 413 2 2
ReadX 7387 385 4 4
ReadX 7387 389 4 4
ReadX 7387 393 25 25
ReadX 7387 385 4 4
ReadX 7387 389 8 8
ReadX 7387 397 4 4
ReadX 7387 401 8 8
ReadX 7387 409 4 4
ReadX 7387 413 8 8
ReadX 7387 421 4 4
ReadX 7387 425 8 8
ReadX 7387 433 4 4
ReadX 7387 437 4 4
ReadX 7387 441 4 4
ReadX 7387 445 4 4
ReadX 7387 449 4 4
ReadX 7387 453 4 4
ReadX 7387 457 4 4
ReadX 7387 461 4 4
ReadX 7387 465 10670 10670
ReadX 7387 428 4096 4096
WriteX 7387 498 512 512
WriteX 7387 472 512 512
WriteX 7387 462 512 512
WriteX 7387 468 512 512
Close 7387
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 7388
Close 7388
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 7389
QUERY_FILE_INFORMATION 7389
ReadX 7389 0 512 512
ReadX 7389 464 512 512
ReadX 7389 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 7390
Close 7390
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 7389
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 7392
WriteX 7392 4607 1 1
QUERY_FILE_INFORMATION 7392
WriteX 7392 0 65471 65471
WriteX 7392 65471 65 65
WriteX 7392 65536 19979 19979
Close 7392
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7393
QUERY_FILE_INFORMATION 7393
ReadX 7393 0 512 512
ReadX 7393 462 512 512
ReadX 7393 974 512 512
ReadX 7393 1486 512 512
ReadX 7393 460 512 512
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
WriteX 7393 470 448 448
QUERY_FILE_INFORMATION 7393
WriteX 7393 470 60 60
WriteX 7393 470 4 4
QUERY_FILE_INFORMATION 7393
WriteX 7393 470 11 11
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
WriteX 7393 464 512 512
WriteX 7393 976 512 512
WriteX 7393 1488 512 512
WriteX 7393 462 512 512
WriteX 7393 0 512 512
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
ReadX 7393 470 512 512
WriteX 7393 482 512 512
WriteX 7393 482 292 292
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
WriteX 7393 483 20 20
WriteX 7393 483 108 108
QUERY_FILE_INFORMATION 7393
WriteX 7393 484 448 448
QUERY_FILE_INFORMATION 7393
WriteX 7393 484 44 44
WriteX 7393 484 20 20
WriteX 7393 480 512 512
WriteX 7393 472 512 512
WriteX 7393 476 512 512
WriteX 7393 988 512 512
WriteX 7393 474 512 512
Flush 7393
WriteX 7393 0 512 512
Flush 7393
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
WriteX 7393 480 512 512
WriteX 7393 472 512 512
WriteX 7393 476 512 512
QUERY_FILE_INFORMATION 7393
WriteX 7393 496 320 320
QUERY_FILE_INFORMATION 7393
WriteX 7393 496 60 60
ReadX 7393 484 512 512
WriteX 7393 500 512 512
WriteX 7393 470 512 512
WriteX 7393 486 2692 2692
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
WriteX 7393 497 25 25
WriteX 7393 496 103 103
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
WriteX 7393 497 44 44
WriteX 7393 497 20 20
WriteX 7393 498 512 512
WriteX 7393 462 512 512
WriteX 7393 466 512 512
WriteX 7393 978 512 512
WriteX 7393 464 512 512
Flush 7393
WriteX 7393 0 512 512
Flush 7393
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
QUERY_FILE_INFORMATION 7393
WriteX 7393 497 7 7
WriteX 7393 497 57 57
WriteX 7393 498 512 512
WriteX 7393 472 512 512
WriteX 7393 462 512 512
WriteX 7393 466 512 512
WriteX 7393 978 512 512
Flush 7393
WriteX 7393 498 512 512
Flush 7393
Close 7393
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7394
QUERY_FILE_INFORMATION 7394
ReadX 7394 0 512 512
ReadX 7394 464 512 512
ReadX 7394 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 7395
ReadX 7395 0 20 20
ReadX 7395 14 40 40
ReadX 7395 54 64 64
ReadX 7395 118 1152 1152
Close 7395
Close 7394
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7396
Close 7396
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7397
ReadX 7397 0 24 24
Close 7397
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7398
QUERY_FILE_INFORMATION 7398
ReadX 7398 0 512 512
ReadX 7398 464 512 512
ReadX 7398 498 512 512
ReadX 7398 472 512 512
ReadX 7398 462 512 512
ReadX 7398 466 512 512
ReadX 7398 978 512 512
ReadX 7398 497 57 57
Close 7398
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7399
QUERY_FILE_INFORMATION 7399
ReadX 7399 0 512 512
ReadX 7399 464 512 512
ReadX 7399 498 512 512
ReadX 7399 472 512 512
ReadX 7399 468 512 512
ReadX 7399 462 512 512
ReadX 7399 466 512 512
QUERY_FILE_INFORMATION 7399
WriteX 7399 482 60 60
WriteX 7399 482 4 4
QUERY_FILE_INFORMATION 7399
WriteX 7399 482 11 11
WriteX 7399 498 512 512
WriteX 7399 472 512 512
WriteX 7399 462 512 512
WriteX 7399 466 512 512
WriteX 7399 978 512 512
Close 7399
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 7400
Close 7400
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 7401
Close 7401
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 7403
WriteX 7403 4607 1 1
QUERY_FILE_INFORMATION 7403
WriteX 7403 0 65471 65471
WriteX 7403 65471 65 65
WriteX 7403 65536 17654 17654
Close 7403
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7404
QUERY_FILE_INFORMATION 7404
ReadX 7404 0 512 512
ReadX 7404 474 512 512
ReadX 7404 986 512 512
ReadX 7404 1498 512 512
ReadX 7404 472 512 512
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
WriteX 7404 482 448 448
QUERY_FILE_INFORMATION 7404
WriteX 7404 482 60 60
WriteX 7404 482 4 4
QUERY_FILE_INFORMATION 7404
WriteX 7404 482 11 11
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
WriteX 7404 476 512 512
WriteX 7404 988 512 512
WriteX 7404 1500 512 512
WriteX 7404 474 512 512
WriteX 7404 0 512 512
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
ReadX 7404 482 512 512
WriteX 7404 494 512 512
WriteX 7404 494 292 292
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
WriteX 7404 495 20 20
WriteX 7404 495 108 108
QUERY_FILE_INFORMATION 7404
WriteX 7404 496 448 448
QUERY_FILE_INFORMATION 7404
WriteX 7404 496 44 44
WriteX 7404 496 20 20
WriteX 7404 492 512 512
WriteX 7404 484 512 512
WriteX 7404 488 512 512
WriteX 7404 1000 512 512
WriteX 7404 486 512 512
Flush 7404
WriteX 7404 0 512 512
Flush 7404
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
WriteX 7404 492 512 512
WriteX 7404 484 512 512
WriteX 7404 488 512 512
QUERY_FILE_INFORMATION 7404
WriteX 7404 508 320 320
QUERY_FILE_INFORMATION 7404
WriteX 7404 508 60 60
ReadX 7404 496 512 512
WriteX 7404 512 512 512
WriteX 7404 482 512 512
WriteX 7404 498 2692 2692
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
WriteX 7404 509 25 25
WriteX 7404 508 103 103
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
WriteX 7404 509 44 44
WriteX 7404 509 20 20
WriteX 7404 510 512 512
WriteX 7404 474 512 512
WriteX 7404 478 512 512
WriteX 7404 990 512 512
WriteX 7404 476 512 512
Flush 7404
WriteX 7404 0 512 512
Flush 7404
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
QUERY_FILE_INFORMATION 7404
WriteX 7404 509 7 7
WriteX 7404 509 57 57
WriteX 7404 510 512 512
WriteX 7404 484 512 512
WriteX 7404 474 512 512
WriteX 7404 478 512 512
WriteX 7404 990 512 512
Flush 7404
WriteX 7404 510 512 512
Flush 7404
Close 7404
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7405
Close 7405
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7406
QUERY_FILE_INFORMATION 7406
ReadX 7406 0 512 512
ReadX 7406 476 512 512
ReadX 7406 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 7407
Close 7407
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 7408
QUERY_FILE_INFORMATION 7408
ReadX 7408 0 512 512
ReadX 7408 512 512 512
ReadX 7408 770 512 512
ReadX 7408 1282 512 512
ReadX 7408 1794 512 512
ReadX 7408 2562 512 512
ReadX 7408 3586 512 512
ReadX 7408 3828 512 512
ReadX 7408 288 512 512
ReadX 7408 1024 512 512
ReadX 7408 954 512 512
ReadX 7408 295 512 512
ReadX 7408 320 512 512
ReadX 7408 322 512 512
ReadX 7408 834 512 512
ReadX 7408 1346 512 512
ReadX 7408 1858 512 512
ReadX 7408 323 512 512
ReadX 7408 835 512 512
ReadX 7408 1347 512 512
ReadX 7408 1859 512 512
ReadX 7408 2371 345 345
ReadX 7408 322 167 167
ReadX 7408 489 512 512
ReadX 7408 1001 512 512
ReadX 7408 1513 512 512
ReadX 7408 2025 512 512
ReadX 7408 2537 512 512
ReadX 7408 3049 512 512
ReadX 7408 3561 345 345
ReadX 7408 323 167 167
ReadX 7408 490 512 512
ReadX 7408 1002 512 512
ReadX 7408 1514 512 512
ReadX 7408 2026 512 512
ReadX 7408 2538 512 512
ReadX 7408 3050 512 512
ReadX 7408 3562 512 512
ReadX 7408 4074 512 512
ReadX 7408 4586 512 512
ReadX 7408 5098 512 512
ReadX 7408 5610 512 512
ReadX 7408 6122 512 512
ReadX 7408 6634 512 512
ReadX 7408 7146 512 512
ReadX 7408 7658 512 512
ReadX 7408 8170 512 512
ReadX 7408 8682 512 512
ReadX 7408 9194 512 512
ReadX 7408 9706 512 512
ReadX 7408 10218 512 512
ReadX 7408 10730 345 345
ReadX 7408 11075 512 512
ReadX 7408 11587 167 167
ReadX 7408 11754 512 512
ReadX 7408 12266 512 512
ReadX 7408 12778 512 512
ReadX 7408 13290 512 512
ReadX 7408 13802 512 512
ReadX 7408 14314 512 512
ReadX 7408 14826 512 512
ReadX 7408 15338 512 512
ReadX 7408 337 512 512
ReadX 7408 337 512 512
ReadX 7408 849 34 34
ReadX 7408 352 512 512
ReadX 7408 864 512 512
ReadX 7408 1376 512 512
ReadX 7408 1888 512 512
ReadX 7408 2400 512 512
ReadX 7408 2912 512 512
ReadX 7408 3424 512 512
ReadX 7408 3936 512 512
ReadX 7408 1632 512 512
ReadX 7408 2144 512 512
ReadX 7408 1682 512 512
ReadX 7408 258 512 512
ReadX 7408 360 144 144
ReadX 7408 2517 512 512
ReadX 7408 3029 512 512
ReadX 7408 1751 512 512
ReadX 7408 2263 512 512
ReadX 7408 2775 512 512
ReadX 7408 3287 512 512
ReadX 7408 3799 512 512
ReadX 7408 4311 512 512
ReadX 7408 4823 512 512
ReadX 7408 5335 512 512
ReadX 7408 5847 512 512
ReadX 7408 6359 512 512
ReadX 7408 6871 512 512
ReadX 7408 7383 512 512
ReadX 7408 7895 512 512
ReadX 7408 8407 512 512
ReadX 7408 8919 512 512
ReadX 7408 9431 512 512
ReadX 7408 9943 512 512
ReadX 7408 10455 512 512
ReadX 7408 10967 512 512
ReadX 7408 11479 512 512
ReadX 7408 2556 512 512
ReadX 7408 3068 512 512
ReadX 7408 3580 512 512
ReadX 7408 4092 512 512
ReadX 7408 4604 512 512
ReadX 7408 5116 512 512
ReadX 7408 5628 512 512
ReadX 7408 6140 512 512
ReadX 7408 6652 512 512
ReadX 7408 7164 512 512
ReadX 7408 7676 512 512
ReadX 7408 8188 512 512
ReadX 7408 8700 512 512
ReadX 7408 9212 512 512
ReadX 7408 9724 512 512
ReadX 7408 10236 512 512
ReadX 7408 10748 512 512
ReadX 7408 11260 512 512
ReadX 7408 11772 512 512
ReadX 7408 12284 512 512
ReadX 7408 12796 49 49
ReadX 7408 260 463 463
ReadX 7408 723 512 512
ReadX 7408 1235 512 512
ReadX 7408 1747 512 512
ReadX 7408 2259 512 512
ReadX 7408 2771 512 512
ReadX 7408 3283 512 512
ReadX 7408 3795 512 512
ReadX 7408 4307 512 512
ReadX 7408 4819 512 512
ReadX 7408 5331 512 512
ReadX 7408 5843 512 512
ReadX 7408 6355 512 512
ReadX 7408 6867 512 512
ReadX 7408 7379 512 512
ReadX 7408 7891 512 512
ReadX 7408 8403 512 512
ReadX 7408 8915 512 512
ReadX 7408 9427 512 512
ReadX 7408 9939 512 512
ReadX 7408 10451 512 512
ReadX 7408 10963 402 402
ReadX 7408 593 240 240
ReadX 7408 2048 272 272
ReadX 7408 2320 512 512
ReadX 7408 2832 512 512
ReadX 7408 3344 512 512
ReadX 7408 3856 512 512
ReadX 7408 4368 512 512
ReadX 7408 4880 512 512
ReadX 7408 5392 240 240
ReadX 7408 608 272 272
ReadX 7408 880 512 512
ReadX 7408 1392 512 512
ReadX 7408 1904 512 512
ReadX 7408 2416 512 512
ReadX 7408 2928 512 512
ReadX 7408 3440 512 512
ReadX 7408 3952 512 512
ReadX 7408 4464 512 512
ReadX 7408 4976 512 512
ReadX 7408 5488 512 512
ReadX 7408 6000 512 512
ReadX 7408 6512 512 512
ReadX 7408 7024 512 512
ReadX 7408 7536 512 512
ReadX 7408 8048 512 512
ReadX 7408 8560 512 512
ReadX 7408 9072 512 512
ReadX 7408 9584 512 512
ReadX 7408 10096 512 512
ReadX 7408 1683 512 512
ReadX 7408 514 512 512
ReadX 7408 620 512 512
ReadX 7408 770 512 512
ReadX 7408 1282 512 512
ReadX 7408 1794 512 512
ReadX 7408 2000 512 512
ReadX 7408 1434 512 512
ReadX 7408 2050 512 512
ReadX 7408 2118 512 512
ReadX 7408 1715 512 512
ReadX 7408 1024 512 512
ReadX 7408 954 512 512
ReadX 7408 1880 512 512
ReadX 7408 1286 512 512
ReadX 7408 1510 512 512
ReadX 7408 2562 512 512
ReadX 7408 2610 512 512
ReadX 7408 3586 512 512
ReadX 7408 3812 512 512
ReadX 7408 3828 512 512
ReadX 7408 4046 512 512
ReadX 7408 4066 512 512
ReadX 7408 1747 512 512
ReadX 7408 1026 512 512
ReadX 7408 1538 512 512
ReadX 7408 514 512 512
ReadX 7408 751 512 512
ReadX 7408 1263 512 512
ReadX 7408 620 512 512
ReadX 7408 1132 512 512
ReadX 7408 1644 512 512
ReadX 7408 2156 512 512
ReadX 7408 2668 512 512
ReadX 7408 3180 512 512
ReadX 7408 3692 512 512
ReadX 7408 4204 394 394
ReadX 7408 606 118 118
ReadX 7408 724 512 512
ReadX 7408 1236 512 512
ReadX 7408 1748 512 512
ReadX 7408 2260 512 512
ReadX 7408 2772 512 512
ReadX 7408 3284 512 512
ReadX 7408 3796 394 394
ReadX 7408 636 118 118
ReadX 7408 754 512 512
ReadX 7408 1266 512 512
ReadX 7408 1778 512 512
ReadX 7408 2290 512 512
ReadX 7408 2802 512 512
ReadX 7408 3314 512 512
ReadX 7408 3826 512 512
ReadX 7408 4338 512 512
ReadX 7408 4850 512 512
ReadX 7408 5362 512 512
ReadX 7408 5874 512 512
ReadX 7408 6386 512 512
ReadX 7408 6898 512 512
ReadX 7408 7410 512 512
ReadX 7408 7922 512 512
ReadX 7408 8434 512 512
ReadX 7408 8946 512 512
ReadX 7408 9458 512 512
ReadX 7408 9970 512 512
ReadX 7408 10482 512 512
ReadX 7408 723 512 512
ReadX 7408 1235 512 512
ReadX 7408 725 512 512
ReadX 7408 729 512 512
ReadX 7408 1241 512 512
ReadX 7408 1753 512 512
ReadX 7408 2265 512 512
ReadX 7408 2777 512 512
ReadX 7408 3289 512 512
ReadX 7408 3801 512 512
ReadX 7408 4313 512 512
ReadX 7408 4825 512 512
ReadX 7408 5337 512 512
ReadX 7408 5849 512 512
ReadX 7408 6361 512 512
ReadX 7408 755 512 512
ReadX 7408 1267 512 512
ReadX 7408 1779 512 512
ReadX 7408 2291 512 512
ReadX 7408 2803 512 512
ReadX 7408 3315 512 512
ReadX 7408 3827 512 512
ReadX 7408 4339 244 244
ReadX 7408 4583 512 512
ReadX 7408 5095 268 268
ReadX 7408 5363 512 512
ReadX 7408 5875 512 512
ReadX 7408 6387 512 512
ReadX 7408 6899 512 512
ReadX 7408 7411 512 512
ReadX 7408 7923 512 512
ReadX 7408 8435 512 512
ReadX 7408 8947 512 512
ReadX 7408 9459 512 512
ReadX 7408 9971 512 512
ReadX 7408 10483 512 512
ReadX 7408 10995 512 512
ReadX 7408 11507 512 512
ReadX 7408 12019 512 512
ReadX 7408 12531 512 512
ReadX 7408 13043 512 512
ReadX 7408 13555 512 512
ReadX 7408 14067 512 512
ReadX 7408 14579 512 512
ReadX 7408 15091 512 512
ReadX 7408 15603 342 342
ReadX 7408 725 512 512
ReadX 7408 2000 512 512
ReadX 7408 3918 512 512
ReadX 7408 727 512 512
ReadX 7408 258 512 512
ReadX 7408 376 512 512
ReadX 7408 1109 512 512
ReadX 7408 1028 512 512
ReadX 7408 1540 512 512
ReadX 7408 2052 512 512
ReadX 7408 2564 512 512
ReadX 7408 3076 512 512
ReadX 7408 3588 512 512
ReadX 7408 4100 512 512
ReadX 7408 4612 412 412
ReadX 7408 1012 100 100
ReadX 7408 1112 512 512
ReadX 7408 1624 512 512
ReadX 7408 2136 512 512
ReadX 7408 2648 512 512
ReadX 7408 3160 512 512
ReadX 7408 3672 512 512
ReadX 7408 4184 412 412
ReadX 7408 1044 100 100
ReadX 7408 1144 512 512
ReadX 7408 1656 512 512
ReadX 7408 2168 512 512
ReadX 7408 2680 512 512
ReadX 7408 3192 512 512
ReadX 7408 3704 512 512
ReadX 7408 4216 512 512
ReadX 7408 4728 512 512
ReadX 7408 5240 512 512
ReadX 7408 5752 512 512
ReadX 7408 6264 512 512
ReadX 7408 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 7408 7288 512 512
ReadX 7408 7800 512 512
ReadX 7408 8312 512 512
ReadX 7408 8824 512 512
ReadX 7408 9336 512 512
ReadX 7408 9848 512 512
ReadX 7408 10360 512 512
ReadX 7408 10872 512 512
ReadX 7408 11384 512 512
ReadX 7408 11896 512 512
ReadX 7408 12408 512 512
ReadX 7408 1088 512 512
ReadX 7408 1600 512 512
ReadX 7408 1090 512 512
ReadX 7408 1094 512 512
ReadX 7408 1606 512 512
ReadX 7408 2118 512 512
ReadX 7408 2630 512 512
ReadX 7408 3142 512 512
ReadX 7408 3654 512 512
ReadX 7408 4166 512 512
ReadX 7408 4678 512 512
ReadX 7408 1111 512 512
ReadX 7408 1623 512 512
ReadX 7408 2135 512 512
ReadX 7408 2647 512 512
ReadX 7408 3159 512 512
ReadX 7408 3671 512 512
ReadX 7408 4183 512 512
ReadX 7408 4695 512 512
ReadX 7408 5207 512 512
ReadX 7408 5719 512 512
ReadX 7408 6231 512 512
ReadX 7408 6743 512 512
ReadX 7408 7255 512 512
ReadX 7408 7767 512 512
ReadX 7408 8279 512 512
ReadX 7408 8791 512 512
ReadX 7408 9303 512 512
ReadX 7408 9815 512 512
ReadX 7408 10327 512 512
ReadX 7408 10839 512 512
ReadX 7408 11351 294 294
ReadX 7408 1091 512 512
ReadX 7408 970 512 512
ReadX 7408 1093 512 512
ReadX 7408 1434 512 512
ReadX 7408 2050 512 512
ReadX 7408 2158 512 512
ReadX 7408 2118 512 512
ReadX 7408 2630 512 512
ReadX 7408 3142 512 512
ReadX 7408 3654 512 512
ReadX 7408 4166 512 512
ReadX 7408 4678 512 512
ReadX 7408 5190 512 512
ReadX 7408 5702 382 382
ReadX 7408 2104 130 130
ReadX 7408 2234 512 512
ReadX 7408 2746 512 512
ReadX 7408 3258 512 512
ReadX 7408 3770 512 512
ReadX 7408 4282 512 512
ReadX 7408 4794 512 512
ReadX 7408 5306 382 382
ReadX 7408 2134 130 130
ReadX 7408 2264 512 512
ReadX 7408 2776 512 512
ReadX 7408 3288 512 512
ReadX 7408 3800 512 512
ReadX 7408 4312 512 512
ReadX 7408 4824 512 512
ReadX 7408 5336 512 512
ReadX 7408 2147 512 512
ReadX 7408 2149 512 512
ReadX 7408 2152 512 512
ReadX 7408 2664 512 512
ReadX 7408 3176 512 512
ReadX 7408 3688 512 512
ReadX 7408 2159 512 512
ReadX 7408 2671 512 512
ReadX 7408 3183 512 512
ReadX 7408 3695 512 512
ReadX 7408 4207 512 512
ReadX 7408 4719 512 512
ReadX 7408 5231 512 512
ReadX 7408 5743 512 512
ReadX 7408 6255 512 512
ReadX 7408 6767 512 512
ReadX 7408 7279 512 512
ReadX 7408 7791 512 512
ReadX 7408 8303 512 512
ReadX 7408 8815 512 512
ReadX 7408 9327 512 512
ReadX 7408 9839 512 512
ReadX 7408 10351 512 512
ReadX 7408 10863 512 512
ReadX 7408 11375 512 512
ReadX 7408 11887 512 512
ReadX 7408 12399 38 38
ReadX 7408 2149 512 512
ReadX 7408 1794 512 512
ReadX 7408 2016 512 512
ReadX 7408 2151 512 512
ReadX 7408 1918 512 512
ReadX 7408 1880 512 512
ReadX 7408 2392 512 512
ReadX 7408 2904 512 512
ReadX 7408 3416 512 512
ReadX 7408 3928 512 512
ReadX 7408 4440 512 512
ReadX 7408 4952 512 512
ReadX 7408 5464 416 416
ReadX 7408 1866 96 96
ReadX 7408 1962 512 512
ReadX 7408 2474 512 512
ReadX 7408 2986 512 512
ReadX 7408 3498 512 512
ReadX 7408 4010 512 512
ReadX 7408 4522 512 512
ReadX 7408 5034 416 416
ReadX 7408 1896 96 96
ReadX 7408 1992 512 512
ReadX 7408 2504 512 512
ReadX 7408 3016 512 512
ReadX 7408 3528 512 512
ReadX 7408 1903 512 512
ReadX 7408 1905 512 512
ReadX 7408 1908 512 512
ReadX 7408 2420 512 512
ReadX 7408 2932 512 512
ReadX 7408 3444 512 512
ReadX 7408 3956 512 512
ReadX 7408 1919 512 512
ReadX 7408 2431 512 512
ReadX 7408 2943 512 512
ReadX 7408 3455 512 512
ReadX 7408 3967 512 512
ReadX 7408 4479 512 512
ReadX 7408 4991 512 512
ReadX 7408 5503 512 512
ReadX 7408 6015 512 512
ReadX 7408 6527 512 512
ReadX 7408 7039 512 512
ReadX 7408 7551 512 512
ReadX 7408 8063 512 512
ReadX 7408 8575 512 512
ReadX 7408 9087 512 512
ReadX 7408 9599 512 512
ReadX 7408 10111 512 512
ReadX 7408 10623 512 512
ReadX 7408 11135 512 512
ReadX 7408 11647 512 512
ReadX 7408 12159 322 322
ReadX 7408 1905 512 512
ReadX 7408 1846 512 512
ReadX 7408 1907 512 512
ReadX 7408 1860 268 268
ReadX 7408 1832 244 244
ReadX 7408 1846 512 512
ReadX 7408 2358 512 512
ReadX 7408 2870 512 512
ReadX 7408 3382 512 512
ReadX 7408 3894 512 512
ReadX 7408 4406 512 512
ReadX 7408 4918 512 512
ReadX 7408 1858 512 512
ReadX 7408 1859 512 512
ReadX 7408 1860 488 488
ReadX 7408 1832 24 24
ReadX 7408 1861 228 228
ReadX 7408 1832 284 284
ReadX 7408 2116 512 512
ReadX 7408 2628 512 512
ReadX 7408 3140 512 512
ReadX 7408 3652 512 512
ReadX 7408 4164 512 512
ReadX 7408 4676 512 512
ReadX 7408 5188 228 228
ReadX 7408 1862 284 284
ReadX 7408 2146 512 512
ReadX 7408 2658 38 38
ReadX 7408 1859 512 512
ReadX 7408 2047 512 512
ReadX 7408 2016 512 512
ReadX 7408 2528 512 512
ReadX 7408 3040 512 512
ReadX 7408 3552 512 512
ReadX 7408 4064 512 512
ReadX 7408 4576 512 512
ReadX 7408 5088 512 512
ReadX 7408 5600 424 424
ReadX 7408 2002 88 88
ReadX 7408 2090 512 512
ReadX 7408 2602 512 512
ReadX 7408 3114 512 512
ReadX 7408 3626 512 512
ReadX 7408 4138 512 512
ReadX 7408 4650 512 512
ReadX 7408 5162 424 424
ReadX 7408 2032 88 88
ReadX 7408 2120 512 512
ReadX 7408 2632 512 512
ReadX 7408 3144 512 512
ReadX 7408 3656 512 512
ReadX 7408 4168 512 512
ReadX 7408 4680 512 512
ReadX 7408 5192 512 512
ReadX 7408 2044 512 512
ReadX 7408 2045 512 512
ReadX 7408 2046 512 512
ReadX 7408 2047 512 512
ReadX 7408 2559 110 110
ReadX 7408 2052 402 402
ReadX 7408 2454 512 512
ReadX 7408 2966 512 512
ReadX 7408 3478 512 512
ReadX 7408 3990 512 512
ReadX 7408 4502 512 512
ReadX 7408 5014 512 512
ReadX 7408 5526 512 512
ReadX 7408 6038 512 512
ReadX 7408 6550 512 512
ReadX 7408 7062 512 512
ReadX 7408 7574 512 512
ReadX 7408 8086 512 512
ReadX 7408 8598 512 512
ReadX 7408 9110 512 512
ReadX 7408 9622 512 512
ReadX 7408 10134 512 512
ReadX 7408 10646 512 512
ReadX 7408 11158 512 512
ReadX 7408 11670 512 512
ReadX 7408 12182 512 512
ReadX 7408 12694 118 118
ReadX 7408 2045 512 512
ReadX 7408 1282 512 512
ReadX 7408 1343 512 512
ReadX 7408 1286 512 512
ReadX 7408 1798 512 512
ReadX 7408 2310 512 512
ReadX 7408 2822 512 512
ReadX 7408 3334 512 512
ReadX 7408 3846 512 512
ReadX 7408 4358 512 512
ReadX 7408 4870 416 416
ReadX 7408 1270 96 96
ReadX 7408 1366 512 512
ReadX 7408 1878 512 512
ReadX 7408 2390 512 512
ReadX 7408 2902 512 512
ReadX 7408 3414 512 512
ReadX 7408 3926 416 416
ReadX 7408 1284 96 96
ReadX 7408 1380 416 416
ReadX 7408 1302 96 96
ReadX 7408 1398 512 512
ReadX 7408 1910 512 512
ReadX 7408 2422 512 512
ReadX 7408 2934 512 512
ReadX 7408 3446 512 512
ReadX 7408 3958 512 512
ReadX 7408 4470 512 512
ReadX 7408 4982 512 512
ReadX 7408 5494 512 512
ReadX 7408 6006 512 512
ReadX 7408 6518 512 512
ReadX 7408 7030 512 512
ReadX 7408 7542 512 512
ReadX 7408 1328 512 512
ReadX 7408 1330 512 512
ReadX 7408 1333 512 512
ReadX 7408 1845 512 512
ReadX 7408 2357 512 512
ReadX 7408 2869 512 512
ReadX 7408 3381 512 512
ReadX 7408 1344 512 512
ReadX 7408 1856 512 512
ReadX 7408 2368 512 512
ReadX 7408 2880 512 512
ReadX 7408 3392 512 512
ReadX 7408 3904 512 512
ReadX 7408 4416 512 512
ReadX 7408 4928 512 512
ReadX 7408 5440 512 512
ReadX 7408 5952 512 512
ReadX 7408 6464 512 512
ReadX 7408 6976 512 512
ReadX 7408 7488 512 512
ReadX 7408 8000 512 512
ReadX 7408 8512 512 512
ReadX 7408 9024 512 512
ReadX 7408 9536 512 512
ReadX 7408 10048 512 512
ReadX 7408 10560 512 512
ReadX 7408 11072 512 512
ReadX 7408 11584 426 426
ReadX 7408 1330 512 512
ReadX 7408 1842 512 512
ReadX 7408 1250 512 512
ReadX 7408 1264 268 268
ReadX 7408 1236 244 244
ReadX 7408 1250 512 512
ReadX 7408 1762 512 512
ReadX 7408 2274 512 512
ReadX 7408 2786 512 512
ReadX 7408 3298 512 512
ReadX 7408 3810 512 512
ReadX 7408 4322 512 512
ReadX 7408 1262 512 512
ReadX 7408 1263 512 512
ReadX 7408 1264 488 488
ReadX 7408 1236 24 24
ReadX 7408 1265 228 228
ReadX 7408 1236 284 284
ReadX 7408 1520 512 512
ReadX 7408 2032 512 512
ReadX 7408 2544 512 512
ReadX 7408 3056 512 512
ReadX 7408 3568 512 512
ReadX 7408 4080 512 512
ReadX 7408 4592 228 228
ReadX 7408 1266 284 284
ReadX 7408 1550 512 512
ReadX 7408 2062 42 42
ReadX 7408 1263 512 512
ReadX 7408 1538 512 512
ReadX 7408 1640 512 512
ReadX 7408 1510 512 512
ReadX 7408 2022 512 512
ReadX 7408 2534 512 512
ReadX 7408 3046 512 512
ReadX 7408 3558 512 512
ReadX 7408 4070 512 512
ReadX 7408 4582 512 512
ReadX 7408 5094 408 408
ReadX 7408 1496 104 104
ReadX 7408 1600 512 512
ReadX 7408 2112 512 512
ReadX 7408 2624 512 512
ReadX 7408 3136 512 512
ReadX 7408 3648 512 512
ReadX 7408 4160 512 512
ReadX 7408 4672 408 408
ReadX 7408 1526 104 104
ReadX 7408 1630 512 512
ReadX 7408 2142 512 512
ReadX 7408 2654 512 512
ReadX 7408 3166 512 512
ReadX 7408 3678 512 512
ReadX 7408 4190 408 408
ReadX 7408 1540 104 104
ReadX 7408 1644 512 512
ReadX 7408 2156 512 512
ReadX 7408 2668 512 512
ReadX 7408 3180 512 512
ReadX 7408 3692 512 512
ReadX 7408 4204 512 512
ReadX 7408 4716 512 512
ReadX 7408 5228 512 512
ReadX 7408 5740 512 512
ReadX 7408 6252 512 512
ReadX 7408 6764 512 512
ReadX 7408 7276 512 512
ReadX 7408 7788 512 512
ReadX 7408 8300 512 512
ReadX 7408 8812 512 512
ReadX 7408 9324 512 512
ReadX 7408 9836 512 512
ReadX 7408 10348 512 512
ReadX 7408 10860 512 512
ReadX 7408 11372 512 512
ReadX 7408 1615 512 512
ReadX 7408 2127 512 512
ReadX 7408 1617 512 512
ReadX 7408 1621 512 512
ReadX 7408 2133 512 512
ReadX 7408 2645 512 512
ReadX 7408 3157 512 512
ReadX 7408 3669 512 512
ReadX 7408 4181 512 512
ReadX 7408 4693 512 512
ReadX 7408 5205 512 512
ReadX 7408 5717 512 512
ReadX 7408 6229 512 512
ReadX 7408 1641 512 512
ReadX 7408 2153 512 512
ReadX 7408 2665 512 512
ReadX 7408 3177 512 512
ReadX 7408 3689 512 512
ReadX 7408 4201 512 512
ReadX 7408 4713 512 512
ReadX 7408 5225 512 512
ReadX 7408 5737 512 512
ReadX 7408 6249 512 512
ReadX 7408 6761 512 512
ReadX 7408 7273 512 512
ReadX 7408 7785 512 512
ReadX 7408 8297 512 512
ReadX 7408 8809 512 512
ReadX 7408 9321 512 512
ReadX 7408 9833 512 512
ReadX 7408 10345 512 512
ReadX 7408 10857 512 512
ReadX 7408 11369 512 512
ReadX 7408 11881 2 2
ReadX 7408 1796 510 510
ReadX 7408 2306 512 512
ReadX 7408 2818 512 512
ReadX 7408 3330 512 512
ReadX 7408 3842 512 512
ReadX 7408 4354 512 512
ReadX 7408 4866 512 512
ReadX 7408 5378 512 512
ReadX 7408 5890 512 512
ReadX 7408 6402 512 512
ReadX 7408 6914 512 512
ReadX 7408 7426 512 512
ReadX 7408 7938 512 512
ReadX 7408 8450 512 512
ReadX 7408 8962 512 512
ReadX 7408 9474 512 512
ReadX 7408 9986 512 512
ReadX 7408 10498 326 326
ReadX 7408 1617 512 512
ReadX 7408 2129 512 512
ReadX 7408 1450 512 512
ReadX 7408 1621 512 512
ReadX 7408 1446 512 512
ReadX 7408 1450 512 512
ReadX 7408 1962 512 512
ReadX 7408 2474 512 512
ReadX 7408 2986 512 512
ReadX 7408 3498 512 512
ReadX 7408 4010 512 512
ReadX 7408 4522 512 512
ReadX 7408 5034 424 424
ReadX 7408 1436 88 88
ReadX 7408 1524 512 512
ReadX 7408 2036 512 512
ReadX 7408 2548 512 512
ReadX 7408 3060 512 512
ReadX 7408 1442 512 512
ReadX 7408 1443 512 512
ReadX 7408 1444 512 512
ReadX 7408 1446 512 512
ReadX 7408 1958 386 386
ReadX 7408 1466 126 126
ReadX 7408 1592 512 512
ReadX 7408 2104 512 512
ReadX 7408 2616 512 512
ReadX 7408 3128 512 512
ReadX 7408 3640 512 512
ReadX 7408 4152 512 512
ReadX 7408 4664 512 512
ReadX 7408 5176 512 512
ReadX 7408 5688 512 512
ReadX 7408 6200 512 512
ReadX 7408 6712 512 512
ReadX 7408 7224 512 512
ReadX 7408 7736 512 512
ReadX 7408 8248 512 512
ReadX 7408 8760 294 294
ReadX 7408 1443 512 512
ReadX 7408 964 512 512
ReadX 7408 970 512 512
ReadX 7408 1482 512 512
ReadX 7408 1994 512 512
ReadX 7408 2506 512 512
ReadX 7408 3018 512 512
ReadX 7408 3530 512 512
ReadX 7408 4042 512 512
ReadX 7408 4554 424 424
ReadX 7408 956 88 88
ReadX 7408 1044 512 512
ReadX 7408 1556 512 512
ReadX 7408 2068 512 512
ReadX 7408 2580 512 512
ReadX 7408 962 512 512
ReadX 7408 963 512 512
ReadX 7408 964 512 512
ReadX 7408 965 512 512
ReadX 7408 1477 512 512
ReadX 7408 1989 228 228
ReadX 7408 986 284 284
ReadX 7408 1270 512 512
ReadX 7408 1782 512 512
ReadX 7408 2294 512 512
ReadX 7408 2806 512 512
ReadX 7408 3318 512 512
ReadX 7408 3830 512 512
ReadX 7408 4342 512 512
ReadX 7408 4854 512 512
ReadX 7408 5366 512 512
ReadX 7408 5878 512 512
ReadX 7408 6390 512 512
ReadX 7408 6902 512 512
ReadX 7408 7414 42 42
ReadX 7408 963 512 512
ReadX 7408 2610 512 512
ReadX 7408 3812 512 512
ReadX 7408 3828 512 512
ReadX 7408 3969 512 512
ReadX 7408 3918 512 512
ReadX 7408 4430 512 512
ReadX 7408 4942 512 512
ReadX 7408 5454 512 512
ReadX 7408 5966 512 512
ReadX 7408 6478 512 512
ReadX 7408 6990 512 512
ReadX 7408 7502 424 424
ReadX 7408 3904 88 88
ReadX 7408 3992 512 512
ReadX 7408 4504 512 512
ReadX 7408 5016 512 512
ReadX 7408 5528 512 512
ReadX 7408 6040 512 512
ReadX 7408 6552 512 512
ReadX 7408 7064 424 424
ReadX 7408 3934 88 88
ReadX 7408 4022 512 512
ReadX 7408 4534 512 512
ReadX 7408 5046 512 512
ReadX 7408 5558 512 512
ReadX 7408 6070 512 512
ReadX 7408 6582 512 512
ReadX 7408 7094 512 512
ReadX 7408 7606 512 512
ReadX 7408 8118 512 512
ReadX 7408 8630 512 512
ReadX 7408 3953 512 512
ReadX 7408 4465 512 512
ReadX 7408 3956 512 512
ReadX 7408 3964 512 512
ReadX 7408 4476 512 512
ReadX 7408 4988 512 512
ReadX 7408 3970 512 512
ReadX 7408 4482 512 512
ReadX 7408 4994 512 512
ReadX 7408 5506 512 512
ReadX 7408 6018 512 512
ReadX 7408 6530 512 512
ReadX 7408 7042 512 512
ReadX 7408 7554 512 512
ReadX 7408 8066 512 512
ReadX 7408 8578 512 512
ReadX 7408 9090 512 512
ReadX 7408 9602 512 512
ReadX 7408 10114 512 512
ReadX 7408 10626 512 512
ReadX 7408 11138 512 512
ReadX 7408 11650 512 512
ReadX 7408 12162 512 512
ReadX 7408 12674 512 512
ReadX 7408 13186 512 512
ReadX 7408 13698 512 512
ReadX 7408 14210 134 134
ReadX 7408 3956 512 512
ReadX 7408 4468 512 512
ReadX 7408 4980 512 512
ReadX 7408 5492 512 512
ReadX 7408 3074 512 512
ReadX 7408 3246 512 512
ReadX 7408 3964 512 512
ReadX 7408 3330 512 512
ReadX 7408 3465 512 512
ReadX 7408 3246 512 512
ReadX 7408 3758 512 512
ReadX 7408 4270 512 512
ReadX 7408 4782 512 512
ReadX 7408 5294 512 512
ReadX 7408 5806 512 512
ReadX 7408 6318 512 512
ReadX 7408 6830 368 368
ReadX 7408 3232 144 144
ReadX 7408 3376 512 512
ReadX 7408 3888 512 512
ReadX 7408 4400 512 512
ReadX 7408 4912 512 512
ReadX 7408 5424 512 512
ReadX 7408 5936 512 512
ReadX 7408 6448 368 368
ReadX 7408 3262 144 144
ReadX 7408 3406 512 512
ReadX 7408 3918 512 512
ReadX 7408 4430 512 512
ReadX 7408 4942 512 512
ReadX 7408 5454 512 512
ReadX 7408 5966 512 512
ReadX 7408 6478 512 512
ReadX 7408 6990 512 512
ReadX 7408 7502 512 512
ReadX 7408 8014 512 512
ReadX 7408 8526 512 512
ReadX 7408 9038 512 512
ReadX 7408 9550 512 512
ReadX 7408 10062 512 512
ReadX 7408 10574 512 512
ReadX 7408 11086 512 512
ReadX 7408 11598 512 512
ReadX 7408 12110 512 512
ReadX 7408 12622 512 512
ReadX 7408 13134 512 512
ReadX 7408 13646 368 368
ReadX 7408 3332 144 144
ReadX 7408 3476 512 512
ReadX 7408 3988 512 512
ReadX 7408 4500 512 512
ReadX 7408 5012 512 512
ReadX 7408 5524 512 512
ReadX 7408 6036 512 512
ReadX 7408 6548 512 512
ReadX 7408 7060 512 512
ReadX 7408 7572 512 512
ReadX 7408 8084 512 512
ReadX 7408 8596 512 512
ReadX 7408 9108 512 512
ReadX 7408 9620 512 512
ReadX 7408 10132 512 512
ReadX 7408 10644 512 512
ReadX 7408 11156 512 512
ReadX 7408 11668 512 512
ReadX 7408 12180 512 512
ReadX 7408 12692 512 512
ReadX 7408 13204 512 512
ReadX 7408 3430 512 512
ReadX 7408 3942 512 512
ReadX 7408 3434 512 512
ReadX 7408 3435 512 512
ReadX 7408 3947 512 512
ReadX 7408 4459 512 512
ReadX 7408 4971 512 512
ReadX 7408 5483 512 512
ReadX 7408 5995 512 512
ReadX 7408 6507 512 512
ReadX 7408 7019 512 512
ReadX 7408 7531 512 512
ReadX 7408 8043 512 512
ReadX 7408 8555 512 512
ReadX 7408 9067 512 512
ReadX 7408 9579 512 512
ReadX 7408 10091 512 512
ReadX 7408 10603 512 512
ReadX 7408 11115 512 512
ReadX 7408 3467 512 512
ReadX 7408 3979 512 512
ReadX 7408 4491 512 512
ReadX 7408 5003 512 512
ReadX 7408 5515 512 512
ReadX 7408 6027 512 512
ReadX 7408 6539 512 512
ReadX 7408 7051 512 512
ReadX 7408 7563 512 512
ReadX 7408 8075 512 512
ReadX 7408 8587 512 512
ReadX 7408 9099 512 512
ReadX 7408 9611 512 512
ReadX 7408 10123 512 512
ReadX 7408 10635 512 512
ReadX 7408 11147 512 512
ReadX 7408 11659 512 512
ReadX 7408 12171 512 512
ReadX 7408 12683 512 512
ReadX 7408 13195 512 512
ReadX 7408 13707 56 56
ReadX 7408 13763 512 512
ReadX 7408 14275 456 456
ReadX 7408 14731 512 512
ReadX 7408 15243 512 512
ReadX 7408 15755 512 512
ReadX 7408 16267 512 512
ReadX 7408 16779 512 512
ReadX 7408 17291 512 512
ReadX 7408 17803 512 512
ReadX 7408 18315 512 512
ReadX 7408 18827 512 512
ReadX 7408 19339 512 512
ReadX 7408 19851 512 512
ReadX 7408 20363 512 512
ReadX 7408 20875 512 512
ReadX 7408 21387 512 512
ReadX 7408 21899 512 512
ReadX 7408 22411 512 512
ReadX 7408 22923 512 512
ReadX 7408 23435 512 512
ReadX 7408 23947 512 512
ReadX 7408 24459 512 512
ReadX 7408 24971 282 282
ReadX 7408 3434 512 512
ReadX 7408 2818 512 512
ReadX 7408 2870 512 512
ReadX 7408 3026 512 512
ReadX 7408 3538 512 512
ReadX 7408 2870 512 512
ReadX 7408 3382 512 512
ReadX 7408 3894 512 512
ReadX 7408 4406 512 512
ReadX 7408 4918 512 512
ReadX 7408 5430 512 512
ReadX 7408 5942 512 512
ReadX 7408 6454 374 374
ReadX 7408 2856 138 138
ReadX 7408 2994 512 512
ReadX 7408 3506 512 512
ReadX 7408 4018 512 512
ReadX 7408 4530 512 512
ReadX 7408 5042 512 512
ReadX 7408 5554 512 512
ReadX 7408 6066 374 374
ReadX 7408 2886 138 138
ReadX 7408 3024 512 512
ReadX 7408 3536 512 512
ReadX 7408 4048 512 512
ReadX 7408 4560 512 512
ReadX 7408 5072 512 512
ReadX 7408 5584 512 512
ReadX 7408 6096 512 512
ReadX 7408 6608 512 512
ReadX 7408 7120 512 512
ReadX 7408 7632 512 512
ReadX 7408 8144 512 512
ReadX 7408 8656 512 512
ReadX 7408 9168 512 512
ReadX 7408 9680 512 512
ReadX 7408 10192 512 512
ReadX 7408 10704 512 512
ReadX 7408 11216 512 512
ReadX 7408 11728 512 512
ReadX 7408 12240 512 512
ReadX 7408 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 7408 13264 512 512
ReadX 7408 13776 512 512
ReadX 7408 14288 512 512
ReadX 7408 14800 512 512
ReadX 7408 15312 512 512
ReadX 7408 15824 512 512
ReadX 7408 16336 512 512
ReadX 7408 16848 512 512
ReadX 7408 17360 512 512
ReadX 7408 17872 512 512
ReadX 7408 18384 512 512
ReadX 7408 18896 512 512
ReadX 7408 19408 512 512
ReadX 7408 19920 512 512
ReadX 7408 20432 512 512
ReadX 7408 20944 512 512
ReadX 7408 21456 512 512
ReadX 7408 21968 512 512
ReadX 7408 22480 512 512
ReadX 7408 22992 512 512
ReadX 7408 2998 512 512
ReadX 7408 3510 512 512
ReadX 7408 3001 512 512
ReadX 7408 3003 512 512
ReadX 7408 3515 512 512
ReadX 7408 4027 512 512
ReadX 7408 4539 512 512
ReadX 7408 5051 512 512
ReadX 7408 5563 512 512
ReadX 7408 6075 512 512
ReadX 7408 6587 512 512
ReadX 7408 7099 512 512
ReadX 7408 7611 512 512
ReadX 7408 8123 512 512
ReadX 7408 8635 512 512
ReadX 7408 3029 512 512
ReadX 7408 3541 512 512
ReadX 7408 4053 512 512
ReadX 7408 4565 512 512
ReadX 7408 5077 512 512
ReadX 7408 5589 512 512
ReadX 7408 6101 512 512
ReadX 7408 6613 512 512
ReadX 7408 7125 512 512
ReadX 7408 7637 512 512
ReadX 7408 8149 512 512
ReadX 7408 8661 512 512
ReadX 7408 9173 512 512
ReadX 7408 9685 512 512
ReadX 7408 10197 512 512
ReadX 7408 10709 512 512
ReadX 7408 11221 512 512
ReadX 7408 11733 512 512
ReadX 7408 12245 512 512
ReadX 7408 12757 512 512
ReadX 7408 13269 40 40
ReadX 7408 3076 472 472
ReadX 7408 3548 512 512
ReadX 7408 4060 512 512
ReadX 7408 4572 512 512
ReadX 7408 5084 512 512
ReadX 7408 5596 512 512
ReadX 7408 6108 512 512
ReadX 7408 6620 512 512
ReadX 7408 7132 512 512
ReadX 7408 7644 512 512
ReadX 7408 8156 512 512
ReadX 7408 8668 512 512
ReadX 7408 9180 512 512
ReadX 7408 9692 512 512
ReadX 7408 10204 512 512
ReadX 7408 10716 512 512
ReadX 7408 11228 512 512
ReadX 7408 11740 512 512
ReadX 7408 12252 512 512
ReadX 7408 12764 512 512
ReadX 7408 13276 310 310
ReadX 7408 3001 512 512
ReadX 7408 2562 512 512
ReadX 7408 2626 512 512
ReadX 7408 3003 512 512
ReadX 7408 2721 512 512
ReadX 7408 2626 512 512
ReadX 7408 3138 512 512
ReadX 7408 3650 512 512
ReadX 7408 4162 512 512
ReadX 7408 4674 512 512
ReadX 7408 5186 512 512
ReadX 7408 5698 512 512
ReadX 7408 6210 424 424
ReadX 7408 2612 88 88
ReadX 7408 2700 512 512
ReadX 7408 3212 512 512
ReadX 7408 3724 512 512
ReadX 7408 4236 512 512
ReadX 7408 4748 512 512
ReadX 7408 5260 512 512
ReadX 7408 5772 424 424
ReadX 7408 2642 88 88
ReadX 7408 2730 512 512
ReadX 7408 3242 512 512
ReadX 7408 3754 512 512
ReadX 7408 4266 512 512
ReadX 7408 4778 512 512
ReadX 7408 5290 512 512
ReadX 7408 5802 512 512
ReadX 7408 6314 512 512
ReadX 7408 6826 512 512
ReadX 7408 7338 512 512
ReadX 7408 7850 512 512
ReadX 7408 8362 512 512
ReadX 7408 8874 512 512
ReadX 7408 9386 512 512
ReadX 7408 9898 512 512
ReadX 7408 10410 512 512
ReadX 7408 10922 512 512
ReadX 7408 11434 512 512
ReadX 7408 11946 512 512
ReadX 7408 12458 512 512
ReadX 7408 2716 512 512
ReadX 7408 2717 512 512
ReadX 7408 2718 512 512
ReadX 7408 3230 512 512
ReadX 7408 2721 512 512
ReadX 7408 3233 512 512
ReadX 7408 3745 512 512
ReadX 7408 4257 512 512
ReadX 7408 4769 512 512
ReadX 7408 5281 512 512
ReadX 7408 5793 512 512
ReadX 7408 6305 512 512
ReadX 7408 6817 512 512
ReadX 7408 7329 512 512
ReadX 7408 7841 512 512
ReadX 7408 8353 512 512
ReadX 7408 8865 512 512
ReadX 7408 9377 512 512
ReadX 7408 9889 512 512
ReadX 7408 10401 512 512
ReadX 7408 10913 512 512
ReadX 7408 11425 512 512
ReadX 7408 11937 512 512
ReadX 7408 12449 512 512
ReadX 7408 12961 512 512
ReadX 7408 13473 512 512
ReadX 7408 13985 106 106
ReadX 7408 2820 406 406
ReadX 7408 3226 512 512
ReadX 7408 3738 512 512
ReadX 7408 4250 512 512
ReadX 7408 4762 512 512
ReadX 7408 5274 512 512
ReadX 7408 5786 512 512
ReadX 7408 6298 512 512
ReadX 7408 6810 512 512
ReadX 7408 7322 512 512
ReadX 7408 7834 512 512
ReadX 7408 8346 512 512
ReadX 7408 8858 512 512
ReadX 7408 9370 512 512
ReadX 7408 9882 512 512
ReadX 7408 10394 512 512
ReadX 7408 10906 512 512
ReadX 7408 11418 182 182
ReadX 7408 2717 512 512
ReadX 7408 258 512 512
ReadX 7408 470 512 512
ReadX 7408 376 512 512
ReadX 7408 888 512 512
ReadX 7408 1400 512 512
ReadX 7408 1912 512 512
ReadX 7408 2424 512 512
ReadX 7408 2936 512 512
ReadX 7408 3448 512 512
ReadX 7408 3960 424 424
ReadX 7408 362 88 88
ReadX 7408 450 512 512
ReadX 7408 962 512 512
ReadX 7408 1474 512 512
ReadX 7408 1986 512 512
ReadX 7408 2498 512 512
ReadX 7408 3010 512 512
ReadX 7408 3522 424 424
ReadX 7408 392 88 88
ReadX 7408 480 512 512
ReadX 7408 992 512 512
ReadX 7408 1504 512 512
ReadX 7408 2016 512 512
ReadX 7408 2528 512 512
ReadX 7408 3040 512 512
ReadX 7408 3552 512 512
ReadX 7408 4064 512 512
ReadX 7408 4576 512 512
ReadX 7408 5088 512 512
ReadX 7408 5600 512 512
ReadX 7408 6112 512 512
ReadX 7408 6624 512 512
ReadX 7408 7136 512 512
ReadX 7408 7648 512 512
ReadX 7408 8160 512 512
ReadX 7408 8672 512 512
ReadX 7408 9184 512 512
ReadX 7408 9696 512 512
ReadX 7408 10208 512 512
ReadX 7408 464 512 512
ReadX 7408 465 512 512
ReadX 7408 466 512 512
ReadX 7408 978 512 512
ReadX 7408 470 512 512
ReadX 7408 982 512 512
ReadX 7408 1494 512 512
ReadX 7408 2006 512 512
ReadX 7408 2518 512 512
ReadX 7408 3030 512 512
ReadX 7408 3542 512 512
ReadX 7408 4054 512 512
ReadX 7408 4566 512 512
ReadX 7408 5078 512 512
ReadX 7408 5590 512 512
ReadX 7408 6102 512 512
ReadX 7408 6614 512 512
ReadX 7408 7126 512 512
ReadX 7408 7638 512 512
ReadX 7408 8150 512 512
ReadX 7408 8662 512 512
ReadX 7408 9174 512 512
ReadX 7408 9686 512 512
ReadX 7408 10198 512 512
ReadX 7408 10710 333 333
ReadX 7408 11043 512 512
ReadX 7408 11555 179 179
ReadX 7408 11734 512 512
ReadX 7408 12246 512 512
ReadX 7408 12758 512 512
ReadX 7408 13270 512 512
ReadX 7408 13782 512 512
ReadX 7408 14294 512 512
ReadX 7408 14806 512 512
ReadX 7408 15318 512 512
ReadX 7408 15830 512 512
ReadX 7408 16342 512 512
ReadX 7408 16854 512 512
ReadX 7408 17366 512 512
ReadX 7408 17878 512 512
ReadX 7408 18390 512 512
ReadX 7408 18902 512 512
ReadX 7408 19414 512 512
ReadX 7408 19926 512 512
ReadX 7408 20438 512 512
ReadX 7408 20950 512 512
ReadX 7408 21462 512 512
ReadX 7408 21974 350 350
ReadX 7408 465 512 512
ReadX 7408 3812 512 512
ReadX 7408 4046 512 512
ReadX 7408 3828 512 512
ReadX 7408 256 512 512
ReadX 7408 260 512 512
ReadX 7408 4066 512 512
ReadX 7408 4578 512 512
ReadX 7408 5090 512 512
ReadX 7408 5602 512 512
ReadX 7408 6114 512 512
ReadX 7408 6626 512 512
ReadX 7408 7138 512 512
ReadX 7408 7650 394 394
ReadX 7408 4052 118 118
ReadX 7408 4170 512 512
ReadX 7408 4682 512 512
ReadX 7408 5194 512 512
ReadX 7408 5706 512 512
ReadX 7408 6218 512 512
ReadX 7408 6730 512 512
ReadX 7408 7242 394 394
ReadX 7408 4082 118 118
ReadX 7408 4200 512 512
ReadX 7408 4712 512 512
ReadX 7408 5224 512 512
ReadX 7408 5736 512 512
ReadX 7408 6248 512 512
ReadX 7408 6760 512 512
ReadX 7408 7272 512 512
ReadX 7408 7784 394 394
ReadX 7408 256 118 118
ReadX 7408 374 512 512
ReadX 7408 886 512 512
ReadX 7408 1398 512 512
ReadX 7408 1910 512 512
ReadX 7408 2422 512 512
ReadX 7408 2934 512 512
ReadX 7408 3446 512 512
ReadX 7408 3958 512 512
ReadX 7408 4470 512 512
ReadX 7408 4982 512 512
ReadX 7408 5494 512 512
ReadX 7408 6006 512 512
ReadX 7408 6518 512 512
ReadX 7408 7030 512 512
ReadX 7408 7542 512 512
ReadX 7408 8054 512 512
ReadX 7408 8566 512 512
ReadX 7408 9078 512 512
ReadX 7408 9590 512 512
ReadX 7408 10102 512 512
ReadX 7408 259 512 512
ReadX 7408 771 512 512
ReadX 7408 259 512 512
ReadX 7408 259 512 512
ReadX 7408 771 512 512
ReadX 7408 1283 512 512
ReadX 7408 1795 512 512
ReadX 7408 2307 512 512
ReadX 7408 2819 512 512
ReadX 7408 3331 512 512
ReadX 7408 3843 512 512
ReadX 7408 4355 512 512
ReadX 7408 4867 512 512
ReadX 7408 260 512 512
ReadX 7408 772 512 512
ReadX 7408 1284 512 512
ReadX 7408 1796 512 512
ReadX 7408 2308 512 512
ReadX 7408 2820 512 512
ReadX 7408 3332 512 512
ReadX 7408 3844 512 512
ReadX 7408 4356 512 512
ReadX 7408 4868 512 512
ReadX 7408 5380 512 512
ReadX 7408 5892 512 512
ReadX 7408 6404 512 512
ReadX 7408 6916 512 512
ReadX 7408 7428 512 512
ReadX 7408 7940 512 512
ReadX 7408 8452 512 512
ReadX 7408 8964 512 512
ReadX 7408 9476 512 512
ReadX 7408 9988 512 512
ReadX 7408 10500 378 378
ReadX 7408 10878 512 512
ReadX 7408 11390 134 134
ReadX 7408 11524 512 512
ReadX 7408 12036 512 512
ReadX 7408 12548 512 512
ReadX 7408 13060 512 512
ReadX 7408 13572 138 138
ReadX 7408 259 512 512
ReadX 7408 273 512 512
ReadX 7408 276 512 512
ReadX 7408 295 512 512
ReadX 7408 288 512 512
ReadX 7408 296 512 512
ReadX 7408 259 512 512
ReadX 7408 273 512 512
ReadX 7408 273 512 512
ReadX 7408 785 512 512
ReadX 7408 1297 512 512
ReadX 7408 1809 512 512
ReadX 7408 2321 512 512
ReadX 7408 274 512 512
ReadX 7408 274 512 512
ReadX 7408 274 497 497
ReadX 7408 272 15 15
ReadX 7408 287 512 512
ReadX 7408 799 512 512
ReadX 7408 273 512 512
ReadX 7408 785 512 512
ReadX 7408 1297 512 512
ReadX 7408 1809 512 512
ReadX 7408 2321 512 512
ReadX 7408 2833 317 317
ReadX 7408 274 195 195
ReadX 7408 469 512 512
ReadX 7408 981 512 512
ReadX 7408 1493 512 512
ReadX 7408 2005 512 512
ReadX 7408 2517 512 512
ReadX 7408 3029 512 512
ReadX 7408 3541 512 512
ReadX 7408 4053 512 512
ReadX 7408 4565 250 250
ReadX 7408 274 512 512
ReadX 7408 283 512 512
ReadX 7408 795 512 512
ReadX 7408 276 512 512
ReadX 7408 788 512 512
ReadX 7408 1300 512 512
ReadX 7408 1812 512 512
ReadX 7408 2324 512 512
ReadX 7408 2836 512 512
ReadX 7408 3348 512 512
ReadX 7408 3860 420 420
ReadX 7408 275 92 92
ReadX 7408 367 512 512
ReadX 7408 879 512 512
ReadX 7408 1391 512 512
ReadX 7408 1903 512 512
ReadX 7408 2415 512 512
ReadX 7408 2927 512 512
ReadX 7408 3439 420 420
ReadX 7408 277 92 92
ReadX 7408 369 512 512
ReadX 7408 881 512 512
ReadX 7408 1393 512 512
ReadX 7408 1905 512 512
ReadX 7408 2417 512 512
ReadX 7408 2929 512 512
ReadX 7408 3441 512 512
ReadX 7408 3953 512 512
ReadX 7408 4465 512 512
ReadX 7408 4977 512 512
ReadX 7408 5489 512 512
ReadX 7408 6001 512 512
ReadX 7408 6513 512 512
ReadX 7408 7025 512 512
ReadX 7408 7537 512 512
ReadX 7408 8049 512 512
ReadX 7408 8561 512 512
ReadX 7408 9073 512 512
ReadX 7408 9585 512 512
ReadX 7408 10097 512 512
ReadX 7408 282 512 512
ReadX 7408 794 512 512
ReadX 7408 1306 512 512
ReadX 7408 1818 512 512
ReadX 7408 2330 512 512
ReadX 7408 2842 512 512
ReadX 7408 3354 512 512
ReadX 7408 3866 512 512
ReadX 7408 4378 512 512
ReadX 7408 284 512 512
ReadX 7408 796 512 512
ReadX 7408 1308 512 512
ReadX 7408 1820 512 512
ReadX 7408 2332 512 512
ReadX 7408 2844 512 512
ReadX 7408 3356 512 512
ReadX 7408 3868 512 512
ReadX 7408 4380 512 512
ReadX 7408 4892 512 512
ReadX 7408 5404 512 512
ReadX 7408 5916 512 512
ReadX 7408 6428 512 512
ReadX 7408 6940 512 512
ReadX 7408 7452 512 512
ReadX 7408 7964 512 512
ReadX 7408 8476 512 512
ReadX 7408 8988 512 512
ReadX 7408 9500 512 512
ReadX 7408 10012 512 512
ReadX 7408 10524 472 472
ReadX 7408 288 40 40
ReadX 7408 328 512 512
ReadX 7408 840 512 512
ReadX 7408 1352 512 512
ReadX 7408 1864 512 512
ReadX 7408 2376 512 512
ReadX 7408 2888 512 512
ReadX 7408 3400 512 512
ReadX 7408 3912 512 512
ReadX 7408 4424 512 512
ReadX 7408 4936 512 512
ReadX 7408 5448 512 512
ReadX 7408 5960 512 512
ReadX 7408 6472 512 512
ReadX 7408 6984 512 512
ReadX 7408 7496 512 512
ReadX 7408 8008 512 512
ReadX 7408 8520 512 512
ReadX 7408 9032 512 512
ReadX 7408 9544 512 512
ReadX 7408 10056 512 512
ReadX 7408 10568 506 506
ReadX 7408 282 512 512
ReadX 7408 794 512 512
ReadX 7408 301 512 512
ReadX 7408 296 512 512
ReadX 7408 808 512 512
ReadX 7408 1320 512 512
ReadX 7408 1832 512 512
ReadX 7408 2344 512 512
ReadX 7408 2856 512 512
ReadX 7408 3368 512 512
ReadX 7408 3880 424 424
ReadX 7408 295 88 88
ReadX 7408 383 512 512
ReadX 7408 895 512 512
ReadX 7408 1407 512 512
ReadX 7408 1919 512 512
ReadX 7408 2431 512 512
ReadX 7408 2943 512 512
ReadX 7408 3455 424 424
ReadX 7408 297 88 88
ReadX 7408 385 512 512
ReadX 7408 897 512 512
ReadX 7408 1409 512 512
ReadX 7408 1921 512 512
ReadX 7408 2433 512 512
ReadX 7408 2945 512 512
ReadX 7408 3457 512 512
ReadX 7408 3969 512 512
ReadX 7408 4481 512 512
ReadX 7408 4993 512 512
ReadX 7408 5505 512 512
ReadX 7408 6017 512 512
ReadX 7408 6529 512 512
ReadX 7408 7041 512 512
ReadX 7408 7553 512 512
ReadX 7408 8065 512 512
ReadX 7408 8577 512 512
ReadX 7408 9089 512 512
ReadX 7408 9601 512 512
ReadX 7408 10113 512 512
ReadX 7408 301 512 512
ReadX 7408 301 512 512
ReadX 7408 301 512 512
ReadX 7408 813 512 512
ReadX 7408 301 512 512
ReadX 7408 813 512 512
ReadX 7408 1325 512 512
ReadX 7408 1837 512 512
ReadX 7408 2349 512 512
ReadX 7408 2861 512 512
ReadX 7408 3373 512 512
ReadX 7408 3885 512 512
ReadX 7408 4397 512 512
ReadX 7408 4909 512 512
ReadX 7408 5421 512 512
ReadX 7408 5933 512 512
ReadX 7408 6445 512 512
ReadX 7408 6957 512 512
ReadX 7408 7469 512 512
ReadX 7408 7981 512 512
ReadX 7408 8493 512 512
ReadX 7408 9005 512 512
ReadX 7408 9517 463 463
ReadX 7408 9980 512 512
ReadX 7408 10492 49 49
ReadX 7408 10541 512 512
ReadX 7408 11053 512 512
ReadX 7408 11565 512 512
ReadX 7408 12077 512 512
ReadX 7408 12589 512 512
ReadX 7408 13101 512 512
ReadX 7408 13613 512 512
ReadX 7408 14125 512 512
ReadX 7408 14637 512 512
ReadX 7408 15149 512 512
ReadX 7408 15661 512 512
ReadX 7408 16173 512 512
ReadX 7408 16685 512 512
ReadX 7408 17197 512 512
ReadX 7408 17709 512 512
ReadX 7408 18221 512 512
ReadX 7408 18733 512 512
ReadX 7408 19245 512 512
ReadX 7408 19757 512 512
ReadX 7408 20269 512 512
ReadX 7408 20781 326 326
ReadX 7408 301 512 512
QUERY_FS_INFORMATION 259
Close 7406
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7409
Close 7409
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7410
ReadX 7410 0 24 24
Close 7410
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7411
QUERY_FILE_INFORMATION 7411
ReadX 7411 0 512 512
ReadX 7411 476 512 512
ReadX 7411 510 512 512
ReadX 7411 484 512 512
ReadX 7411 474 512 512
ReadX 7411 478 512 512
ReadX 7411 990 512 512
ReadX 7411 509 57 57
Close 7411
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7412
QUERY_FILE_INFORMATION 7412
ReadX 7412 0 512 512
ReadX 7412 476 512 512
ReadX 7412 510 512 512
ReadX 7412 484 512 512
ReadX 7412 480 512 512
ReadX 7412 474 512 512
ReadX 7412 478 512 512
QUERY_FILE_INFORMATION 7412
WriteX 7412 494 60 60
WriteX 7412 494 4 4
QUERY_FILE_INFORMATION 7412
WriteX 7412 494 11 11
WriteX 7412 510 512 512
WriteX 7412 484 512 512
WriteX 7412 474 512 512
WriteX 7412 478 512 512
WriteX 7412 990 512 512
Close 7412
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 7413
Close 7413
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 7414
Close 7414
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 7416
WriteX 7416 4607 1 1
QUERY_FILE_INFORMATION 7416
WriteX 7416 0 65471 65471
WriteX 7416 65471 65 65
WriteX 7416 65536 19490 19490
Close 7416
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7417
QUERY_FILE_INFORMATION 7417
ReadX 7417 0 512 512
ReadX 7417 482 512 512
ReadX 7417 994 512 512
ReadX 7417 1506 512 512
ReadX 7417 480 512 512
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 490 448 448
QUERY_FILE_INFORMATION 7417
WriteX 7417 490 60 60
WriteX 7417 490 4 4
QUERY_FILE_INFORMATION 7417
WriteX 7417 490 11 11
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 484 512 512
WriteX 7417 996 512 512
WriteX 7417 1508 512 512
WriteX 7417 482 512 512
WriteX 7417 0 512 512
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
ReadX 7417 490 512 512
WriteX 7417 502 512 512
WriteX 7417 502 292 292
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 503 20 20
WriteX 7417 503 108 108
QUERY_FILE_INFORMATION 7417
WriteX 7417 504 448 448
QUERY_FILE_INFORMATION 7417
WriteX 7417 504 44 44
WriteX 7417 504 20 20
WriteX 7417 500 512 512
WriteX 7417 492 512 512
WriteX 7417 496 512 512
WriteX 7417 1008 512 512
WriteX 7417 494 512 512
Flush 7417
WriteX 7417 0 512 512
Flush 7417
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 500 512 512
WriteX 7417 492 512 512
WriteX 7417 496 512 512
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 518 320 320
QUERY_FILE_INFORMATION 7417
WriteX 7417 518 60 60
ReadX 7417 504 512 512
WriteX 7417 522 512 512
WriteX 7417 506 3204 3204
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 519 25 25
WriteX 7417 518 103 103
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 519 44 44
WriteX 7417 519 20 20
WriteX 7417 520 512 512
WriteX 7417 482 512 512
WriteX 7417 486 512 512
WriteX 7417 998 512 512
WriteX 7417 484 512 512
WriteX 7417 490 512 512
Flush 7417
WriteX 7417 0 512 512
Flush 7417
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
QUERY_FILE_INFORMATION 7417
WriteX 7417 519 7 7
WriteX 7417 519 57 57
WriteX 7417 520 512 512
WriteX 7417 492 512 512
WriteX 7417 482 512 512
WriteX 7417 486 512 512
WriteX 7417 998 512 512
Flush 7417
WriteX 7417 520 512 512
Flush 7417
Close 7417
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7418
Close 7418
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 7419
QUERY_FILE_INFORMATION 7419
ReadX 7419 0 512 512
ReadX 7419 490 512 512
ReadX 7419 484 512 512
ReadX 7419 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 7420
Close 7420
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 7419
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 7421
Close 7421
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 7422
ReadX 7422 0 24 24
Close 7422
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 7423
QUERY_FILE_INFORMATION 7423
ReadX 7423 0 512 512
ReadX 7423 366 512 512
ReadX 7423 878 512 512
ReadX 7423 1390 512 512
ReadX 7423 1902 512 512
ReadX 7423 374 57 57
Close 7423
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 7424
QUERY_FILE_INFORMATION 7424
ReadX 7424 0 512 512
ReadX 7424 366 512 512
ReadX 7424 878 512 512
ReadX 7424 1390 512 512
ReadX 7424 1902 512 512
QUERY_FILE_INFORMATION 7424
WriteX 7424 374 60 60
WriteX 7424 374 4 4
QUERY_FILE_INFORMATION 7424
WriteX 7424 374 11 11
ReadX 7424 374 57 57
ReadX 7424 374 57 57
ReadX 7424 292 4096 4096
ReadX 7424 364 512 512
ReadX 7424 512 4096 4096
ReadX 7424 4608 4096 4096
ReadX 7424 8704 4096 4096
ReadX 7424 12800 4096 4096
ReadX 7424 16896 4096 4096
ReadX 7424 20992 4096 4096
ReadX 7424 25088 4096 4096
ReadX 7424 29184 4096 4096
ReadX 7424 33280 4096 4096
ReadX 7424 37376 4096 4096
ReadX 7424 41472 4096 4096
ReadX 7424 45568 4096 4096
ReadX 7424 49664 4096 4096
ReadX 7424 53760 4096 4096
ReadX 7424 57856 4096 4096
ReadX 7424 61952 4096 4096
ReadX 7424 66048 4096 4096
ReadX 7424 70144 4096 4096
ReadX 7424 74240 162 162
ReadX 7424 308 4096 4096
ReadX 7424 4404 4096 4096
WriteX 7424 368 512 512
WriteX 7424 880 512 512
WriteX 7424 1392 512 512
Close 7424
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 7425
Close 7425
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 7426
QUERY_FILE_INFORMATION 7426
ReadX 7426 0 512 512
ReadX 7426 366 512 512
ReadX 7426 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 7427
Close 7427
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 7426
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 7429
WriteX 7429 4607 1 1
QUERY_FILE_INFORMATION 7429
WriteX 7429 0 65471 65471
WriteX 7429 65471 65 65
WriteX 7429 65536 8866 8866
Close 7429
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7430
QUERY_FILE_INFORMATION 7430
ReadX 7430 0 512 512
ReadX 7430 366 512 512
ReadX 7430 878 512 512
ReadX 7430 1390 512 512
ReadX 7430 364 512 512
QUERY_FILE_INFORMATION 7430
QUERY_FILE_INFORMATION 7430
QUERY_FILE_INFORMATION 7430
WriteX 7430 374 448 448
QUERY_FILE_INFORMATION 7430
WriteX 7430 374 60 60
WriteX 7430 374 4 4
QUERY_FILE_INFORMATION 7430
WriteX 7430 374 11 11
QUERY_FILE_INFORMATION 7430
QUERY_FILE_INFORMATION 7430
WriteX 7430 374 7 7
WriteX 7430 374 57 57
WriteX 7430 368 512 512
WriteX 7430 880 512 512
WriteX 7430 1392 512 512
WriteX 7430 366 512 512
WriteX 7430 0 512 512
Flush 7430
WriteX 7430 368 512 512
Flush 7430
Close 7430
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7431
QUERY_FILE_INFORMATION 7431
ReadX 7431 0 512 512
ReadX 7431 366 512 512
ReadX 7431 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 7431
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7432
Close 7432
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7433
ReadX 7433 0 24 24
Close 7433
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7434
QUERY_FILE_INFORMATION 7434
ReadX 7434 0 512 512
ReadX 7434 366 512 512
ReadX 7434 878 512 512
ReadX 7434 1390 512 512
ReadX 7434 1902 512 512
ReadX 7434 374 57 57
Close 7434
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7435
QUERY_FILE_INFORMATION 7435
ReadX 7435 0 512 512
ReadX 7435 366 512 512
ReadX 7435 878 512 512
ReadX 7435 1390 512 512
ReadX 7435 1902 512 512
QUERY_FILE_INFORMATION 7435
WriteX 7435 374 60 60
WriteX 7435 374 4 4
QUERY_FILE_INFORMATION 7435
WriteX 7435 374 11 11
WriteX 7435 368 512 512
WriteX 7435 880 512 512
WriteX 7435 1392 512 512
Close 7435
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 7436
Close 7436
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 7437
Close 7437
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 7439
WriteX 7439 4607 1 1
QUERY_FILE_INFORMATION 7439
WriteX 7439 0 65471 65471
WriteX 7439 65471 65 65
WriteX 7439 65536 9298 9298
Close 7439
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7440
QUERY_FILE_INFORMATION 7440
ReadX 7440 0 512 512
ReadX 7440 368 512 512
ReadX 7440 880 512 512
ReadX 7440 1392 512 512
ReadX 7440 366 512 512
QUERY_FILE_INFORMATION 7440
QUERY_FILE_INFORMATION 7440
QUERY_FILE_INFORMATION 7440
WriteX 7440 376 448 448
QUERY_FILE_INFORMATION 7440
WriteX 7440 376 60 60
WriteX 7440 376 4 4
QUERY_FILE_INFORMATION 7440
WriteX 7440 376 11 11
QUERY_FILE_INFORMATION 7440
QUERY_FILE_INFORMATION 7440
WriteX 7440 376 7 7
WriteX 7440 376 57 57
WriteX 7440 370 512 512
WriteX 7440 882 512 512
WriteX 7440 1394 512 512
WriteX 7440 368 512 512
WriteX 7440 0 512 512
Flush 7440
WriteX 7440 370 512 512
Flush 7440
Close 7440
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7441
Close 7441
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7442
QUERY_FILE_INFORMATION 7442
ReadX 7442 0 512 512
ReadX 7442 368 512 512
ReadX 7442 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 7443
Close 7443
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 7445
Close 7445
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 7446
ReadX 7446 0 24 24
Close 7446
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 7447
QUERY_FILE_INFORMATION 7447
ReadX 7447 0 512 512
ReadX 7447 512 512 512
ReadX 7447 1024 512 512
ReadX 7447 2016 512 512
ReadX 7447 1056 512 512
ReadX 7447 1096 57 57
Close 7447
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 7448
QUERY_FILE_INFORMATION 7448
ReadX 7448 0 512 512
ReadX 7448 512 512 512
ReadX 7448 1024 512 512
ReadX 7448 2016 512 512
ReadX 7448 1056 512 512
ReadX 7448 1096 57 57
ReadX 7448 1096 57 57
ReadX 7448 1088 62 62
ReadX 7448 1536 4096 4096
ReadX 7448 5632 4096 4096
ReadX 7448 9728 4096 4096
ReadX 7448 13824 2859 2859
ReadX 7448 1120 28 28
ReadX 7448 1148 20 20
ReadX 7448 1168 8 8
ReadX 7448 1176 88 88
ReadX 7448 1264 8 8
ReadX 7448 1272 4 4
ReadX 7448 1276 4 4
ReadX 7448 1280 1 1
ReadX 7448 1130 4 4
ReadX 7448 1134 4 4
ReadX 7448 1138 1 1
ReadX 7448 1131 4 4
ReadX 7448 1135 4 4
ReadX 7448 1139 1 1
ReadX 7448 1131 4 4
ReadX 7448 1135 4 4
ReadX 7448 1139 2 2
ReadX 7448 1132 4 4
ReadX 7448 1136 4 4
ReadX 7448 1140 25 25
ReadX 7448 1134 4 4
ReadX 7448 1138 8 8
ReadX 7448 1146 4 4
ReadX 7448 1150 8 8
ReadX 7448 1158 4 4
ReadX 7448 1162 8 8
ReadX 7448 1170 4 4
ReadX 7448 1174 4 4
ReadX 7448 1178 4 4
ReadX 7448 1182 4 4
ReadX 7448 1186 4 4
ReadX 7448 1190 4 4
ReadX 7448 1194 13900 13900
ReadX 7448 2048 4096 4096
Close 7448
QUERY_FS_INFORMATION 259
Close 7442
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7449
Close 7449
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7450
ReadX 7450 0 24 24
Close 7450
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7451
QUERY_FILE_INFORMATION 7451
ReadX 7451 0 512 512
ReadX 7451 368 512 512
ReadX 7451 880 512 512
ReadX 7451 1392 512 512
ReadX 7451 1904 512 512
ReadX 7451 376 57 57
Close 7451
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7452
QUERY_FILE_INFORMATION 7452
ReadX 7452 0 512 512
ReadX 7452 368 512 512
ReadX 7452 880 512 512
ReadX 7452 1392 512 512
ReadX 7452 1904 512 512
QUERY_FILE_INFORMATION 7452
WriteX 7452 376 60 60
WriteX 7452 376 4 4
QUERY_FILE_INFORMATION 7452
WriteX 7452 376 11 11
WriteX 7452 370 512 512
WriteX 7452 882 512 512
WriteX 7452 1394 512 512
Close 7452
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 7453
Close 7453
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 7454
Close 7454
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 7456
WriteX 7456 4607 1 1
QUERY_FILE_INFORMATION 7456
WriteX 7456 0 65471 65471
WriteX 7456 65471 65 65
WriteX 7456 65536 11540 11540
Close 7456
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7457
QUERY_FILE_INFORMATION 7457
ReadX 7457 0 512 512
ReadX 7457 398 512 512
ReadX 7457 910 512 512
ReadX 7457 1422 512 512
ReadX 7457 396 512 512
QUERY_FILE_INFORMATION 7457
QUERY_FILE_INFORMATION 7457
QUERY_FILE_INFORMATION 7457
WriteX 7457 406 448 448
QUERY_FILE_INFORMATION 7457
WriteX 7457 406 60 60
WriteX 7457 406 4 4
QUERY_FILE_INFORMATION 7457
WriteX 7457 406 11 11
QUERY_FILE_INFORMATION 7457
QUERY_FILE_INFORMATION 7457
WriteX 7457 406 7 7
WriteX 7457 406 57 57
WriteX 7457 400 512 512
WriteX 7457 912 512 512
WriteX 7457 1424 512 512
WriteX 7457 398 512 512
WriteX 7457 0 512 512
Flush 7457
WriteX 7457 400 512 512
Flush 7457
Close 7457
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7458
Close 7458
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 7459
QUERY_FILE_INFORMATION 7459
ReadX 7459 0 512 512
ReadX 7459 398 512 512
ReadX 7459 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 7460
Close 7460
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 7459
ReadX 7408 1434 512 512
Close 7408
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 7461
WriteX 7461 0 65471 65471
WriteX 7461 65471 63 63
WriteX 7461 65534 65471 65471
WriteX 7461 131005 63 63
Close 7461
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 7462
WriteX 7462 0 65471 65471
WriteX 7462 65471 63 63
WriteX 7462 65534 65471 65471
WriteX 7462 131005 63 63
WriteX 7462 131068 65471 65471
WriteX 7462 196539 63 63
WriteX 7462 196602 65471 65471
WriteX 7462 262073 63 63
Close 7462
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 7463
WriteX 7463 0 65471 65471
WriteX 7463 65471 63 63
WriteX 7463 65534 65471 65471
WriteX 7463 131005 63 63
WriteX 7463 131068 65471 65471
WriteX 7463 196539 63 63
WriteX 7463 196602 65471 65471
WriteX 7463 262073 63 63
WriteX 7463 262136 65471 65471
WriteX 7463 327607 63 63
WriteX 7463 327670 65471 65471
WriteX 7463 393141 63 63
WriteX 7463 393204 65471 65471
WriteX 7463 458675 63 63
WriteX 7463 458738 65471 65471
WriteX 7463 524209 63 63
Close 7463
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7464
Close 7464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 7465
ReadX 7465 0 512 512
ReadX 7465 512 511 511
ReadX 7465 1023 512 512
ReadX 7465 1535 512 512
Close 7465
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 7466
ReadX 7466 0 512 512
ReadX 7466 512 510 510
ReadX 7466 1022 512 512
ReadX 7466 1534 510 510
ReadX 7466 2044 510 510
Close 7466
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 7467
ReadX 7467 0 512 512
ReadX 7467 512 512 512
ReadX 7467 1024 512 512
ReadX 7467 1536 512 512
ReadX 7467 2048 512 512
ReadX 7467 2560 512 512
ReadX 7467 3072 512 512
ReadX 7467 3584 512 512
ReadX 7467 4096 512 512
ReadX 7467 4608 512 512
ReadX 7467 5120 512 512
ReadX 7467 5632 512 512
ReadX 7467 6144 512 512
ReadX 7467 6656 512 512
ReadX 7467 7168 512 512
ReadX 7467 7680 512 512
ReadX 7467 8192 512 512
ReadX 7467 8704 512 512
Close 7467
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7468
Close 7468
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 7469
QUERY_FILE_INFORMATION 7469
Close 7469
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 7470
ReadX 7470 0 8192 8192
Close 7470
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 7471
Close 7471
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 7472
QUERY_FILE_INFORMATION 7472
Close 7472
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 7473
ReadX 7473 0 8192 8192
Close 7473
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7474
Close 7474
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 7475
QUERY_FILE_INFORMATION 7475
Close 7475
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 7476
ReadX 7476 0 8192 8192
Close 7476
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 7477
ReadX 7477 0 8192 8192
ReadX 7477 8192 8192 8192
ReadX 7477 16384 8192 8192
ReadX 7477 24576 8192 8192
Close 7477
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 7479
Close 7479
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 7481
WriteX 7481 8191 1 1
QUERY_FILE_INFORMATION 7481
WriteX 7481 0 10438 10438
Close 7481
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 7482
Close 7482
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 7483
QUERY_FILE_INFORMATION 7483
QUERY_FILE_INFORMATION 7483
Close 7483
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 7484
QUERY_FILE_INFORMATION 7484
QUERY_FILE_INFORMATION 7484
Close 7484
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 7485
Close 7485
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 7486
QUERY_FILE_INFORMATION 7486
QUERY_FILE_INFORMATION 7486
Close 7486
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 7487
QUERY_FILE_INFORMATION 7487
QUERY_FILE_INFORMATION 7487
Close 7487
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 7488
Close 7488
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 7489
QUERY_FILE_INFORMATION 7489
QUERY_FILE_INFORMATION 7489
Close 7489
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 7490
QUERY_FILE_INFORMATION 7490
QUERY_FILE_INFORMATION 7490
Close 7490
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 7491
Close 7491
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 7492
QUERY_FILE_INFORMATION 7492
QUERY_FILE_INFORMATION 7492
Close 7492
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 7493
ReadX 7493 0 8 8
ReadX 7493 8 4 4
ReadX 7493 12 8 8
ReadX 7493 22 8 8
ReadX 7493 520 8 8
ReadX 7493 525 8 8
ReadX 7493 533 4 4
ReadX 7493 543 8 8
ReadX 7493 551 4 4
ReadX 7493 1058 8 8
ReadX 7493 1066 4 4
ReadX 7493 1081 8 8
ReadX 7493 1089 4 4
ReadX 7493 660 8 8
Close 7493
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 7494
ReadX 7494 0 8192 8192
Close 7494
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 7495
ReadX 7495 0 8192 8192
ReadX 7495 520 8192 8192
ReadX 7495 8712 8192 8192
ReadX 7495 16904 8192 8192
ReadX 7495 25096 8192 8192
ReadX 7495 33288 8192 8192
ReadX 7495 41480 8192 8192
ReadX 7495 49672 8192 8192
ReadX 7495 57864 8192 8192
ReadX 7495 66056 8192 8192
ReadX 7495 74248 8192 8192
ReadX 7495 82440 8192 8192
ReadX 7495 90632 8192 8192
ReadX 7495 98824 8192 8192
ReadX 7495 107016 8192 8192
ReadX 7495 115208 8192 8192
ReadX 7495 123400 8192 8192
ReadX 7495 131592 8192 8192
ReadX 7495 139784 8192 8192
ReadX 7495 147976 8192 8192
ReadX 7495 156168 8192 8192
Close 7495
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 7496
QUERY_FILE_INFORMATION 7496
Close 7496
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 7497
Close 7497
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 7499
WriteX 7499 8191 1 1
QUERY_FILE_INFORMATION 7499
WriteX 7499 0 28489 28489
Close 7499
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 7500
Close 7500
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 7501
Close 7501
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 7502
QUERY_FILE_INFORMATION 7502
Close 7502
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 7503
ReadX 7503 0 8192 8192
Close 7503
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7504
Close 7504
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 7505
QUERY_FILE_INFORMATION 7505
Close 7505
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 7506
ReadX 7506 0 8192 8192
Close 7506
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 7507
ReadX 7507 0 8192 8192
ReadX 7507 8192 8192 8192
ReadX 7507 16384 8192 8192
ReadX 7507 24576 8192 8192
ReadX 7507 32768 16384 16384
ReadX 7507 49152 8192 8192
ReadX 7507 57344 8192 8192
ReadX 7507 65536 8192 8192
Close 7507
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 7509
Close 7509
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 7511
WriteX 7511 8191 1 1
QUERY_FILE_INFORMATION 7511
WriteX 7511 0 29253 29253
Close 7511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 7512
Close 7512
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 7513
QUERY_FILE_INFORMATION 7513
QUERY_FILE_INFORMATION 7513
Close 7513
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 7514
QUERY_FILE_INFORMATION 7514
QUERY_FILE_INFORMATION 7514
Close 7514
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 7515
QUERY_FILE_INFORMATION 7515
Close 7515
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 7516
Close 7516
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 7518
WriteX 7518 8191 1 1
QUERY_FILE_INFORMATION 7518
WriteX 7518 0 30183 30183
Close 7518
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 7519
Close 7519
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 7520
WriteX 7520 0 510 510
WriteX 7520 510 512 512
WriteX 7520 1022 510 510
WriteX 7520 1532 510 510
WriteX 7520 2042 168 168
Close 7520
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7521
Close 7521
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 7522
WriteX 7522 0 511 511
WriteX 7522 511 512 512
WriteX 7522 1023 512 512
WriteX 7522 1535 488 488
Close 7522
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 7523
ReadX 7523 0 65471 65471
ReadX 7523 65471 63 63
ReadX 7523 65534 65471 65471
ReadX 7523 131005 63 63
ReadX 7523 131068 65471 65471
ReadX 7523 196539 63 63
ReadX 7523 196602 65471 65471
ReadX 7523 262073 63 63
ReadX 7523 262136 65471 65471
ReadX 7523 327607 63 63
ReadX 7523 327670 10 10
Close 7523
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 7524
ReadX 7524 0 65471 65471
ReadX 7524 65471 63 63
ReadX 7524 65534 65471 65471
ReadX 7524 131005 63 63
ReadX 7524 131068 65471 65471
ReadX 7524 196539 63 63
ReadX 7524 196602 65471 65471
ReadX 7524 262073 63 63
ReadX 7524 262136 65471 65471
ReadX 7524 327607 63 63
ReadX 7524 327670 65471 65471
ReadX 7524 393141 63 63
ReadX 7524 393204 65471 65471
ReadX 7524 458675 63 63
ReadX 7524 458738 65471 65471
ReadX 7524 524209 63 63
ReadX 7524 524272 65471 65471
ReadX 7524 589743 63 63
ReadX 7524 589806 65471 65471
ReadX 7524 655277 63 63
ReadX 7524 655340 32 32
Close 7524
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 7525
ReadX 7525 0 65471 65471
ReadX 7525 65471 63 63
ReadX 7525 65534 65471 65471
ReadX 7525 131005 63 63
ReadX 7525 131068 65471 65471
ReadX 7525 196539 63 63
ReadX 7525 196602 65471 65471
ReadX 7525 262073 63 63
ReadX 7525 262136 65471 65471
ReadX 7525 327607 63 63
ReadX 7525 327670 65471 65471
ReadX 7525 393141 63 63
ReadX 7525 393204 65471 65471
ReadX 7525 458675 63 63
ReadX 7525 458738 65471 65471
ReadX 7525 524209 63 63
ReadX 7525 524272 65471 65471
ReadX 7525 589743 63 63
ReadX 7525 589806 65471 65471
ReadX 7525 655277 63 63
ReadX 7525 655340 65471 65471
ReadX 7525 720811 63 63
ReadX 7525 720874 65471 65471
ReadX 7525 786345 63 63
ReadX 7525 786408 65471 65471
ReadX 7525 851879 63 63
ReadX 7525 851942 65471 65471
ReadX 7525 917413 63 63
ReadX 7525 917476 65471 65471
ReadX 7525 982947 63 63
ReadX 7525 983010 65471 65471
ReadX 7525 1048481 63 63
ReadX 7525 1048544 65471 65471
ReadX 7525 1114015 63 63
ReadX 7525 1114078 65471 65471
ReadX 7525 1179549 63 63
ReadX 7525 1179612 65471 65471
ReadX 7525 1245083 63 63
ReadX 7525 1245146 65471 65471
ReadX 7525 1310617 63 63
ReadX 7525 1310680 65471 65471
ReadX 7525 1376151 63 63
ReadX 7525 1376214 65471 65471
ReadX 7525 1441685 63 63
ReadX 7525 1441748 65471 65471
ReadX 7525 1507219 63 63
ReadX 7525 1507282 65471 65471
ReadX 7525 1572753 63 63
ReadX 7525 1572816 65471 65471
ReadX 7525 1638287 63 63
ReadX 7525 1638350 65471 65471
ReadX 7525 1703821 63 63
ReadX 7525 1703884 65471 65471
ReadX 7525 1769355 63 63
ReadX 7525 1769418 65471 65471
ReadX 7525 1834889 63 63
ReadX 7525 1834952 32824 32824
Close 7525
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 7526
QUERY_FILE_INFORMATION 7526
ReadX 7526 0 512 512
ReadX 7526 512 512 512
ReadX 7526 1024 512 512
QUERY_FILE_INFORMATION 7526
QUERY_FILE_INFORMATION 7526
ReadX 7526 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 7526
QUERY_FILE_INFORMATION 7526
ReadX 7526 512 4096 4096
QUERY_FILE_INFORMATION 7526
QUERY_FILE_INFORMATION 7526
QUERY_FILE_INFORMATION 7526
WriteX 7526 512 4096 4096
WriteX 7526 1024 512 512
ReadX 7526 502 512 512
QUERY_FILE_INFORMATION 7526
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7526 2560 512 512
ReadX 7526 1536 512 512
ReadX 7526 2176 384 384
ReadX 7526 3072 128 128
ReadX 7526 3107 512 512
ReadX 7526 3619 512 512
ReadX 7526 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7526 286 123 123
ReadX 7526 292 24 24
ReadX 7526 512 2048 2048
ReadX 7526 512 2048 2048
ReadX 7526 2560 2048 2048
ReadX 7526 416 1536 1536
ReadX 7526 768 512 512
ReadX 7526 1280 2048 2048
ReadX 7526 3328 2048 2048
ReadX 7526 5376 2048 2048
ReadX 7526 7424 2048 2048
ReadX 7526 9472 2048 2048
ReadX 7526 11520 2048 2048
ReadX 7526 13568 2048 2048
ReadX 7526 15616 2048 2048
ReadX 7526 17664 2048 2048
ReadX 7526 19712 2048 2048
ReadX 7526 21760 2048 2048
ReadX 7526 23808 2048 2048
ReadX 7526 25856 2048 2048
ReadX 7526 27904 2048 2048
ReadX 7526 29952 2048 2048
ReadX 7526 32000 2048 2048
ReadX 7526 34048 2048 2048
ReadX 7526 36096 2048 2048
ReadX 7526 38144 2048 2048
ReadX 7526 40192 2048 2048
ReadX 7526 42240 512 512
ReadX 7526 42752 2048 2048
ReadX 7526 44800 2048 2048
ReadX 7526 46848 2048 2048
ReadX 7526 48896 2048 2048
ReadX 7526 50944 2048 2048
ReadX 7526 52992 2048 2048
ReadX 7526 55040 2048 2048
ReadX 7526 57088 2048 2048
ReadX 7526 316 2048 2048
ReadX 7526 2364 2048 2048
ReadX 7526 4412 2048 2048
ReadX 7526 6460 2048 2048
ReadX 7526 8508 2048 2048
ReadX 7526 10556 2048 2048
ReadX 7526 12604 2048 2048
ReadX 7526 14652 2048 2048
ReadX 7526 16700 2048 2048
ReadX 7526 18748 2048 2048
ReadX 7526 20796 2048 2048
ReadX 7526 22844 2048 2048
ReadX 7526 24892 2048 2048
ReadX 7526 26940 2048 2048
ReadX 7526 28988 2048 2048
ReadX 7526 31036 2048 2048
ReadX 7526 436 2048 2048
ReadX 7526 2484 2048 2048
ReadX 7526 4532 2048 2048
ReadX 7526 6580 2048 2048
ReadX 7526 8628 2048 2048
ReadX 7526 10676 2048 2048
ReadX 7526 476 2048 2048
ReadX 7526 476 2048 2048
ReadX 7526 476 2048 2048
ReadX 7526 2524 2048 2048
ReadX 7526 484 2048 2048
ReadX 7526 484 2048 2048
ReadX 7526 484 2048 2048
ReadX 7526 2532 665 665
ReadX 7526 492 665 665
ReadX 7526 492 665 665
ReadX 7526 492 665 665
ReadX 7526 296 512 512
ReadX 7526 318 512 512
ReadX 7526 300 512 512
ReadX 7526 312 512 512
ReadX 7526 320 512 512
ReadX 7526 832 354 354
ReadX 7526 504 4096 4096
ReadX 7526 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 7527
Close 7527
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 7528
WriteX 7528 1535 1 1
QUERY_FILE_INFORMATION 7528
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7526 296 1251 1251
ReadX 7526 2176 384 384
ReadX 7526 3072 1634 1634
QUERY_FILE_INFORMATION 7528
WriteX 7528 0 57088 57088
WriteX 7528 0 4096 4096
Flush 7528
Close 7526
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 7529
Close 7529
WriteX 7528 0 4096 4096
Close 7528
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 7530
Close 7530
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 7531
QUERY_FILE_INFORMATION 7531
ReadX 7531 0 512 512
ReadX 7531 512 512 512
ReadX 7531 1024 512 512
QUERY_FILE_INFORMATION 7531
QUERY_FILE_INFORMATION 7531
ReadX 7531 512 2048 2048
QUERY_FILE_INFORMATION 7531
QUERY_FILE_INFORMATION 7531
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7531 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 7532
WriteX 7532 1535 1 1
QUERY_FILE_INFORMATION 7532
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7531 1536 512 512
ReadX 7531 288 1251 1251
ReadX 7531 2048 2018 2018
QUERY_FILE_INFORMATION 7532
WriteX 7532 0 51456 51456
WriteX 7532 0 4096 4096
Flush 7532
QUERY_FILE_INFORMATION 7531
QUERY_FILE_INFORMATION 7531
Close 7531
WriteX 7532 0 4096 4096
Close 7532
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 7533
Close 7533
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 7534
QUERY_FILE_INFORMATION 7534
ReadX 7534 0 512 512
ReadX 7534 512 512 512
ReadX 7534 1024 512 512
QUERY_FILE_INFORMATION 7534
QUERY_FILE_INFORMATION 7534
ReadX 7534 512 2048 2048
QUERY_FILE_INFORMATION 7534
QUERY_FILE_INFORMATION 7534
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7534 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 7536
Close 7536
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 7538
WriteX 7538 4045 1 1
QUERY_FILE_INFORMATION 7538
WriteX 7538 0 53077 53077
Close 7538
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 7539
WriteX 7539 1535 1 1
QUERY_FILE_INFORMATION 7539
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7534 1536 512 512
ReadX 7534 288 1251 1251
ReadX 7534 2048 2018 2018
QUERY_FILE_INFORMATION 7539
WriteX 7539 0 65471 65471
WriteX 7539 65471 65 65
WriteX 7539 65536 1856 1856
WriteX 7539 0 4096 4096
Flush 7539
QUERY_FILE_INFORMATION 7534
QUERY_FILE_INFORMATION 7534
Close 7534
WriteX 7539 0 4096 4096
Close 7539
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 7540
Close 7540
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 7541
QUERY_FILE_INFORMATION 7541
ReadX 7541 0 512 512
ReadX 7541 512 512 512
ReadX 7541 1024 512 512
QUERY_FILE_INFORMATION 7541
QUERY_FILE_INFORMATION 7541
ReadX 7541 576 2048 2048
QUERY_FILE_INFORMATION 7541
QUERY_FILE_INFORMATION 7541
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 7543
Close 7543
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 7545
WriteX 7545 4076 1 1
QUERY_FILE_INFORMATION 7545
WriteX 7545 0 7983 7983
Close 7545
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 7547
Close 7547
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 7549
WriteX 7549 4095 1 1
QUERY_FILE_INFORMATION 7549
WriteX 7549 0 65471 65471
WriteX 7549 65471 65 65
WriteX 7549 65536 65471 65471
WriteX 7549 131007 65 65
WriteX 7549 131072 65471 65471
WriteX 7549 196543 65 65
WriteX 7549 196608 65471 65471
WriteX 7549 262079 65 65
WriteX 7549 262144 65471 65471
WriteX 7549 327615 65 65
WriteX 7549 327680 65471 65471
WriteX 7549 393151 65 65
WriteX 7549 393216 65471 65471
WriteX 7549 458687 65 65
WriteX 7549 458752 46731 46731
Close 7549
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 7550
WriteX 7550 1535 1 1
QUERY_FILE_INFORMATION 7550
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7541 1536 512 512
ReadX 7541 2048 2018 2018
ReadX 7541 4096 512 512
ReadX 7541 4608 2197 2197
QUERY_FILE_INFORMATION 7550
WriteX 7550 0 65471 65471
WriteX 7550 65471 65 65
WriteX 7550 65536 22848 22848
WriteX 7550 0 4096 4096
Flush 7550
QUERY_FILE_INFORMATION 7541
QUERY_FILE_INFORMATION 7541
Close 7541
WriteX 7550 0 4096 4096
Close 7550
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 7551
Close 7551
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 7552
QUERY_FILE_INFORMATION 7552
ReadX 7552 0 512 512
ReadX 7552 512 512 512
ReadX 7552 1024 512 512
QUERY_FILE_INFORMATION 7552
QUERY_FILE_INFORMATION 7552
ReadX 7552 576 2048 2048
QUERY_FILE_INFORMATION 7552
QUERY_FILE_INFORMATION 7552
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7552 4096 512 512
Close 7552
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 7553
QUERY_FILE_INFORMATION 7553
ReadX 7553 0 512 512
ReadX 7553 512 512 512
ReadX 7553 1024 512 512
QUERY_FILE_INFORMATION 7553
QUERY_FILE_INFORMATION 7553
ReadX 7553 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 7553
QUERY_FILE_INFORMATION 7553
ReadX 7553 288 4096 4096
QUERY_FILE_INFORMATION 7553
QUERY_FILE_INFORMATION 7553
QUERY_FILE_INFORMATION 7553
WriteX 7553 288 4096 4096
WriteX 7553 1024 512 512
ReadX 7553 1536 512 512
QUERY_FILE_INFORMATION 7553
ReadX 7553 288 2048 2048
ReadX 7553 2336 2048 2048
ReadX 7553 3072 1536 1536
ReadX 7553 544 512 512
ReadX 7553 1056 2048 2048
ReadX 7553 3104 2048 2048
ReadX 7553 5152 2048 2048
ReadX 7553 7200 2048 2048
ReadX 7553 9248 2048 2048
ReadX 7553 11296 2048 2048
ReadX 7553 13344 2048 2048
ReadX 7553 15392 2048 2048
ReadX 7553 17440 2048 2048
ReadX 7553 19488 2048 2048
ReadX 7553 21536 2048 2048
ReadX 7553 23584 2048 2048
ReadX 7553 25632 2048 2048
ReadX 7553 27680 2048 2048
ReadX 7553 29728 2048 2048
ReadX 7553 31776 2048 2048
ReadX 7553 33824 2048 2048
ReadX 7553 35872 2048 2048
ReadX 7553 37920 2048 2048
ReadX 7553 39968 2048 2048
ReadX 7553 42016 512 512
ReadX 7553 42528 512 512
ReadX 7553 43040 1536 1536
ReadX 7553 44576 2048 2048
ReadX 7553 46624 2048 2048
ReadX 7553 48672 2048 2048
ReadX 7553 50720 2048 2048
ReadX 7553 52768 2048 2048
ReadX 7553 54816 2048 2048
ReadX 7553 56864 2048 2048
ReadX 7553 58912 2048 2048
ReadX 7553 60960 2048 2048
ReadX 7553 63008 2048 2048
ReadX 7553 65056 2048 2048
ReadX 7553 67104 2048 2048
ReadX 7553 69152 2048 2048
ReadX 7553 71200 2048 2048
ReadX 7553 73248 2048 2048
ReadX 7553 75296 2048 2048
ReadX 7553 77344 2048 2048
ReadX 7553 79392 2048 2048
ReadX 7553 81440 2048 2048
ReadX 7553 83488 2048 2048
ReadX 7553 85536 512 512
ReadX 7553 86048 512 512
ReadX 7553 86560 1536 1536
ReadX 7553 88096 2048 2048
ReadX 7553 90144 2048 2048
ReadX 7553 92192 2048 2048
ReadX 7553 94240 2048 2048
ReadX 7553 96288 2048 2048
ReadX 7553 552 2048 2048
ReadX 7553 2600 2048 2048
ReadX 7553 4648 2048 2048
ReadX 7553 6696 2048 2048
ReadX 7553 8744 2048 2048
ReadX 7553 10792 2048 2048
ReadX 7553 12840 2048 2048
ReadX 7553 14888 2048 2048
ReadX 7553 16936 2048 2048
ReadX 7553 18984 2048 2048
ReadX 7553 21032 2048 2048
ReadX 7553 23080 2048 2048
ReadX 7553 25128 2048 2048
ReadX 7553 27176 2048 2048
ReadX 7553 29224 2048 2048
ReadX 7553 31272 2048 2048
ReadX 7553 33320 2048 2048
ReadX 7553 35368 2048 2048
ReadX 7553 37416 2048 2048
ReadX 7553 39464 2048 2048
ReadX 7553 41512 512 512
ReadX 7553 42024 512 512
ReadX 7553 42536 1536 1536
ReadX 7553 44072 2048 2048
ReadX 7553 46120 2048 2048
ReadX 7553 48168 2048 2048
ReadX 7553 50216 2048 2048
ReadX 7553 52264 2048 2048
ReadX 7553 54312 2048 2048
ReadX 7553 56360 2048 2048
ReadX 7553 58408 2048 2048
ReadX 7553 60456 2048 2048
ReadX 7553 62504 2048 2048
ReadX 7553 64552 2048 2048
ReadX 7553 66600 2048 2048
ReadX 7553 68648 2048 2048
ReadX 7553 70696 2048 2048
ReadX 7553 72744 2048 2048
ReadX 7553 74792 2048 2048
ReadX 7553 76840 2048 2048
ReadX 7553 78888 2048 2048
ReadX 7553 80936 2048 2048
ReadX 7553 82984 2048 2048
ReadX 7553 85032 512 512
ReadX 7553 85544 2048 2048
ReadX 7553 87592 2048 2048
ReadX 7553 89640 2048 2048
ReadX 7553 91688 2048 2048
ReadX 7553 93736 2048 2048
ReadX 7553 95784 2048 2048
ReadX 7553 97832 2048 2048
ReadX 7553 99880 2048 2048
ReadX 7553 101928 2048 2048
ReadX 7553 103976 2048 2048
ReadX 7553 106024 2048 2048
ReadX 7553 108072 2048 2048
ReadX 7553 110120 2048 2048
ReadX 7553 112168 2048 2048
ReadX 7553 114216 2048 2048
ReadX 7553 116264 2048 2048
ReadX 7553 118312 2048 2048
ReadX 7553 120360 2048 2048
ReadX 7553 122408 2048 2048
ReadX 7553 124456 512 512
ReadX 7553 124968 512 512
ReadX 7553 125480 1536 1536
ReadX 7553 127016 2048 2048
ReadX 7553 129064 2048 2048
ReadX 7553 131112 2048 2048
ReadX 7553 133160 2048 2048
ReadX 7553 135208 2048 2048
ReadX 7553 137256 2048 2048
ReadX 7553 139304 2048 2048
ReadX 7553 141352 2048 2048
ReadX 7553 143400 2048 2048
ReadX 7553 145448 2048 2048
ReadX 7553 147496 2048 2048
ReadX 7553 149544 2048 2048
ReadX 7553 151592 2048 2048
ReadX 7553 153640 2048 2048
ReadX 7553 155688 2048 2048
ReadX 7553 157736 2048 2048
ReadX 7553 159784 2048 2048
ReadX 7553 161832 2048 2048
ReadX 7553 163880 2048 2048
ReadX 7553 165928 2048 2048
ReadX 7553 167976 2048 2048
ReadX 7553 170024 512 512
ReadX 7553 1538 1536 1536
ReadX 7553 3074 2048 2048
ReadX 7553 5122 2048 2048
ReadX 7553 7170 2048 2048
ReadX 7553 9218 2048 2048
ReadX 7553 11266 2048 2048
ReadX 7553 13314 2048 2048
ReadX 7553 15362 2048 2048
ReadX 7553 17410 2048 2048
ReadX 7553 19458 2048 2048
ReadX 7553 21506 2048 2048
ReadX 7553 23554 2048 2048
ReadX 7553 25602 2048 2048
ReadX 7553 27650 2048 2048
ReadX 7553 29698 2048 2048
ReadX 7553 31746 2048 2048
ReadX 7553 33794 2048 2048
ReadX 7553 35842 2048 2048
ReadX 7553 37890 2048 2048
ReadX 7553 39938 2048 2048
ReadX 7553 41986 2048 2048
ReadX 7553 44034 875 875
ReadX 7553 1730 4096 4096
ReadX 7553 1724 1536 1536
ReadX 7553 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 7554
Close 7554
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 7555
WriteX 7555 2047 1 1
QUERY_FILE_INFORMATION 7555
Close 7553
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 7556
Close 7556
WriteX 7555 0 42388 42388
Close 7555
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 7557
Close 7557
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 7558
QUERY_FILE_INFORMATION 7558
ReadX 7558 0 512 512
ReadX 7558 1756 512 512
ReadX 7558 2268 512 512
QUERY_FILE_INFORMATION 7558
QUERY_FILE_INFORMATION 7558
ReadX 7558 1744 512 512
ReadX 7558 2256 512 512
ReadX 7558 2768 512 512
ReadX 7558 3280 512 512
ReadX 7558 3792 512 512
ReadX 7558 4304 512 512
ReadX 7558 512 2048 2048
QUERY_FILE_INFORMATION 7558
QUERY_FILE_INFORMATION 7558
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 7559
WriteX 7559 2047 1 1
QUERY_FILE_INFORMATION 7559
QUERY_FILE_INFORMATION 7558
QUERY_FILE_INFORMATION 7558
Close 7558
WriteX 7559 0 42652 42652
Close 7559
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 7560
Close 7560
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 7561
QUERY_FILE_INFORMATION 7561
ReadX 7561 0 512 512
ReadX 7561 1762 512 512
ReadX 7561 2274 512 512
QUERY_FILE_INFORMATION 7561
QUERY_FILE_INFORMATION 7561
ReadX 7561 1750 512 512
ReadX 7561 2262 512 512
ReadX 7561 2774 512 512
ReadX 7561 3286 512 512
ReadX 7561 3798 512 512
ReadX 7561 4310 512 512
ReadX 7561 512 2048 2048
QUERY_FILE_INFORMATION 7561
QUERY_FILE_INFORMATION 7561
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 7563
Close 7563
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 7565
WriteX 7565 4080 1 1
QUERY_FILE_INFORMATION 7565
WriteX 7565 0 65471 65471
WriteX 7565 65471 65 65
WriteX 7565 65536 49 49
Close 7565
Close 7561
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 7566
WriteX 7566 0 65471 65471
WriteX 7566 65471 63 63
WriteX 7566 65534 65471 65471
WriteX 7566 131005 63 63
Close 7566
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 7567
WriteX 7567 0 65471 65471
WriteX 7567 65471 63 63
WriteX 7567 65534 65471 65471
WriteX 7567 131005 63 63
WriteX 7567 131068 65471 65471
WriteX 7567 196539 63 63
WriteX 7567 196602 65471 65471
WriteX 7567 262073 63 63
Close 7567
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 7568
WriteX 7568 0 65471 65471
WriteX 7568 65471 63 63
WriteX 7568 65534 65471 65471
WriteX 7568 131005 63 63
WriteX 7568 131068 65471 65471
WriteX 7568 196539 63 63
WriteX 7568 196602 65471 65471
WriteX 7568 262073 63 63
WriteX 7568 262136 65471 65471
WriteX 7568 327607 63 63
WriteX 7568 327670 65471 65471
WriteX 7568 393141 63 63
WriteX 7568 393204 65471 65471
WriteX 7568 458675 63 63
WriteX 7568 458738 65471 65471
WriteX 7568 524209 63 63
Close 7568
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 7569
Close 7569
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 7570
Close 7570
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 7573
Close 7573
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 7575
Close 7575
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 7576
Close 7576
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 7579
Close 7579
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 7581
Close 7581
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 7582
Close 7582
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7585
Close 7585
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7589
Close 7589
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7593
Close 7593
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7597
Close 7597
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 7601
Close 7601
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 7605
Close 7605
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 7609
Close 7609
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 7613
Close 7613
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 7615
Close 7615
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 7617
Close 7617
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 7619
WriteX 7619 4095 1 1
QUERY_FILE_INFORMATION 7619
QUERY_FS_INFORMATION 259
WriteX 7619 0 65471 65471
WriteX 7619 65471 65 65
WriteX 7619 65536 65471 65471
WriteX 7619 131007 65 65
WriteX 7619 131072 65471 65471
WriteX 7619 196543 65 65
WriteX 7619 196608 65471 65471
WriteX 7619 262079 65 65
WriteX 7619 262144 26634 26634
Close 7619
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 7624
QUERY_FILE_INFORMATION 7624
QUERY_FILE_INFORMATION 7624
Close 7624
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 7625
Close 7625
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 7626
Close 7626
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 7627
QUERY_FILE_INFORMATION 7627
ReadX 7627 0 512 512
ReadX 7627 288 512 512
ReadX 7627 800 512 512
Close 7627
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 7628
ReadX 7628 0 24 24
Close 7628
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 7629
ReadX 7629 0 24 24
Close 7629
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 7630
QUERY_FILE_INFORMATION 7630
ReadX 7630 0 512 512
ReadX 7630 288 512 512
ReadX 7630 800 512 512
ReadX 7630 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 7630 1759 2849 2849
Close 7630
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 7631
Close 7631
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 7634
Close 7634
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 7636
Close 7636
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 7637
Close 7637
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 7640
Close 7640
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 7642
Close 7642
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7643
Close 7643
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7646
Close 7646
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7650
Close 7650
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7654
Close 7654
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7658
Close 7658
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 7662
Close 7662
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 7666
Close 7666
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 7669
Close 7669
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 7673
Close 7673
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 7677
Close 7677
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 7679
Close 7679
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 7680
Close 7680
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 7689
QUERY_FILE_INFORMATION 7689
QUERY_FILE_INFORMATION 7689
Close 7689
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 7690
Close 7690
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 7691
Close 7691
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 7692
QUERY_FILE_INFORMATION 7692
ReadX 7692 0 512 512
ReadX 7692 288 512 512
ReadX 7692 800 512 512
Close 7692
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 7693
ReadX 7693 0 24 24
Close 7693
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 7694
QUERY_FILE_INFORMATION 7694
ReadX 7694 0 512 512
ReadX 7694 288 512 512
ReadX 7694 800 512 512
ReadX 7694 512 36 36
Close 7694
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 7695
QUERY_FILE_INFORMATION 7695
ReadX 7695 0 512 512
ReadX 7695 288 512 512
ReadX 7695 800 512 512
ReadX 7695 512 682 682
ReadX 7695 3584 106 106
ReadX 7695 3712 10 10
ReadX 7695 3722 10 10
ReadX 7695 512 2048 2048
ReadX 7695 3072 512 512
ReadX 7695 276 84 84
ReadX 7695 273 49 49
ReadX 7695 2560 512 512
Close 7695
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 7705
QUERY_FILE_INFORMATION 7705
QUERY_FILE_INFORMATION 7705
Close 7705
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 7706
Close 7706
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 7707
Close 7707
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 7708
QUERY_FILE_INFORMATION 7708
ReadX 7708 0 512 512
ReadX 7708 288 512 512
ReadX 7708 800 512 512
Close 7708
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 7709
ReadX 7709 0 24 24
Close 7709
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 7710
QUERY_FILE_INFORMATION 7710
ReadX 7710 0 512 512
ReadX 7710 288 512 512
ReadX 7710 800 512 512
ReadX 7710 512 36 36
Close 7710
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 7711
QUERY_FILE_INFORMATION 7711
ReadX 7711 0 512 512
ReadX 7711 288 512 512
ReadX 7711 800 512 512
ReadX 7711 512 682 682
ReadX 7711 3072 106 106
ReadX 7711 3200 10 10
ReadX 7711 3210 10 10
ReadX 7711 512 2048 2048
ReadX 7711 2560 512 512
ReadX 7711 3887 84 84
ReadX 7711 3838 49 49
ReadX 7711 2048 512 512
Close 7711
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 7712
Close 7712
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 7713
QUERY_FILE_INFORMATION 7713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 7713
QUERY_FILE_INFORMATION 7713
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 7714
QUERY_FILE_INFORMATION 7714
QUERY_FILE_INFORMATION 7714
QUERY_FILE_INFORMATION 7714
ReadX 7714 2156 24 24
ReadX 7714 2139 276 276
ReadX 7714 2136 14 14
ReadX 7714 2136 7 7
ReadX 7714 2138 12 12
ReadX 7714 2137 8 8
ReadX 7714 2135 15 15
ReadX 7714 0 16 16
ReadX 7714 16 2048 2048
ReadX 7714 2064 2048 2048
ReadX 7714 257 2048 2048
ReadX 7714 385 2048 2048
ReadX 7714 513 2048 2048
ReadX 7714 641 2048 2048
ReadX 7714 769 2048 2048
ReadX 7714 897 2048 2048
ReadX 7714 1025 2048 2048
ReadX 7714 1153 2048 2048
ReadX 7714 1281 2048 2048
ReadX 7714 1409 2048 2048
ReadX 7714 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 7716
Close 7716
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 7718
WriteX 7718 15 1 1
QUERY_FILE_INFORMATION 7718
WriteX 7718 0 10575 10575
Flush 7718
Close 7718
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 7719
Close 7719
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 7720
QUERY_FILE_INFORMATION 7720
QUERY_FILE_INFORMATION 7720
QUERY_FILE_INFORMATION 7720
ReadX 7720 2157 24 24
ReadX 7720 2139 276 276
ReadX 7720 2137 14 14
ReadX 7720 2137 7 7
ReadX 7720 2139 12 12
ReadX 7720 2138 8 8
ReadX 7720 2136 15 15
Close 7714
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 7721
Close 7721
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 7722
QUERY_FILE_INFORMATION 7722
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 7723
QUERY_FILE_INFORMATION 7723
ReadX 7723 0 512 512
ReadX 7723 512 512 512
ReadX 7723 1024 512 512
QUERY_FILE_INFORMATION 7723
QUERY_FILE_INFORMATION 7723
Close 7723
QUERY_FILE_INFORMATION 7722
ReadX 7722 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 7724
QUERY_FILE_INFORMATION 7724
ReadX 7724 0 512 512
ReadX 7724 512 512 512
ReadX 7724 1024 512 512
ReadX 7724 288 20 20
ReadX 7724 308 2084 2084
ReadX 7724 388 2084 2084
ReadX 7724 388 2084 2084
ReadX 7713 2157 1386 1386
ReadX 7724 2472 399 399
ReadX 7724 3072 1536 1536
ReadX 7724 544 149 149
ReadX 7724 693 485 485
Close 7724
ReadX 7713 2157 4096 4096
ReadX 7713 6253 4096 4096
ReadX 7713 10349 4096 4096
ReadX 7713 14445 4096 4096
ReadX 7713 18541 4096 4096
ReadX 7713 22637 256 256
ReadX 7713 22893 4096 4096
ReadX 7713 26989 4096 4096
ReadX 7713 31085 4096 4096
ReadX 7713 35181 4096 4096
ReadX 7713 39277 4096 4096
ReadX 7713 43373 4096 4096
ReadX 7713 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 7713 2157 1024 1024
ReadX 7713 1667 4688 4688
ReadX 7713 6355 3516 3516
ReadX 7713 9871 16384 16384
ReadX 7713 26255 3771 3771
ReadX 7713 30026 2048 2048
ReadX 7713 32074 1024 1024
ReadX 7713 33098 6652 6652
ReadX 7713 39750 16384 16384
ReadX 7713 56134 10496 10496
ReadX 7713 66630 1784 1784
ReadX 7713 68414 90 90
ReadX 7713 68504 273 273
ReadX 7713 68777 1600 1600
ReadX 7713 70377 640 640
ReadX 7713 71017 1280 1280
ReadX 7713 72297 8464 8464
ReadX 7713 80761 158 158
ReadX 7713 80919 912 912
ReadX 7713 81831 1980 1980
ReadX 7713 83811 2256 2256
ReadX 7713 86067 400 400
ReadX 7713 86467 252 252
ReadX 7713 86719 42 42
ReadX 7713 86761 725 725
ReadX 7713 2009 512 512
ReadX 7713 3895 9 9
ReadX 7713 3781 46 46
ReadX 7713 4059 92 92
ReadX 7713 3781 92 92
ReadX 7713 3986 184 184
ReadX 7713 3987 16384 16384
ReadX 7713 3902 16384 16384
ReadX 7713 3781 10240 10240
ReadX 7713 3821 16384 16384
ReadX 7713 3891 935 935
ReadX 7713 4060 10240 10240
ReadX 7713 4059 184 184
ReadX 7713 256 184 184
ReadX 7713 256 1026 1026
ReadX 7713 3901 326 326
ReadX 7713 3899 652 652
ReadX 7713 256 2 2
ReadX 7713 258 4948 4948
Close 7713
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 7726
Close 7726
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 7728
WriteX 7728 4055 1 1
QUERY_FILE_INFORMATION 7728
WriteX 7728 0 65471 65471
WriteX 7728 65471 65 65
WriteX 7728 65536 65471 65471
WriteX 7728 131007 65 65
WriteX 7728 131072 65471 65471
WriteX 7728 196543 65 65
WriteX 7728 196608 65471 65471
WriteX 7728 262079 65 65
WriteX 7728 262144 65471 65471
WriteX 7728 327615 65 65
WriteX 7728 327680 65471 65471
WriteX 7728 393151 65 65
WriteX 7728 393216 65471 65471
WriteX 7728 458687 65 65
WriteX 7728 458752 65471 65471
WriteX 7728 524223 65 65
WriteX 7728 524288 65471 65471
WriteX 7728 589759 65 65
WriteX 7728 589824 35257 35257
Close 7728
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 7730
Close 7730
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 7732
WriteX 7732 4055 1 1
QUERY_FILE_INFORMATION 7732
WriteX 7732 0 65471 65471
WriteX 7732 65471 65 65
WriteX 7732 65536 65471 65471
WriteX 7732 131007 65 65
WriteX 7732 131072 65471 65471
WriteX 7732 196543 65 65
WriteX 7732 196608 65471 65471
WriteX 7732 262079 65 65
WriteX 7732 262144 65471 65471
WriteX 7732 327615 65 65
WriteX 7732 327680 65471 65471
WriteX 7732 393151 65 65
WriteX 7732 393216 65471 65471
WriteX 7732 458687 65 65
WriteX 7732 458752 65471 65471
WriteX 7732 524223 65 65
WriteX 7732 524288 65471 65471
WriteX 7732 589759 65 65
WriteX 7732 589824 57598 57598
Close 7732
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 7734
WriteX 7734 15 1 1
QUERY_FILE_INFORMATION 7734
WriteX 7734 0 12543 12543
Flush 7734
Close 7734
Close 7720
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 7735
Close 7735
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 7736
QUERY_FILE_INFORMATION 7736
QUERY_FILE_INFORMATION 7736
QUERY_FILE_INFORMATION 7736
ReadX 7736 288 24 24
ReadX 7736 287 276 276
ReadX 7736 286 14 14
ReadX 7736 286 7 7
ReadX 7736 287 12 12
ReadX 7736 287 8 8
ReadX 7736 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 7737
Close 7737
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 7738
QUERY_FILE_INFORMATION 7738
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 7738
QUERY_FILE_INFORMATION 7738
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 7739
QUERY_FILE_INFORMATION 7739
QUERY_FILE_INFORMATION 7739
QUERY_FILE_INFORMATION 7739
ReadX 7739 1938 24 24
ReadX 7739 1920 276 276
ReadX 7739 1918 14 14
ReadX 7739 1918 7 7
ReadX 7739 1919 12 12
ReadX 7739 1919 8 8
ReadX 7739 1917 15 15
ReadX 7739 0 16 16
ReadX 7739 16 2048 2048
ReadX 7739 2064 2048 2048
ReadX 7739 257 2048 2048
ReadX 7739 385 2048 2048
ReadX 7739 513 2048 2048
ReadX 7739 641 2048 2048
ReadX 7739 769 2048 2048
ReadX 7739 897 2048 2048
ReadX 7739 1025 2048 2048
ReadX 7739 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 7741
Close 7741
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 7743
WriteX 7743 15 1 1
QUERY_FILE_INFORMATION 7743
WriteX 7743 0 11588 11588
Flush 7743
Close 7743
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 7744
Close 7744
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 7745
QUERY_FILE_INFORMATION 7745
QUERY_FILE_INFORMATION 7745
QUERY_FILE_INFORMATION 7745
ReadX 7745 1909 24 24
ReadX 7745 1892 276 276
ReadX 7745 1889 14 14
ReadX 7745 1889 7 7
ReadX 7745 1891 12 12
ReadX 7745 1890 8 8
ReadX 7745 1888 15 15
Close 7739
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 7747
WriteX 7747 15 1 1
QUERY_FILE_INFORMATION 7747
WriteX 7747 0 11615 11615
Flush 7747
Close 7747
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 7745
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 7748
Close 7748
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 7749
QUERY_FILE_INFORMATION 7749
QUERY_FILE_INFORMATION 7749
QUERY_FILE_INFORMATION 7749
ReadX 7749 1947 24 24
ReadX 7749 1929 276 276
ReadX 7749 1927 14 14
ReadX 7749 1927 7 7
ReadX 7749 1929 12 12
ReadX 7749 1928 8 8
ReadX 7749 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 7751
Close 7751
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 7753
WriteX 7753 4088 1 1
QUERY_FILE_INFORMATION 7753
WriteX 7753 0 65471 65471
WriteX 7753 65471 65 65
WriteX 7753 65536 16050 16050
Close 7753
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7738 1939 64 64
ReadX 7738 128 248 248
ReadX 7738 128 568 568
ReadX 7738 3872 1536 1536
ReadX 7738 3456 2560 2560
ReadX 7738 3136 512 512
ReadX 7738 2880 4096 4096
ReadX 7738 3264 3072 3072
ReadX 7738 320 4096 4096
ReadX 7738 1024 4096 4096
ReadX 7738 3616 4096 4096
ReadX 7738 1939 64 64
ReadX 7738 128 248 248
ReadX 7738 128 608 608
ReadX 7738 2858 1024 1024
ReadX 7738 2810 4096 4096
ReadX 7738 2826 4096 4096
ReadX 7738 2580 2048 2048
ReadX 7738 2800 2560 2560
ReadX 7738 2100 4096 4096
ReadX 7738 2084 4096 4096
ReadX 7738 868 4096 4096
ReadX 7738 2324 4096 4096
ReadX 7738 884 4096 4096
ReadX 7738 2604 1024 1024
ReadX 7738 580 4096 4096
ReadX 7738 596 4096 4096
ReadX 7738 2752 4096 4096
ReadX 7738 2842 1024 1024
ReadX 7738 660 4096 4096
ReadX 7738 2720 4096 4096
ReadX 7738 2736 4096 4096
ReadX 7738 628 4096 4096
ReadX 7738 2704 4096 4096
ReadX 7738 1556 4096 4096
ReadX 7738 576 4096 4096
ReadX 7738 3168 1536 1536
ReadX 7738 832 4096 4096
ReadX 7738 1088 4096 4096
ReadX 7738 1344 4096 4096
ReadX 7738 1600 4096 4096
ReadX 7738 1856 4096 4096
ReadX 7738 2112 4096 4096
ReadX 7738 1892 4096 4096
ReadX 7738 820 4096 4096
ReadX 7738 788 4096 4096
ReadX 7738 1604 4096 4096
ReadX 7738 3648 4096 4096
ReadX 7738 2608 4096 4096
ReadX 7738 548 4096 4096
ReadX 7738 740 4096 4096
ReadX 7738 1344 4096 4096
ReadX 7738 3392 4096 4096
ReadX 7738 3904 4096 4096
ReadX 7738 644 4096 4096
ReadX 7738 676 4096 4096
ReadX 7738 2688 4096 4096
ReadX 7738 320 4096 4096
ReadX 7738 900 4096 4096
ReadX 7738 1908 4096 4096
ReadX 7738 852 4096 4096
ReadX 7738 724 4096 4096
ReadX 7738 2292 4096 4096
ReadX 7738 612 4096 4096
ReadX 7738 388 4096 4096
ReadX 7738 2368 4096 4096
ReadX 7738 2624 4096 4096
ReadX 7738 500 4096 4096
ReadX 7738 356 4096 4096
ReadX 7738 1024 4096 4096
ReadX 7738 576 4096 4096
ReadX 7738 340 4096 4096
ReadX 7738 420 4096 4096
ReadX 7738 1600 4096 4096
ReadX 7738 404 4096 4096
ReadX 7738 1428 4096 4096
ReadX 7738 2656 4096 4096
ReadX 7738 2624 4096 4096
ReadX 7738 452 4096 4096
ReadX 7738 692 4096 4096
ReadX 7738 564 4096 4096
ReadX 7738 372 4096 4096
ReadX 7738 468 4096 4096
ReadX 7738 484 4096 4096
ReadX 7738 1088 4096 4096
ReadX 7738 1924 4096 4096
ReadX 7738 2768 4096 4096
ReadX 7738 832 4096 4096
ReadX 7738 836 4096 4096
ReadX 7738 1856 4096 4096
ReadX 7738 2640 4096 4096
ReadX 7738 436 4096 4096
ReadX 7738 1828 4096 4096
ReadX 7738 804 4096 4096
ReadX 7738 1860 4096 4096
ReadX 7738 1812 4096 4096
ReadX 7738 756 4096 4096
ReadX 7738 1636 4096 4096
ReadX 7738 772 4096 4096
ReadX 7738 2036 4096 4096
ReadX 7738 1220 4096 4096
ReadX 7738 1652 4096 4096
ReadX 7738 2588 4096 4096
ReadX 7738 916 4096 4096
ReadX 7738 260 4096 4096
ReadX 7738 932 4096 4096
ReadX 7738 2624 4096 4096
ReadX 7738 308 4096 4096
ReadX 7738 292 4096 4096
ReadX 7738 1140 4096 4096
ReadX 7738 276 4096 4096
ReadX 7738 2020 4096 4096
ReadX 7738 2880 4096 4096
ReadX 7738 516 4096 4096
ReadX 7738 1844 4096 4096
ReadX 7738 1124 4096 4096
ReadX 7738 3136 4096 4096
ReadX 7738 324 4096 4096
ReadX 7738 1156 4096 4096
ReadX 7738 1172 4096 4096
ReadX 7738 2112 4096 4096
ReadX 7738 2368 4096 4096
ReadX 7738 964 4096 4096
ReadX 7738 980 4096 4096
ReadX 7738 1012 4096 4096
ReadX 7738 532 4096 4096
ReadX 7738 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 7738 1620 4096 4096
ReadX 7738 1604 4096 4096
ReadX 7738 2116 4096 4096
ReadX 7738 2132 4096 4096
ReadX 7738 2148 4096 4096
ReadX 7738 2276 4096 4096
ReadX 7738 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 7755
Close 7755
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 7757
QUERY_FILE_INFORMATION 7722
WriteX 7757 4088 1 1
QUERY_FILE_INFORMATION 7757
QUERY_FILE_INFORMATION 7722
Close 7722
WriteX 7757 0 65471 65471
WriteX 7757 65471 65 65
WriteX 7757 65536 64850 64850
Close 7757
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 7759
WriteX 7759 15 1 1
QUERY_FILE_INFORMATION 7759
ReadX 7738 2068 4096 4096
ReadX 7738 1588 4096 4096
ReadX 7738 1572 4096 4096
WriteX 7759 0 18630 18630
Flush 7759
Close 7759
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 7749
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 7760
Close 7760
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 7761
QUERY_FILE_INFORMATION 7761
QUERY_FILE_INFORMATION 7761
QUERY_FILE_INFORMATION 7761
ReadX 7761 661 24 24
ReadX 7761 659 356 356
ReadX 7761 659 14 14
ReadX 7761 659 7 7
ReadX 7761 659 12 12
ReadX 7761 659 8 8
ReadX 7761 659 15 15
ReadX 7761 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 7738 612 4096 4096
ReadX 7738 564 4096 4096
ReadX 7738 1876 4096 4096
ReadX 7738 628 4096 4096
ReadX 7738 740 4096 4096
ReadX 7738 724 4096 4096
ReadX 7738 644 4096 4096
ReadX 7738 2324 4096 4096
ReadX 7738 660 4096 4096
ReadX 7738 852 4096 4096
ReadX 7738 868 4096 4096
Close 7761
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 7736
ReadX 7738 2368 4096 4096
ReadX 7738 1024 4096 4096
ReadX 7738 320 4096 4096
ReadX 7738 580 4096 4096
ReadX 7738 3136 512 512
ReadX 7738 2880 4096 4096
Close 7738
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 7762
WriteX 7762 0 65471 65471
WriteX 7762 65471 63 63
WriteX 7762 65534 65471 65471
WriteX 7762 131005 63 63
Close 7762
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 7763
WriteX 7763 0 65471 65471
WriteX 7763 65471 63 63
WriteX 7763 65534 65471 65471
WriteX 7763 131005 63 63
WriteX 7763 131068 65471 65471
WriteX 7763 196539 63 63
WriteX 7763 196602 65471 65471
WriteX 7763 262073 63 63
Close 7763
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 7764
WriteX 7764 0 65471 65471
WriteX 7764 65471 63 63
WriteX 7764 65534 65471 65471
WriteX 7764 131005 63 63
WriteX 7764 131068 65471 65471
WriteX 7764 196539 63 63
WriteX 7764 196602 65471 65471
WriteX 7764 262073 63 63
WriteX 7764 262136 65471 65471
WriteX 7764 327607 63 63
WriteX 7764 327670 65471 65471
WriteX 7764 393141 63 63
WriteX 7764 393204 65471 65471
WriteX 7764 458675 63 63
WriteX 7764 458738 65471 65471
WriteX 7764 524209 63 63
Close 7764
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7765
Close 7765
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7766
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7766 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7767
ReadX 7767 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7768
ReadX 7768 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7769
ReadX 7769 0 511 511
ReadX 7766 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7766
Close 7767
Close 7768
Close 7769
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7770
ReadX 7770 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7771
ReadX 7771 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7772
ReadX 7772 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7773
ReadX 7773 0 511 511
ReadX 7770 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 7774
FIND_FIRST \clients\client1\~dmtmp\*
Close 7774
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 7775
QUERY_FILE_INFORMATION 7775
WriteX 7775 2047 1 1
QUERY_FILE_INFORMATION 7775
WriteX 7775 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 7776
Close 7776
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 7777
WriteX 7777 52 1 1
QUERY_FILE_INFORMATION 7777
WriteX 7777 0 53 53
WriteX 7777 53 28 28
WriteX 7777 81 4 4
WriteX 7777 85 28 28
WriteX 7777 113 38 38
WriteX 7777 151 28 28
WriteX 7777 179 2 2
WriteX 7777 181 28 28
WriteX 7777 209 3 3
WriteX 7777 212 279 279
WriteX 7777 9 4 4
Close 7777
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 7778
ReadX 7778 0 53 53
ReadX 7778 53 28 28
ReadX 7778 81 4 4
ReadX 7778 85 28 28
ReadX 7778 113 38 38
ReadX 7778 151 28 28
ReadX 7778 179 2 2
ReadX 7778 181 28 28
ReadX 7778 209 3 3
Close 7778
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 7770
Close 7771
Close 7772
Close 7773
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7779
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7779 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7780
ReadX 7780 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7781
ReadX 7781 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7782
ReadX 7782 0 511 511
ReadX 7779 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 7784
Close 7784
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7785
WriteX 7785 52 1 1
QUERY_FILE_INFORMATION 7785
WriteX 7785 0 53 53
WriteX 7785 53 28 28
WriteX 7785 81 28 28
WriteX 7785 109 28 28
WriteX 7785 137 28 28
WriteX 7785 165 28 28
WriteX 7785 193 28 28
WriteX 7785 221 28 28
WriteX 7785 249 4 4
WriteX 7785 253 4 4
WriteX 7785 257 4 4
WriteX 7785 261 28 28
WriteX 7785 289 2 2
WriteX 7785 291 2 2
WriteX 7785 293 2 2
WriteX 7785 295 248 248
WriteX 7785 9 4 4
Close 7785
Close 7779
Close 7780
Close 7781
Close 7782
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7786
ReadX 7786 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7787
ReadX 7787 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7788
ReadX 7788 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7789
ReadX 7789 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7790
ReadX 7790 0 53 53
ReadX 7790 53 28 28
ReadX 7790 81 28 28
ReadX 7790 109 28 28
ReadX 7790 137 28 28
ReadX 7790 165 28 28
ReadX 7790 193 28 28
ReadX 7790 221 28 28
ReadX 7790 249 4 4
ReadX 7790 253 4 4
ReadX 7790 257 4 4
ReadX 7790 261 28 28
ReadX 7790 289 2 2
ReadX 7790 291 2 2
ReadX 7790 293 2 2
Close 7790
ReadX 7786 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7786
Close 7787
Close 7788
Close 7789
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 7775
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7791
Close 7791
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7792
ReadX 7792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7793
ReadX 7793 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7794
ReadX 7794 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7795
ReadX 7795 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7796
ReadX 7796 0 53 53
ReadX 7796 53 28 28
ReadX 7796 81 28 28
ReadX 7796 109 28 28
ReadX 7796 137 28 28
ReadX 7796 165 28 28
ReadX 7796 193 28 28
ReadX 7796 221 28 28
ReadX 7796 249 4 4
ReadX 7796 253 4 4
ReadX 7796 257 4 4
ReadX 7796 261 28 28
ReadX 7796 289 2 2
ReadX 7796 291 2 2
ReadX 7796 293 2 2
Close 7796
ReadX 7792 2048 2048 2048
Close 7792
Close 7793
Close 7794
Close 7795
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7797
ReadX 7797 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7798
ReadX 7798 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7799
ReadX 7799 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7800
ReadX 7800 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7801
ReadX 7801 0 53 53
ReadX 7801 53 28 28
ReadX 7801 81 28 28
ReadX 7801 109 28 28
ReadX 7801 137 28 28
ReadX 7801 165 28 28
ReadX 7801 193 28 28
ReadX 7801 221 28 28
ReadX 7801 249 4 4
ReadX 7801 253 4 4
ReadX 7801 257 4 4
ReadX 7801 261 28 28
ReadX 7801 289 2 2
ReadX 7801 291 2 2
ReadX 7801 293 2 2
Close 7801
ReadX 7797 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 7805
FIND_FIRST \clients\client1\~dmtmp\*
Close 7805
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 7806
QUERY_FILE_INFORMATION 7806
WriteX 7806 2047 1 1
QUERY_FILE_INFORMATION 7806
WriteX 7806 0 2048 2048
Close 7806
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 7807
ReadX 7807 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 7807
Close 7797
Close 7798
Close 7799
Close 7800
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 7808
ReadX 7808 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 7808 4095 1 1
QUERY_FILE_INFORMATION 7808
WriteX 7808 2048 2048 2048
QUERY_FILE_INFORMATION 7808
Flush 7808
WriteX 7808 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7809
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7810
ReadX 7810 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7811
ReadX 7811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7812
ReadX 7812 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7813
ReadX 7813 0 53 53
ReadX 7813 53 28 28
ReadX 7813 81 28 28
ReadX 7813 109 28 28
ReadX 7813 137 28 28
ReadX 7813 165 28 28
ReadX 7813 193 28 28
ReadX 7813 221 28 28
ReadX 7813 249 4 4
ReadX 7813 253 4 4
ReadX 7813 257 4 4
ReadX 7813 261 28 28
ReadX 7813 289 2 2
ReadX 7813 291 2 2
ReadX 7813 293 2 2
Close 7813
ReadX 7809 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 7817
FIND_FIRST \clients\client1\~dmtmp\*
Close 7817
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 7818
QUERY_FILE_INFORMATION 7818
WriteX 7818 2047 1 1
QUERY_FILE_INFORMATION 7818
WriteX 7818 0 2048 2048
Close 7818
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 7819
ReadX 7819 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 7823
Close 7823
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 7824
QUERY_FILE_INFORMATION 7824
WriteX 7824 2047 1 1
QUERY_FILE_INFORMATION 7824
WriteX 7824 0 2048 2048
Close 7824
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 7825
ReadX 7825 0 511 511
ReadX 7809 384 2048 2048
ReadX 7809 768 16384 16384
ReadX 7809 1792 14336 14336
Close 7825
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 7826
ReadX 7826 0 511 511
Close 7826
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 7828
Close 7828
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 7819 4095 1 1
QUERY_FILE_INFORMATION 7819
WriteX 7819 2048 2048 2048
WriteX 7819 0 88 88
Close 7819
WriteX 7809 1152 2048 2048
WriteX 7809 1408 6144 6144
WriteX 7809 1920 2048 2048
WriteX 7809 0 88 88
Close 7809
WriteX 7810 0 88 88
Close 7810
WriteX 7811 0 88 88
Close 7811
Close 7812
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 7829
ReadX 7829 0 511 511
ReadX 7829 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7829
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7830
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7830 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7831
ReadX 7831 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7832
ReadX 7832 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7833
ReadX 7833 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7834
ReadX 7834 0 53 53
ReadX 7834 53 28 28
ReadX 7834 81 28 28
ReadX 7834 109 28 28
ReadX 7834 137 28 28
ReadX 7834 165 28 28
ReadX 7834 193 28 28
ReadX 7834 221 28 28
ReadX 7834 249 4 4
ReadX 7834 253 4 4
ReadX 7834 257 4 4
ReadX 7834 261 28 28
ReadX 7834 289 2 2
ReadX 7834 291 2 2
ReadX 7834 293 2 2
Close 7834
ReadX 7830 2048 2048 2048
Close 7830
Close 7831
Close 7832
Close 7833
Close 7808
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 7835
QUERY_FILE_INFORMATION 7835
Close 7835
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7836
Close 7836
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7837
ReadX 7837 0 511 511
ReadX 7837 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7838
ReadX 7838 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7839
ReadX 7839 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7840
ReadX 7840 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7841
ReadX 7841 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7842
ReadX 7842 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7843
ReadX 7843 0 53 53
ReadX 7843 53 2 2
ReadX 7843 55 2 2
ReadX 7843 57 184 184
ReadX 7843 241 298 298
Close 7843
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7844
ReadX 7844 0 41 41
ReadX 7837 2048 2048 2048
Close 7844
Close 7837
Close 7838
Close 7841
Close 7842
Close 7839
Close 7840
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7845
ReadX 7845 0 511 511
ReadX 7845 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7846
ReadX 7846 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7847
ReadX 7847 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7848
ReadX 7848 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7849
ReadX 7849 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7850
ReadX 7850 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7851
ReadX 7851 0 53 53
ReadX 7851 53 2 2
ReadX 7851 55 2 2
ReadX 7851 57 184 184
ReadX 7851 241 298 298
Close 7851
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7852
ReadX 7852 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7853
ReadX 7853 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7854
ReadX 7854 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7855
ReadX 7855 0 511 511
ReadX 7854 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7856
ReadX 7856 0 53 53
ReadX 7856 53 2 2
ReadX 7856 55 480 480
ReadX 7856 535 2 2
Close 7856
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7857
ReadX 7857 0 41 41
ReadX 7845 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 7861
FIND_FIRST \clients\client1\~dmtmp\*
Close 7861
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 7862
QUERY_FILE_INFORMATION 7862
WriteX 7862 2047 1 1
QUERY_FILE_INFORMATION 7862
WriteX 7862 0 2048 2048
Close 7862
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 7863
ReadX 7863 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 7863
Close 7852
Close 7853
Close 7854
Close 7855
Close 7857
Close 7845
Close 7846
Close 7849
Close 7850
Close 7847
Close 7848
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 7864
ReadX 7864 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7865
Close 7865
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7866
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7866 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7867
ReadX 7867 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7868
ReadX 7868 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7869
ReadX 7869 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7870
ReadX 7870 0 53 53
ReadX 7870 53 2 2
ReadX 7870 55 480 480
ReadX 7870 535 2 2
Close 7870
ReadX 7866 2048 2048 2048
Close 7866
Close 7867
Close 7868
Close 7869
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7871
ReadX 7871 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7872
ReadX 7872 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7873
ReadX 7873 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7874
ReadX 7874 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7875
ReadX 7875 0 53 53
ReadX 7875 53 2 2
ReadX 7875 55 480 480
ReadX 7875 535 2 2
Close 7875
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7876
ReadX 7876 0 511 511
ReadX 7876 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7877
ReadX 7877 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7878
ReadX 7878 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7879
ReadX 7879 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7880
ReadX 7880 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7881
ReadX 7881 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7882
ReadX 7882 0 41 41
ReadX 7876 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7883
ReadX 7883 0 53 53
ReadX 7883 53 2 2
ReadX 7883 55 2 2
ReadX 7883 57 184 184
ReadX 7883 241 298 298
Close 7883
ReadX 7871 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 7887
FIND_FIRST \clients\client1\~dmtmp\*
Close 7887
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7888
QUERY_FILE_INFORMATION 7888
WriteX 7888 2047 1 1
QUERY_FILE_INFORMATION 7888
WriteX 7888 0 2048 2048
Close 7888
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7889
ReadX 7889 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 7889
Close 7882
Close 7876
Close 7877
Close 7880
Close 7881
Close 7878
Close 7879
Close 7871
Close 7872
Close 7873
Close 7874
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7890
ReadX 7890 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 7864 4095 1 1
QUERY_FILE_INFORMATION 7864
WriteX 7864 2048 2048 2048
QUERY_FILE_INFORMATION 7864
Flush 7864
WriteX 7864 0 88 88
WriteX 7890 4095 1 1
QUERY_FILE_INFORMATION 7890
WriteX 7890 2048 2048 2048
QUERY_FILE_INFORMATION 7890
Flush 7890
WriteX 7890 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7891
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7891 0 511 511
ReadX 7891 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7892
ReadX 7892 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7893
ReadX 7893 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7894
ReadX 7894 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7895
ReadX 7895 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7896
ReadX 7896 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7897
ReadX 7897 0 53 53
ReadX 7897 53 2 2
ReadX 7897 55 2 2
ReadX 7897 57 184 184
ReadX 7897 241 298 298
Close 7897
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7898
ReadX 7898 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7899
ReadX 7899 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7900
ReadX 7900 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7901
ReadX 7901 0 511 511
ReadX 7900 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7902
ReadX 7902 0 53 53
ReadX 7902 53 2 2
ReadX 7902 55 480 480
ReadX 7902 535 2 2
Close 7902
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7903
ReadX 7903 0 41 41
ReadX 7891 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7904
ReadX 7904 0 53 53
ReadX 7904 53 2 2
ReadX 7904 55 480 480
ReadX 7904 535 2 2
Close 7904
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7905
ReadX 7905 0 53 53
ReadX 7905 53 2 2
ReadX 7905 55 2 2
ReadX 7905 57 184 184
ReadX 7905 241 298 298
Close 7905
ReadX 7898 2048 2048 2048
ReadX 7899 2048 2048 2048
ReadX 7898 320 16384 16384
ReadX 7898 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 7906
FIND_FIRST \clients\client1\~dmtmp\*
Close 7906
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 7907
QUERY_FILE_INFORMATION 7907
WriteX 7907 4095 1 1
QUERY_FILE_INFORMATION 7907
WriteX 7907 0 4096 4096
Close 7907
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 7908
ReadX 7908 0 41 41
Close 7898
Close 7899
Close 7900
Close 7901
Close 7903
Close 7891
Close 7892
Close 7895
Close 7896
Close 7893
Close 7894
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 7909
Close 7909
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 7910
QUERY_FILE_INFORMATION 7910
WriteX 7910 4095 1 1
QUERY_FILE_INFORMATION 7910
WriteX 7910 0 4096 4096
Close 7910
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 7911
ReadX 7911 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 7908
ReadX 7908 0 4096 4096
WriteX 7911 0 4096 4096
Close 7911
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 7913
ReadX 7913 0 41 41
Close 7908
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 7913
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 7914
Close 7914
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 7915
ReadX 7915 0 41 41
Close 7915
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 7916
Close 7916
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7917
QUERY_FILE_INFORMATION 7917
WriteX 7917 2047 1 1
QUERY_FILE_INFORMATION 7917
WriteX 7917 0 2048 2048
Close 7917
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7918
ReadX 7918 0 511 511
ReadX 7918 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 7919
ReadX 7919 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 7919
Close 7918
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7920
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7920 0 511 511
ReadX 7920 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7921
ReadX 7921 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7922
ReadX 7922 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7923
ReadX 7923 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7924
ReadX 7924 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7925
ReadX 7925 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7926
ReadX 7926 0 53 53
ReadX 7926 53 2 2
ReadX 7926 55 2 2
ReadX 7926 57 184 184
ReadX 7926 241 298 298
Close 7926
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7927
ReadX 7927 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7928
ReadX 7928 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7929
ReadX 7929 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7930
ReadX 7930 0 511 511
ReadX 7929 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7931
ReadX 7931 0 53 53
ReadX 7931 53 2 2
ReadX 7931 55 480 480
ReadX 7931 535 2 2
Close 7931
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7932
ReadX 7932 0 41 41
ReadX 7920 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7933
ReadX 7933 0 53 53
ReadX 7933 53 2 2
ReadX 7933 55 480 480
ReadX 7933 535 2 2
Close 7933
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7934
ReadX 7934 0 53 53
ReadX 7934 53 2 2
ReadX 7934 55 2 2
ReadX 7934 57 184 184
ReadX 7934 241 298 298
Close 7934
ReadX 7927 2048 2048 2048
Close 7927
Close 7928
Close 7929
Close 7930
Close 7932
Close 7920
Close 7921
Close 7924
Close 7925
Close 7922
Close 7923
Close 7864
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 7935
QUERY_FILE_INFORMATION 7935
Close 7935
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 7890
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 7936
QUERY_FILE_INFORMATION 7936
Close 7936
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7937
Close 7937
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7938
ReadX 7938 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7939
ReadX 7939 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7940
ReadX 7940 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7941
ReadX 7941 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7942
ReadX 7942 0 53 53
ReadX 7942 53 2 2
ReadX 7942 55 480 480
ReadX 7942 535 2 2
Close 7942
ReadX 7938 2048 2048 2048
Close 7938
Close 7939
Close 7940
Close 7941
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7943
ReadX 7943 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7944
ReadX 7944 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7945
ReadX 7945 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 7946
ReadX 7946 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 7947
ReadX 7947 0 53 53
ReadX 7947 53 2 2
ReadX 7947 55 480 480
ReadX 7947 535 2 2
Close 7947
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7948
ReadX 7948 0 511 511
ReadX 7948 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7949
ReadX 7949 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7950
ReadX 7950 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7951
ReadX 7951 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7952
ReadX 7952 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7953
ReadX 7953 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7954
ReadX 7954 0 41 41
ReadX 7948 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7955
ReadX 7955 0 53 53
ReadX 7955 53 2 2
ReadX 7955 55 2 2
ReadX 7955 57 184 184
ReadX 7955 241 298 298
Close 7955
ReadX 7943 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 7959
FIND_FIRST \clients\client1\~dmtmp\*
Close 7959
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 7960
QUERY_FILE_INFORMATION 7960
WriteX 7960 2047 1 1
QUERY_FILE_INFORMATION 7960
WriteX 7960 0 2048 2048
Close 7960
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 7961
ReadX 7961 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 7961
Close 7954
Close 7948
Close 7949
Close 7952
Close 7953
Close 7950
Close 7951
Close 7943
Close 7944
Close 7945
Close 7946
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 7962
ReadX 7962 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7963
Close 7963
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7964
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7964 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7965
ReadX 7965 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7966
ReadX 7966 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7967
ReadX 7967 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7968
ReadX 7968 0 53 53
ReadX 7968 53 28 28
ReadX 7968 81 28 28
ReadX 7968 109 28 28
ReadX 7968 137 28 28
ReadX 7968 165 28 28
ReadX 7968 193 28 28
ReadX 7968 221 28 28
ReadX 7968 249 4 4
ReadX 7968 253 4 4
ReadX 7968 257 4 4
ReadX 7968 261 28 28
ReadX 7968 289 2 2
ReadX 7968 291 2 2
ReadX 7968 293 2 2
Close 7968
ReadX 7964 2048 2048 2048
Close 7964
Close 7965
Close 7966
Close 7967
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7969
ReadX 7969 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7970
ReadX 7970 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 7971
ReadX 7971 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7972
ReadX 7972 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 7973
ReadX 7973 0 53 53
ReadX 7973 53 28 28
ReadX 7973 81 28 28
ReadX 7973 109 28 28
ReadX 7973 137 28 28
ReadX 7973 165 28 28
ReadX 7973 193 28 28
ReadX 7973 221 28 28
ReadX 7973 249 4 4
ReadX 7973 253 4 4
ReadX 7973 257 4 4
ReadX 7973 261 28 28
ReadX 7973 289 2 2
ReadX 7973 291 2 2
ReadX 7973 293 2 2
Close 7973
ReadX 7969 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 7977
FIND_FIRST \clients\client1\~dmtmp\*
Close 7977
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 7978
QUERY_FILE_INFORMATION 7978
WriteX 7978 2047 1 1
QUERY_FILE_INFORMATION 7978
WriteX 7978 0 2048 2048
Close 7978
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 7979
ReadX 7979 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 7979
Close 7969
Close 7970
Close 7971
Close 7972
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 7980
ReadX 7980 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7981
Close 7981
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7982
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7982 0 511 511
ReadX 7982 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7983
ReadX 7983 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7984
ReadX 7984 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7985
ReadX 7985 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7986
ReadX 7986 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7987
ReadX 7987 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7988
ReadX 7988 0 53 53
ReadX 7988 53 2 2
ReadX 7988 55 2 2
ReadX 7988 57 184 184
ReadX 7988 241 298 298
Close 7988
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7989
ReadX 7989 0 41 41
ReadX 7982 2048 2048 2048
Close 7989
Close 7982
Close 7983
Close 7986
Close 7987
Close 7984
Close 7985
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7990
ReadX 7990 0 511 511
ReadX 7990 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 7991
ReadX 7991 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 7992
ReadX 7992 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 7993
ReadX 7993 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 7994
ReadX 7994 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 7995
ReadX 7995 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 7996
ReadX 7996 0 53 53
ReadX 7996 53 2 2
ReadX 7996 55 2 2
ReadX 7996 57 184 184
ReadX 7996 241 298 298
Close 7996
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7997
ReadX 7997 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7998
ReadX 7998 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 7999
ReadX 7999 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8000
ReadX 8000 0 511 511
ReadX 7999 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8001
ReadX 8001 0 53 53
ReadX 8001 53 2 2
ReadX 8001 55 480 480
ReadX 8001 535 2 2
Close 8001
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8002
ReadX 8002 0 41 41
ReadX 7990 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 8006
FIND_FIRST \clients\client1\~dmtmp\*
Close 8006
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8007
QUERY_FILE_INFORMATION 8007
WriteX 8007 2047 1 1
QUERY_FILE_INFORMATION 8007
WriteX 8007 0 2048 2048
Close 8007
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8008
ReadX 8008 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 8008
Close 7997
Close 7998
Close 7999
Close 8000
Close 8002
Close 7990
Close 7991
Close 7994
Close 7995
Close 7992
Close 7993
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8009
ReadX 8009 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 7962 4095 1 1
QUERY_FILE_INFORMATION 7962
WriteX 7962 2048 2048 2048
QUERY_FILE_INFORMATION 7962
Flush 7962
WriteX 7962 0 88 88
WriteX 7980 4095 1 1
QUERY_FILE_INFORMATION 7980
WriteX 7980 2048 2048 2048
QUERY_FILE_INFORMATION 7980
Flush 7980
WriteX 7980 0 88 88
WriteX 8009 4095 1 1
QUERY_FILE_INFORMATION 8009
WriteX 8009 2048 2048 2048
QUERY_FILE_INFORMATION 8009
Flush 8009
WriteX 8009 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8010
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8010 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8011
ReadX 8011 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8012
ReadX 8012 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8013
ReadX 8013 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8014
ReadX 8014 0 53 53
ReadX 8014 53 2 2
ReadX 8014 55 480 480
ReadX 8014 535 2 2
Close 8014
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8015
ReadX 8015 0 511 511
ReadX 8015 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8016
ReadX 8016 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8017
ReadX 8017 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8018
ReadX 8018 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8019
ReadX 8019 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8020
ReadX 8020 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8021
ReadX 8021 0 41 41
ReadX 8015 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8022
ReadX 8022 0 53 53
ReadX 8022 53 2 2
ReadX 8022 55 2 2
ReadX 8022 57 184 184
ReadX 8022 241 298 298
Close 8022
ReadX 8010 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8023
ReadX 8023 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8024
ReadX 8024 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8025
ReadX 8025 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8026
ReadX 8026 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8027
ReadX 8027 0 53 53
ReadX 8027 53 28 28
ReadX 8027 81 28 28
ReadX 8027 109 28 28
ReadX 8027 137 28 28
ReadX 8027 165 28 28
ReadX 8027 193 28 28
ReadX 8027 221 28 28
ReadX 8027 249 4 4
ReadX 8027 253 4 4
ReadX 8027 257 4 4
ReadX 8027 261 28 28
ReadX 8027 289 2 2
ReadX 8027 291 2 2
ReadX 8027 293 2 2
Close 8027
ReadX 8023 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8028
ReadX 8028 0 53 53
ReadX 8028 53 2 2
ReadX 8028 55 2 2
ReadX 8028 57 184 184
ReadX 8028 241 298 298
Close 8028
ReadX 8012 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8029
ReadX 8029 0 53 53
ReadX 8029 53 2 2
ReadX 8029 55 480 480
ReadX 8029 535 2 2
Close 8029
ReadX 8023 4096 16384 16384
ReadX 8023 1280 16384 16384
ReadX 8023 2304 6144 6144
ReadX 8023 2688 2048 2048
ReadX 8010 4096 16384 16384
ReadX 8010 1280 16384 16384
ReadX 8010 2304 16384 16384
ReadX 8010 3328 16384 16384
ReadX 8010 272 16384 16384
ReadX 8010 336 16384 16384
ReadX 8010 400 16384 16384
ReadX 8010 464 16384 16384
ReadX 8010 528 16384 16384
ReadX 8010 592 16384 16384
ReadX 8010 656 16384 16384
ReadX 8010 720 16384 16384
ReadX 8010 784 16384 16384
ReadX 8010 848 16384 16384
ReadX 8010 912 16384 16384
ReadX 8016 2048 2048 2048
ReadX 8015 760 2048 2048
ReadX 8015 1144 2048 2048
ReadX 8015 408 2048 2048
ReadX 8015 912 2048 2048
ReadX 8015 1096 2048 2048
ReadX 8015 776 2048 2048
ReadX 8015 560 2048 2048
ReadX 8015 376 2048 2048
ReadX 8015 320 2048 2048
ReadX 8015 3072 2048 2048
ReadX 8015 784 2048 2048
ReadX 8015 2176 2048 2048
ReadX 8015 792 2048 2048
ReadX 8015 576 2048 2048
ReadX 8015 600 2048 2048
ReadX 8015 728 2048 2048
ReadX 8015 1112 2048 2048
ReadX 8015 664 2048 2048
ReadX 8015 976 2048 2048
ReadX 8015 3840 2048 2048
ReadX 8015 296 2048 2048
ReadX 8015 480 2048 2048
ReadX 8015 680 2048 2048
ReadX 8015 696 2048 2048
ReadX 8015 832 2048 2048
ReadX 8015 1016 2048 2048
ReadX 8015 1104 2048 2048
ReadX 8015 3200 2048 2048
ReadX 8015 264 2048 2048
ReadX 8015 448 2048 2048
ReadX 8015 648 2048 2048
ReadX 8015 1136 2048 2048
ReadX 8015 288 2048 2048
ReadX 8015 352 2048 2048
ReadX 8015 536 2048 2048
ReadX 8015 800 2048 2048
ReadX 8015 736 2048 2048
ReadX 8015 392 2048 2048
ReadX 8015 752 2048 2048
ReadX 8015 880 2048 2048
ReadX 8015 1064 2048 2048
ReadX 8015 1128 2048 2048
ReadX 8015 1536 2048 2048
ReadX 8015 2432 2048 2048
ReadX 8015 688 2048 2048
ReadX 8015 872 2048 2048
ReadX 8015 1072 2048 2048
ReadX 8015 984 2048 2048
ReadX 8015 704 2048 2048
ReadX 8015 3328 2048 2048
ReadX 8015 888 2048 2048
ReadX 8015 496 2048 2048
ReadX 8015 624 2048 2048
ReadX 8015 808 2048 2048
ReadX 8015 1008 2048 2048
ReadX 8015 1152 2048 2048
ReadX 8015 416 2048 2048
ReadX 8015 584 2048 2048
ReadX 8015 384 2048 2048
ReadX 8015 568 2048 2048
ReadX 8015 512 2048 2048
ReadX 8015 1408 2048 2048
ReadX 8015 472 2048 2048
ReadX 8015 672 2048 2048
ReadX 8015 2560 2048 2048
ReadX 8015 544 2048 2048
ReadX 8015 920 2048 2048
ReadX 8015 1120 2048 2048
ReadX 8015 2304 2048 2048
ReadX 8015 1080 2048 2048
ReadX 8015 1664 2048 2048
ReadX 8015 608 2048 2048
ReadX 8015 2688 2048 2048
ReadX 8015 3712 2048 2048
ReadX 8015 616 2048 2048
ReadX 8015 632 2048 2048
ReadX 8015 944 2048 2048
ReadX 8015 856 2048 2048
ReadX 8015 768 2048 2048
ReadX 8015 720 2048 2048
ReadX 8015 640 2048 2048
ReadX 8015 1048 2048 2048
ReadX 8015 1040 2048 2048
ReadX 8015 1032 2048 2048
ReadX 8015 1000 2048 2048
ReadX 8015 992 2048 2048
ReadX 8015 968 2048 2048
ReadX 8015 952 2048 2048
ReadX 8015 1056 2048 2048
ReadX 8015 816 2048 2048
ReadX 8015 864 2048 2048
ReadX 8015 2816 2048 2048
ReadX 8015 640 2048 2048
ReadX 8015 1024 2048 2048
ReadX 8015 504 2048 2048
ReadX 8015 424 2048 2048
ReadX 8015 840 2048 2048
ReadX 8015 896 2048 2048
ReadX 8015 520 2048 2048
ReadX 8015 960 2048 2048
ReadX 8015 552 2048 2048
ReadX 8015 488 2048 2048
ReadX 8015 824 2048 2048
ReadX 8015 304 2048 2048
ReadX 8015 768 2048 2048
ReadX 8015 712 2048 2048
ReadX 8015 512 2048 2048
ReadX 8015 432 2048 2048
ReadX 8015 384 2048 2048
ReadX 8015 2944 2048 2048
ReadX 8015 1088 2048 2048
ReadX 8015 928 2048 2048
ReadX 8015 280 2048 2048
ReadX 8015 744 2048 2048
ReadX 8015 3968 2048 2048
ReadX 8015 336 2048 2048
ReadX 8015 592 2048 2048
ReadX 8015 312 2048 2048
ReadX 8015 400 2048 2048
ReadX 8015 904 2048 2048
ReadX 8015 464 2048 2048
ReadX 8015 3456 2048 2048
ReadX 8015 848 2048 2048
ReadX 8015 936 2048 2048
ReadX 8015 656 2048 2048
ReadX 8015 344 2048 2048
ReadX 8015 440 2048 2048
ReadX 8015 4096 2048 2048
ReadX 8015 528 2048 2048
ReadX 8015 2048 2048 2048
ReadX 8015 1024 2048 2048
ReadX 8015 456 2048 2048
ReadX 8015 1792 2048 2048
ReadX 8015 1152 2048 2048
ReadX 8015 3584 2048 2048
ReadX 8015 1920 2048 2048
ReadX 8015 1280 2048 2048
ReadX 8015 896 2048 2048
ReadX 8015 328 2048 2048
Close 8023
Close 8024
Close 8025
Close 8026
Close 8021
Close 8015
Close 8016
Close 8019
Close 8020
Close 8017
Close 8018
Close 8010
Close 8011
Close 8012
Close 8013
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8030
FIND_FIRST \clients\client1\~dmtmp\*
Close 8030
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8031
QUERY_FILE_INFORMATION 8031
WriteX 8031 0 2048 2048
WriteX 8031 18431 1 1
QUERY_FILE_INFORMATION 8031
WriteX 8031 2048 16384 16384
WriteX 8031 1152 16384 16384
WriteX 8031 2176 16384 16384
WriteX 8031 3200 16384 16384
WriteX 8031 264 16384 16384
WriteX 8031 328 16384 16384
WriteX 8031 392 16384 16384
WriteX 8031 456 16384 16384
WriteX 8031 520 16384 16384
WriteX 8031 584 16384 16384
WriteX 8031 648 16384 16384
WriteX 8031 712 16384 16384
WriteX 8031 776 16384 16384
WriteX 8031 840 16384 16384
WriteX 8031 904 16384 16384
WriteX 8031 968 16384 16384
WriteX 8031 1032 16384 16384
WriteX 8031 1096 16384 16384
WriteX 8031 1160 16384 16384
WriteX 8031 1224 16384 16384
WriteX 8031 1288 16384 16384
WriteX 8031 1352 16384 16384
WriteX 8031 1416 16384 16384
WriteX 8031 1480 16384 16384
WriteX 8031 1544 16384 16384
WriteX 8031 1608 16384 16384
WriteX 8031 1672 16384 16384
WriteX 8031 1736 16384 16384
WriteX 8031 1800 16384 16384
WriteX 8031 1864 16384 16384
WriteX 8031 1928 16384 16384
WriteX 8031 1992 16384 16384
WriteX 8031 2056 16384 16384
WriteX 8031 2120 16384 16384
WriteX 8031 2184 16384 16384
WriteX 8031 2248 16384 16384
WriteX 8031 2312 16384 16384
WriteX 8031 2376 16384 16384
WriteX 8031 2440 16384 16384
WriteX 8031 0 88 88
Close 8031
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8032
ReadX 8032 0 511 511
ReadX 8032 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8032
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8033
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8033 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8034
ReadX 8034 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8035
ReadX 8035 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8036
ReadX 8036 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8037
ReadX 8037 0 53 53
ReadX 8037 53 2 2
ReadX 8037 55 480 480
ReadX 8037 535 2 2
Close 8037
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8038
ReadX 8038 0 511 511
ReadX 8038 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8039
ReadX 8039 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8040
ReadX 8040 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8041
ReadX 8041 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8042
ReadX 8042 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8043
ReadX 8043 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8044
ReadX 8044 0 41 41
ReadX 8038 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8045
ReadX 8045 0 53 53
ReadX 8045 53 2 2
ReadX 8045 55 2 2
ReadX 8045 57 184 184
ReadX 8045 241 298 298
Close 8045
ReadX 8033 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8046
ReadX 8046 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8047
ReadX 8047 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8048
ReadX 8048 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8049
ReadX 8049 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8050
ReadX 8050 0 53 53
ReadX 8050 53 28 28
ReadX 8050 81 28 28
ReadX 8050 109 28 28
ReadX 8050 137 28 28
ReadX 8050 165 28 28
ReadX 8050 193 28 28
ReadX 8050 221 28 28
ReadX 8050 249 4 4
ReadX 8050 253 4 4
ReadX 8050 257 4 4
ReadX 8050 261 28 28
ReadX 8050 289 2 2
ReadX 8050 291 2 2
ReadX 8050 293 2 2
Close 8050
ReadX 8046 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8051
ReadX 8051 0 53 53
ReadX 8051 53 2 2
ReadX 8051 55 2 2
ReadX 8051 57 184 184
ReadX 8051 241 298 298
Close 8051
ReadX 8035 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8052
ReadX 8052 0 53 53
ReadX 8052 53 2 2
ReadX 8052 55 480 480
ReadX 8052 535 2 2
Close 8052
Close 8046
Close 8047
Close 8048
Close 8049
Close 8044
Close 8038
Close 8039
Close 8042
Close 8043
Close 8040
Close 8041
Close 8033
Close 8034
Close 8035
Close 8036
Close 7962
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 8053
QUERY_FILE_INFORMATION 8053
Close 8053
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 7980
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 8054
QUERY_FILE_INFORMATION 8054
Close 8054
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 8009
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8055
QUERY_FILE_INFORMATION 8055
Close 8055
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8056
Close 8056
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8057
ReadX 8057 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8058
ReadX 8058 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8059
ReadX 8059 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8060
ReadX 8060 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8061
ReadX 8061 0 53 53
ReadX 8061 53 28 28
ReadX 8061 81 28 28
ReadX 8061 109 28 28
ReadX 8061 137 28 28
ReadX 8061 165 28 28
ReadX 8061 193 28 28
ReadX 8061 221 28 28
ReadX 8061 249 4 4
ReadX 8061 253 4 4
ReadX 8061 257 4 4
ReadX 8061 261 28 28
ReadX 8061 289 2 2
ReadX 8061 291 2 2
ReadX 8061 293 2 2
Close 8061
ReadX 8057 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 8057 384 2048 2048
ReadX 8057 768 16384 16384
ReadX 8057 1792 14336 14336
ReadX 8060 2048 2048 2048
ReadX 8059 2048 2048 2048
WriteX 8057 1152 2048 2048
WriteX 8060 2048 2048 2048
WriteX 8059 2048 2048 2048
WriteX 8057 0 88 88
WriteX 8058 0 88 88
WriteX 8059 0 88 88
WriteX 8060 0 88 88
Close 8057
Close 8058
Close 8059
Close 8060
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8062
Close 8062
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8063
ReadX 8063 0 511 511
ReadX 8063 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8064
ReadX 8064 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8065
ReadX 8065 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8066
ReadX 8066 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8067
ReadX 8067 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8068
ReadX 8068 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8069
ReadX 8069 0 53 53
ReadX 8069 53 2 2
ReadX 8069 55 2 2
ReadX 8069 57 184 184
ReadX 8069 241 298 298
Close 8069
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8070
ReadX 8070 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8071
ReadX 8071 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8072
ReadX 8072 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8073
ReadX 8073 0 511 511
ReadX 8072 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8074
ReadX 8074 0 53 53
ReadX 8074 53 2 2
ReadX 8074 55 480 480
ReadX 8074 535 2 2
Close 8074
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8075
ReadX 8075 0 41 41
ReadX 8063 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 8076
QUERY_FILE_INFORMATION 8076
QUERY_FILE_INFORMATION 8076
ReadX 8076 0 8192 8192
Close 8076
ReadX 8063 1152 2048 2048
ReadX 8063 4096 16384 16384
Close 8070
Close 8071
Close 8072
Close 8073
Close 8075
Close 8063
Close 8064
Close 8067
Close 8068
Close 8065
Close 8066
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8077
Close 8077
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8078
QUERY_FILE_INFORMATION 8078
ReadX 8078 0 64 64
ReadX 8078 144 64 64
ReadX 8078 224 156 156
ReadX 8078 1193 128 128
ReadX 8078 1201 128 128
ReadX 8078 1072 4 4
ReadX 8078 1076 1925 1925
ReadX 8078 758 4 4
ReadX 8078 762 4557 4557
ReadX 8078 1052 4 4
ReadX 8078 1056 314 314
ReadX 8078 1056 11056 11056
Close 8078
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8079
ReadX 8079 0 511 511
ReadX 8079 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8080
ReadX 8080 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8081
ReadX 8081 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8082
ReadX 8082 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8083
ReadX 8083 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8084
ReadX 8084 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8085
ReadX 8085 0 53 53
ReadX 8085 53 2 2
ReadX 8085 55 2 2
ReadX 8085 57 184 184
ReadX 8085 241 298 298
Close 8085
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8086
ReadX 8086 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8087
ReadX 8087 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8088
ReadX 8088 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8089
ReadX 8089 0 511 511
ReadX 8088 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8090
ReadX 8090 0 53 53
ReadX 8090 53 2 2
ReadX 8090 55 480 480
ReadX 8090 535 2 2
Close 8090
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8091
ReadX 8091 0 41 41
ReadX 8079 2048 2048 2048
ReadX 8080 2048 2048 2048
ReadX 8079 1144 2048 2048
ReadX 8079 1152 2048 2048
ReadX 8079 4096 16384 16384
WriteX 8079 2048 2048 2048
WriteX 8080 2048 2048 2048
WriteX 8079 0 88 88
WriteX 8080 0 88 88
Close 8086
Close 8087
Close 8088
Close 8089
Close 8091
Close 8079
Close 8080
Close 8083
Close 8084
Close 8081
Close 8082
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 8092
Close 8092
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 8093
QUERY_FILE_INFORMATION 8093
ReadX 8093 0 64 64
ReadX 8093 144 64 64
ReadX 8093 224 84 84
ReadX 8093 478 16 16
ReadX 8093 1056 6176 6176
Close 8093
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8094
ReadX 8094 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8095
ReadX 8095 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8096
ReadX 8096 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8097
ReadX 8097 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8098
ReadX 8098 0 53 53
ReadX 8098 53 28 28
ReadX 8098 81 28 28
ReadX 8098 109 28 28
ReadX 8098 137 28 28
ReadX 8098 165 28 28
ReadX 8098 193 28 28
ReadX 8098 221 28 28
ReadX 8098 249 4 4
ReadX 8098 253 4 4
ReadX 8098 257 4 4
ReadX 8098 261 28 28
ReadX 8098 289 2 2
ReadX 8098 291 2 2
ReadX 8098 293 2 2
Close 8098
ReadX 8094 2048 2048 2048
ReadX 8095 2048 2048 2048
ReadX 8094 1280 2048 2048
ReadX 8097 2048 2048 2048
ReadX 8096 2048 2048 2048
WriteX 8094 1280 2048 2048
WriteX 8097 2048 2048 2048
WriteX 8096 2048 2048 2048
WriteX 8095 2048 2048 2048
WriteX 8094 0 88 88
WriteX 8095 0 88 88
WriteX 8096 0 88 88
WriteX 8097 0 88 88
WriteX 8094 1280 2048 2048
WriteX 8097 2048 2048 2048
WriteX 8096 2048 2048 2048
WriteX 8095 2048 2048 2048
WriteX 8094 0 88 88
WriteX 8095 0 88 88
WriteX 8096 0 88 88
WriteX 8097 0 88 88
WriteX 8094 1280 2048 2048
WriteX 8097 2048 2048 2048
WriteX 8096 2048 2048 2048
WriteX 8095 2048 2048 2048
WriteX 8094 0 88 88
WriteX 8095 0 88 88
WriteX 8096 0 88 88
WriteX 8097 0 88 88
Close 8094
Close 8095
Close 8096
Close 8097
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8099
ReadX 8099 0 511 511
ReadX 8099 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8100
ReadX 8100 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8101
ReadX 8101 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8102
ReadX 8102 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8103
ReadX 8103 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8104
ReadX 8104 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8105
ReadX 8105 0 53 53
ReadX 8105 53 2 2
ReadX 8105 55 2 2
ReadX 8105 57 184 184
ReadX 8105 241 298 298
Close 8105
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8106
ReadX 8106 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8107
ReadX 8107 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8108
ReadX 8108 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8109
ReadX 8109 0 511 511
ReadX 8108 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8110
ReadX 8110 0 53 53
ReadX 8110 53 2 2
ReadX 8110 55 480 480
ReadX 8110 535 2 2
Close 8110
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8111
ReadX 8111 0 41 41
ReadX 8099 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 8115
FIND_FIRST \clients\client1\~dmtmp\*
Close 8115
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 8116
QUERY_FILE_INFORMATION 8116
WriteX 8116 2047 1 1
QUERY_FILE_INFORMATION 8116
WriteX 8116 0 2048 2048
Close 8116
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 8117
ReadX 8117 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 8117 4095 1 1
QUERY_FILE_INFORMATION 8117
WriteX 8117 2048 2048 2048
WriteX 8117 0 88 88
Close 8117
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 8118
ReadX 8118 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 8118 2048 2048 2048
Close 8106
Close 8107
Close 8108
Close 8109
Close 8111
Close 8099
Close 8100
Close 8103
Close 8104
Close 8101
Close 8102
WriteX 8118 2048 2048 2048
WriteX 8118 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8119
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8119 0 511 511
ReadX 8119 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8120
ReadX 8120 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8121
ReadX 8121 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8122
ReadX 8122 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8123
ReadX 8123 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8124
ReadX 8124 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8125
ReadX 8125 0 53 53
ReadX 8125 53 2 2
ReadX 8125 55 2 2
ReadX 8125 57 184 184
ReadX 8125 241 298 298
Close 8125
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8126
ReadX 8126 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8127
ReadX 8127 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8128
ReadX 8128 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8129
ReadX 8129 0 511 511
ReadX 8128 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8130
ReadX 8130 0 53 53
ReadX 8130 53 2 2
ReadX 8130 55 480 480
ReadX 8130 535 2 2
Close 8130
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8131
ReadX 8131 0 41 41
ReadX 8119 2048 2048 2048
ReadX 8119 1152 2048 2048
ReadX 8119 4096 16384 16384
ReadX 8119 1280 16384 16384
ReadX 8119 2304 16384 16384
ReadX 8119 3328 16384 16384
ReadX 8119 272 16384 16384
ReadX 8119 336 16384 16384
ReadX 8119 400 16384 16384
ReadX 8119 464 16384 16384
ReadX 8119 528 16384 16384
ReadX 8119 592 16384 16384
ReadX 8119 656 16384 16384
ReadX 8119 720 16384 16384
ReadX 8119 784 16384 16384
ReadX 8119 848 16384 16384
ReadX 8119 912 16384 16384
ReadX 8119 976 16384 16384
ReadX 8119 1040 16384 16384
ReadX 8119 1104 12288 12288
Close 8126
Close 8127
Close 8128
Close 8129
Close 8131
Close 8119
Close 8120
Close 8123
Close 8124
Close 8121
Close 8122
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8132
FIND_FIRST \clients\client1\~dmtmp\*
Close 8132
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8133
QUERY_FILE_INFORMATION 8133
WriteX 8133 0 2048 2048
WriteX 8133 2048 4096 4096
WriteX 8133 0 88 88
Close 8133
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8134
ReadX 8134 0 511 511
ReadX 8134 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8134
WriteX 8118 2048 2048 2048
WriteX 8118 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8135
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8135 0 511 511
ReadX 8135 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8136
ReadX 8136 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8137
ReadX 8137 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8138
ReadX 8138 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8139
ReadX 8139 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8140
ReadX 8140 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8141
ReadX 8141 0 53 53
ReadX 8141 53 2 2
ReadX 8141 55 2 2
ReadX 8141 57 184 184
ReadX 8141 241 298 298
Close 8141
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8142
ReadX 8142 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8143
ReadX 8143 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8144
ReadX 8144 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8145
ReadX 8145 0 511 511
ReadX 8144 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8146
ReadX 8146 0 53 53
ReadX 8146 53 2 2
ReadX 8146 55 480 480
ReadX 8146 535 2 2
Close 8146
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8147
ReadX 8147 0 41 41
ReadX 8135 2048 2048 2048
ReadX 8135 1152 2048 2048
ReadX 8135 4096 16384 16384
ReadX 8135 1280 16384 16384
ReadX 8135 2304 16384 16384
ReadX 8135 3328 16384 16384
ReadX 8135 272 16384 16384
ReadX 8135 336 16384 16384
ReadX 8135 400 16384 16384
ReadX 8135 464 16384 16384
ReadX 8135 528 16384 16384
ReadX 8135 592 16384 16384
ReadX 8135 656 16384 16384
ReadX 8135 720 16384 16384
ReadX 8135 784 16384 16384
ReadX 8135 848 16384 16384
ReadX 8135 912 16384 16384
ReadX 8135 976 16384 16384
ReadX 8135 1040 16384 16384
ReadX 8135 1104 12288 12288
Close 8142
Close 8143
Close 8144
Close 8145
Close 8147
Close 8135
Close 8136
Close 8139
Close 8140
Close 8137
Close 8138
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8148
FIND_FIRST \clients\client1\~dmtmp\*
Close 8148
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8149
QUERY_FILE_INFORMATION 8149
WriteX 8149 0 2048 2048
WriteX 8149 2048 4096 4096
WriteX 8149 0 88 88
Close 8149
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8150
ReadX 8150 0 511 511
ReadX 8150 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8150
Close 8118
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 8151
QUERY_FILE_INFORMATION 8151
Close 8151
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8152
Close 8152
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8153
QUERY_FILE_INFORMATION 8153
ReadX 8153 0 64 64
ReadX 8153 144 64 64
ReadX 8153 224 156 156
ReadX 8153 1193 128 128
ReadX 8153 1201 128 128
ReadX 8153 1072 4 4
ReadX 8153 1076 1925 1925
ReadX 8153 758 4 4
ReadX 8153 762 4557 4557
ReadX 8153 1052 4 4
ReadX 8153 1056 314 314
ReadX 8153 1056 11056 11056
Close 8153
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8154
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8154 0 511 511
ReadX 8154 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8155
ReadX 8155 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8156
ReadX 8156 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8157
ReadX 8157 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8158
ReadX 8158 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8159
ReadX 8159 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8160
ReadX 8160 0 53 53
ReadX 8160 53 2 2
ReadX 8160 55 2 2
ReadX 8160 57 184 184
ReadX 8160 241 298 298
Close 8160
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8161
ReadX 8161 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8162
ReadX 8162 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8163
ReadX 8163 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8164
ReadX 8164 0 511 511
ReadX 8163 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8165
ReadX 8165 0 53 53
ReadX 8165 53 2 2
ReadX 8165 55 480 480
ReadX 8165 535 2 2
Close 8165
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8166
ReadX 8166 0 41 41
ReadX 8154 2048 2048 2048
ReadX 8154 1152 2048 2048
ReadX 8154 4096 16384 16384
Close 8161
Close 8162
Close 8163
Close 8164
Close 8166
Close 8154
Close 8155
Close 8158
Close 8159
Close 8156
Close 8157
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8167
ReadX 8167 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8168
ReadX 8168 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8169
ReadX 8169 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8170
ReadX 8170 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8171
ReadX 8171 0 53 53
ReadX 8171 53 2 2
ReadX 8171 55 480 480
ReadX 8171 535 2 2
Close 8171
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8172
ReadX 8172 0 511 511
ReadX 8172 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8173
ReadX 8173 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8174
ReadX 8174 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8175
ReadX 8175 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8176
ReadX 8176 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8177
ReadX 8177 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8178
ReadX 8178 0 41 41
ReadX 8172 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8179
ReadX 8179 0 53 53
ReadX 8179 53 2 2
ReadX 8179 55 2 2
ReadX 8179 57 184 184
ReadX 8179 241 298 298
Close 8179
ReadX 8167 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 8183
FIND_FIRST \clients\client1\~dmtmp\*
Close 8183
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 8184
QUERY_FILE_INFORMATION 8184
WriteX 8184 2047 1 1
QUERY_FILE_INFORMATION 8184
WriteX 8184 0 2048 2048
Close 8184
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 8185
ReadX 8185 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 8185 4095 1 1
QUERY_FILE_INFORMATION 8185
WriteX 8185 2048 2048 2048
WriteX 8185 0 88 88
Close 8185
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 8186
ReadX 8186 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 8186 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 8190
Close 8190
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 8191
QUERY_FILE_INFORMATION 8191
WriteX 8191 2047 1 1
QUERY_FILE_INFORMATION 8191
WriteX 8191 0 2048 2048
Close 8191
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 8192
ReadX 8192 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 8192 4095 1 1
QUERY_FILE_INFORMATION 8192
WriteX 8192 2048 2048 2048
WriteX 8192 0 88 88
Close 8192
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 8193
ReadX 8193 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 8193 2048 2048 2048
Close 8178
Close 8172
Close 8173
Close 8176
Close 8177
Close 8174
Close 8175
Close 8167
Close 8168
Close 8169
Close 8170
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8194
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8194 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8195
ReadX 8195 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8196
ReadX 8196 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8197
ReadX 8197 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8198
ReadX 8198 0 53 53
ReadX 8198 53 2 2
ReadX 8198 55 480 480
ReadX 8198 535 2 2
Close 8198
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8199
ReadX 8199 0 511 511
ReadX 8199 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8200
ReadX 8200 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8201
ReadX 8201 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8202
ReadX 8202 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8203
ReadX 8203 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8204
ReadX 8204 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8205
ReadX 8205 0 41 41
ReadX 8199 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8206
ReadX 8206 0 53 53
ReadX 8206 53 2 2
ReadX 8206 55 2 2
ReadX 8206 57 184 184
ReadX 8206 241 298 298
Close 8206
ReadX 8194 2048 2048 2048
ReadX 8194 384 16384 16384
ReadX 8194 1408 16384 16384
ReadX 8194 2560 16384 16384
ReadX 8194 3584 16384 16384
ReadX 8194 288 16384 16384
ReadX 8194 352 16384 16384
ReadX 8194 416 16384 16384
ReadX 8194 480 16384 16384
ReadX 8194 552 16384 16384
ReadX 8194 616 16384 16384
ReadX 8194 680 16384 16384
ReadX 8194 744 16384 16384
ReadX 8194 808 16384 16384
ReadX 8194 872 16384 16384
ReadX 8194 936 10240 10240
Close 8205
Close 8199
Close 8200
Close 8203
Close 8204
Close 8201
Close 8202
Close 8194
Close 8195
Close 8196
Close 8197
Close 8186
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 8207
QUERY_FILE_INFORMATION 8207
Close 8207
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 8193
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 8208
QUERY_FILE_INFORMATION 8208
Close 8208
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 8209
ReadX 8209 0 65471 65471
ReadX 8209 65471 63 63
ReadX 8209 65534 65471 65471
ReadX 8209 131005 63 63
ReadX 8209 131068 65471 65471
ReadX 8209 196539 63 63
ReadX 8209 196602 65471 65471
ReadX 8209 262073 63 63
ReadX 8209 262136 65471 65471
ReadX 8209 327607 63 63
ReadX 8209 327670 10 10
Close 8209
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 8210
ReadX 8210 0 65471 65471
ReadX 8210 65471 63 63
ReadX 8210 65534 65471 65471
ReadX 8210 131005 63 63
ReadX 8210 131068 65471 65471
ReadX 8210 196539 63 63
ReadX 8210 196602 65471 65471
ReadX 8210 262073 63 63
ReadX 8210 262136 65471 65471
ReadX 8210 327607 63 63
ReadX 8210 327670 65471 65471
ReadX 8210 393141 63 63
ReadX 8210 393204 65471 65471
ReadX 8210 458675 63 63
ReadX 8210 458738 65471 65471
ReadX 8210 524209 63 63
ReadX 8210 524272 65471 65471
ReadX 8210 589743 63 63
ReadX 8210 589806 65471 65471
ReadX 8210 655277 63 63
ReadX 8210 655340 32 32
Close 8210
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 8211
ReadX 8211 0 65471 65471
ReadX 8211 65471 63 63
ReadX 8211 65534 65471 65471
ReadX 8211 131005 63 63
ReadX 8211 131068 65471 65471
ReadX 8211 196539 63 63
ReadX 8211 196602 65471 65471
ReadX 8211 262073 63 63
ReadX 8211 262136 65471 65471
ReadX 8211 327607 63 63
ReadX 8211 327670 65471 65471
ReadX 8211 393141 63 63
ReadX 8211 393204 65471 65471
ReadX 8211 458675 63 63
ReadX 8211 458738 65471 65471
ReadX 8211 524209 63 63
ReadX 8211 524272 65471 65471
ReadX 8211 589743 63 63
ReadX 8211 589806 65471 65471
ReadX 8211 655277 63 63
ReadX 8211 655340 65471 65471
ReadX 8211 720811 63 63
ReadX 8211 720874 65471 65471
ReadX 8211 786345 63 63
ReadX 8211 786408 65471 65471
ReadX 8211 851879 63 63
ReadX 8211 851942 65471 65471
ReadX 8211 917413 63 63
ReadX 8211 917476 65471 65471
ReadX 8211 982947 63 63
ReadX 8211 983010 65471 65471
ReadX 8211 1048481 63 63
ReadX 8211 1048544 65471 65471
ReadX 8211 1114015 63 63
ReadX 8211 1114078 65471 65471
ReadX 8211 1179549 63 63
ReadX 8211 1179612 65471 65471
ReadX 8211 1245083 63 63
ReadX 8211 1245146 65471 65471
ReadX 8211 1310617 63 63
ReadX 8211 1310680 65471 65471
ReadX 8211 1376151 63 63
ReadX 8211 1376214 65471 65471
ReadX 8211 1441685 63 63
ReadX 8211 1441748 65471 65471
ReadX 8211 1507219 63 63
ReadX 8211 1507282 65471 65471
ReadX 8211 1572753 63 63
ReadX 8211 1572816 65471 65471
ReadX 8211 1638287 63 63
ReadX 8211 1638350 65471 65471
ReadX 8211 1703821 63 63
ReadX 8211 1703884 65471 65471
ReadX 8211 1769355 63 63
ReadX 8211 1769418 65471 65471
ReadX 8211 1834889 63 63
ReadX 8211 1834952 32824 32824
Close 8211
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 8212
QUERY_FILE_INFORMATION 8212
ReadX 8212 0 512 512
ReadX 8212 512 512 512
ReadX 8212 1024 512 512
QUERY_FILE_INFORMATION 8212
QUERY_FILE_INFORMATION 8212
ReadX 8212 2560 2048 2048
ReadX 8212 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 8213
WriteX 8213 52 1 1
QUERY_FILE_INFORMATION 8213
WriteX 8213 0 53 53
Close 8213
ReadX 8212 2208 650 650
ReadX 8212 1920 2048 2048
ReadX 8212 2112 2048 2048
ReadX 8212 1856 2048 2048
ReadX 8212 1824 2048 2048
ReadX 8212 1536 512 512
ReadX 8212 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 8214
Close 8214
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 8212 1568 512 512
ReadX 8212 1536 512 512
ReadX 8212 2176 384 384
ReadX 8212 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 8215
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 8212 288 2048 2048
ReadX 8212 2336 2048 2048
ReadX 8212 4384 2048 2048
ReadX 8212 6432 2048 2048
ReadX 8212 8480 2048 2048
ReadX 8212 10528 2048 2048
ReadX 8212 12576 2048 2048
WriteX 8215 15359 1 1
QUERY_FILE_INFORMATION 8215
ReadX 8212 14624 2048 2048
ReadX 8212 16672 2048 2048
ReadX 8212 18720 2048 2048
ReadX 8212 1728 2048 2048
WriteX 8215 0 15360 15360
Close 8215
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 8216
QUERY_FILE_INFORMATION 8216
ReadX 8216 0 512 512
ReadX 8216 2048 512 512
ReadX 8216 2560 512 512
QUERY_FILE_INFORMATION 8216
QUERY_FILE_INFORMATION 8216
QUERY_FILE_INFORMATION 8216
QUERY_FILE_INFORMATION 8216
QUERY_FILE_INFORMATION 8216
WriteX 8216 2152 384 384
QUERY_FILE_INFORMATION 8216
WriteX 8216 2150 22 22
WriteX 8216 2144 106 106
QUERY_FILE_INFORMATION 8216
WriteX 8216 2176 496 496
ReadX 8216 2176 496 496
QUERY_FILE_INFORMATION 8216
WriteX 8216 2440 384 384
QUERY_FILE_INFORMATION 8216
WriteX 8216 2152 384 384
WriteX 8216 2432 112 112
QUERY_FILE_INFORMATION 8216
WriteX 8216 2439 16 16
QUERY_FILE_INFORMATION 8216
WriteX 8216 2208 220 220
ReadX 8216 2208 220 220
QUERY_FILE_INFORMATION 8216
QUERY_FILE_INFORMATION 8216
WriteX 8216 2440 220 220
QUERY_FILE_INFORMATION 8216
WriteX 8216 2453 36 36
WriteX 8216 2080 512 512
WriteX 8216 2176 512 512
WriteX 8216 2112 512 512
WriteX 8216 2048 512 512
WriteX 8216 0 512 512
QUERY_FILE_INFORMATION 8212
QUERY_FILE_INFORMATION 8212
WriteX 8216 2080 512 512
Close 8216
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 8217
Close 8217
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 8218
QUERY_FILE_INFORMATION 8218
ReadX 8218 0 512 512
ReadX 8218 2048 512 512
ReadX 8218 2560 512 512
QUERY_FILE_INFORMATION 8218
QUERY_FILE_INFORMATION 8218
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 8219
Close 8219
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 8212
ReadX 8218 1408 512 512
ReadX 8218 2048 512 512
ReadX 8218 1536 512 512
ReadX 8218 2560 512 512
ReadX 8218 3072 512 512
ReadX 8218 3584 512 512
ReadX 8218 4096 512 512
ReadX 8218 4608 512 512
ReadX 8218 5120 512 512
ReadX 8218 5632 512 512
ReadX 8218 6144 512 512
ReadX 8218 6656 512 512
ReadX 8218 7168 512 512
ReadX 8218 7680 512 512
ReadX 8218 8192 512 512
ReadX 8218 8704 512 512
ReadX 8218 9216 512 512
ReadX 8218 9728 512 512
ReadX 8218 10240 512 512
ReadX 8218 10752 512 512
ReadX 8218 11264 512 512
ReadX 8218 11776 512 512
ReadX 8218 12288 512 512
ReadX 8218 12800 512 512
ReadX 8218 13312 512 512
ReadX 8218 13824 512 512
ReadX 8218 14336 512 512
ReadX 8218 14848 512 512
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 15360 512 0
ReadX 8218 2560 2048 2048
ReadX 8218 4608 2048 2048
ReadX 8218 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 8220
QUERY_FILE_INFORMATION 8220
ReadX 8220 0 512 512
ReadX 8220 512 512 512
ReadX 8220 1024 512 512
QUERY_FILE_INFORMATION 8220
QUERY_FILE_INFORMATION 8220
ReadX 8220 352 2048 2048
ReadX 8220 608 1097 1097
ReadX 8220 576 1609 1609
ReadX 8220 4096 512 512
ReadX 8220 1536 512 512
ReadX 8220 3840 256 256
ReadX 8220 288 576 576
ReadX 8220 512 512 512
ReadX 8220 480 512 512
ReadX 8220 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 8221
ReadX 8221 0 4096 4096
ReadX 8221 4096 4096 4096
ReadX 8221 8192 4096 4096
Close 8220
Close 8221
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 8222
WriteX 8222 15359 1 1
QUERY_FILE_INFORMATION 8222
WriteX 8222 0 15360 15360
Close 8222
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 8223
QUERY_FILE_INFORMATION 8223
ReadX 8223 0 512 512
ReadX 8223 2048 512 512
ReadX 8223 2560 512 512
QUERY_FILE_INFORMATION 8223
QUERY_FILE_INFORMATION 8223
QUERY_FILE_INFORMATION 8223
QUERY_FILE_INFORMATION 8223
QUERY_FILE_INFORMATION 8223
WriteX 8223 2152 384 384
QUERY_FILE_INFORMATION 8223
WriteX 8223 2150 22 22
WriteX 8223 2144 106 106
QUERY_FILE_INFORMATION 8223
WriteX 8223 2176 476 476
ReadX 8223 2176 476 476
QUERY_FILE_INFORMATION 8223
WriteX 8223 2440 384 384
QUERY_FILE_INFORMATION 8223
WriteX 8223 2152 384 384
WriteX 8223 2432 92 92
QUERY_FILE_INFORMATION 8223
WriteX 8223 2437 36 36
QUERY_FILE_INFORMATION 8223
WriteX 8223 2208 220 220
ReadX 8223 2208 220 220
QUERY_FILE_INFORMATION 8223
QUERY_FILE_INFORMATION 8223
WriteX 8223 2440 220 220
QUERY_FILE_INFORMATION 8223
WriteX 8223 2453 36 36
WriteX 8223 2080 512 512
WriteX 8223 2176 512 512
WriteX 8223 2112 512 512
WriteX 8223 2048 512 512
WriteX 8223 0 512 512
QUERY_FILE_INFORMATION 8218
QUERY_FILE_INFORMATION 8218
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 8218
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 8224
Close 8224
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 8225
QUERY_FILE_INFORMATION 8225
ReadX 8225 0 512 512
ReadX 8225 2048 512 512
ReadX 8225 2560 512 512
QUERY_FILE_INFORMATION 8225
QUERY_FILE_INFORMATION 8225
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 8226
Close 8226
WriteX 8223 2080 512 512
Close 8223
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 8227
Close 8227
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 8228
QUERY_FILE_INFORMATION 8228
ReadX 8228 0 512 512
ReadX 8228 2048 512 512
ReadX 8228 2560 512 512
QUERY_FILE_INFORMATION 8228
QUERY_FILE_INFORMATION 8228
ReadX 8228 1312 512 512
ReadX 8228 1536 512 512
ReadX 8228 2048 512 512
ReadX 8228 576 512 512
ReadX 8228 1088 512 512
ReadX 8228 1056 512 512
ReadX 8228 1120 512 512
ReadX 8228 1184 512 512
ReadX 8228 2560 2048 2048
ReadX 8228 4608 2048 2048
ReadX 8228 6656 2048 2048
ReadX 8228 8704 2048 2048
ReadX 8228 10752 2048 2048
ReadX 8228 12800 2048 2048
ReadX 8228 14848 2048 512
ReadX 8228 15360 1536 0
ReadX 8228 1088 2048 2048
ReadX 8228 3136 2048 2048
ReadX 8228 1665 5835 5835
ReadX 8228 1856 2048 2048
ReadX 8228 2112 512 512
ReadX 8228 2152 384 384
ReadX 8228 2432 92 92
ReadX 8228 2176 512 512
ReadX 8228 2440 220 220
QUERY_FILE_INFORMATION 8228
QUERY_FILE_INFORMATION 8228
ReadX 8228 2432 512 512
WriteX 8228 2272 512 512
ReadX 8228 2144 512 512
WriteX 8228 2304 512 512
WriteX 8228 2272 92 92
WriteX 8228 2208 512 512
WriteX 8228 2720 512 512
WriteX 8228 0 512 512
QUERY_FILE_INFORMATION 8228
QUERY_FILE_INFORMATION 8228
ReadX 8228 1312 4096 4096
ReadX 8228 5408 4096 4096
ReadX 8228 9504 3305 3305
ReadX 8228 512 4096 4096
QUERY_FILE_INFORMATION 8228
QUERY_FILE_INFORMATION 8228
QUERY_FILE_INFORMATION 8228
WriteX 8228 3132 50 50
WriteX 8228 3182 4096 4096
WriteX 8228 7278 4096 4096
WriteX 8228 15469 1 1
QUERY_FILE_INFORMATION 8228
WriteX 8228 11374 4096 4096
WriteX 8228 15470 3584 3584
WriteX 8228 2144 512 512
WriteX 8228 2336 4096 4096
WriteX 8228 6432 4096 4096
WriteX 8228 10528 4096 4096
WriteX 8228 14624 462 462
WriteX 8228 2048 512 512
WriteX 8228 2560 512 512
WriteX 8228 0 512 512
QUERY_FILE_INFORMATION 8228
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 8229
QUERY_FILE_INFORMATION 8229
ReadX 8229 0 512 512
ReadX 8229 1152 512 512
ReadX 8229 1664 512 512
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
ReadX 8229 512 2048 2048
ReadX 8229 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 8230
WriteX 8230 52 1 1
QUERY_FILE_INFORMATION 8230
WriteX 8230 0 53 53
Close 8230
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
ReadX 8229 1120 504 504
ReadX 8229 896 2048 2048
ReadX 8229 1056 1528 1528
ReadX 8229 864 2048 2048
ReadX 8229 832 2048 2048
ReadX 8229 736 2048 2048
ReadX 8229 1216 512 512
ReadX 8229 1256 384 384
ReadX 8229 1536 140 140
ReadX 8229 1280 512 512
ReadX 8229 1548 252 252
ReadX 8228 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 8231
Close 8231
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 8232
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 8229 2560 2048 2048
ReadX 8229 4608 2048 2048
ReadX 8229 6656 2048 2048
ReadX 8229 8704 2048 2048
ReadX 8229 10752 2048 2048
WriteX 8232 12005 1 1
QUERY_FILE_INFORMATION 8232
WriteX 8232 0 12006 12006
Close 8232
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 8233
QUERY_FILE_INFORMATION 8233
ReadX 8233 0 512 512
ReadX 8233 1152 512 512
ReadX 8233 1664 512 512
QUERY_FILE_INFORMATION 8233
QUERY_FILE_INFORMATION 8233
QUERY_FILE_INFORMATION 8233
QUERY_FILE_INFORMATION 8233
QUERY_FILE_INFORMATION 8233
QUERY_FILE_INFORMATION 8233
QUERY_FILE_INFORMATION 8233
WriteX 8233 1256 384 384
QUERY_FILE_INFORMATION 8233
WriteX 8233 1254 22 22
WriteX 8233 1248 106 106
QUERY_FILE_INFORMATION 8233
WriteX 8233 1280 508 508
ReadX 8233 1280 508 508
QUERY_FILE_INFORMATION 8233
WriteX 8233 1544 384 384
QUERY_FILE_INFORMATION 8233
WriteX 8233 1256 384 384
WriteX 8233 1536 124 124
QUERY_FILE_INFORMATION 8233
WriteX 8233 1543 4 4
QUERY_FILE_INFORMATION 8233
WriteX 8233 1312 252 252
ReadX 8233 1312 252 252
QUERY_FILE_INFORMATION 8233
QUERY_FILE_INFORMATION 8233
WriteX 8233 1544 252 252
QUERY_FILE_INFORMATION 8233
WriteX 8233 1559 4 4
WriteX 8233 1184 512 512
WriteX 8233 1280 512 512
WriteX 8233 1216 512 512
WriteX 8233 1152 512 512
WriteX 8233 0 512 512
QUERY_FILE_INFORMATION 8229
QUERY_FILE_INFORMATION 8229
WriteX 8233 1184 512 512
Close 8233
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 8234
Close 8234
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 8235
QUERY_FILE_INFORMATION 8235
ReadX 8235 0 512 512
ReadX 8235 1152 512 512
ReadX 8235 1664 512 512
QUERY_FILE_INFORMATION 8235
QUERY_FILE_INFORMATION 8235
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 8236
Close 8236
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 8229
ReadX 8235 736 512 512
ReadX 8235 1536 2048 2048
ReadX 8235 3584 2048 2048
ReadX 8235 5632 2048 2048
ReadX 8235 7680 2048 2048
ReadX 8235 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 8237
WriteX 8237 11990 1 1
QUERY_FILE_INFORMATION 8237
WriteX 8237 0 11991 11991
Close 8237
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 8238
QUERY_FILE_INFORMATION 8238
ReadX 8238 0 512 512
ReadX 8238 1184 512 512
ReadX 8238 1696 512 512
QUERY_FILE_INFORMATION 8238
QUERY_FILE_INFORMATION 8238
QUERY_FILE_INFORMATION 8238
QUERY_FILE_INFORMATION 8238
QUERY_FILE_INFORMATION 8238
QUERY_FILE_INFORMATION 8238
QUERY_FILE_INFORMATION 8238
WriteX 8238 1288 384 384
QUERY_FILE_INFORMATION 8238
WriteX 8238 1286 22 22
WriteX 8238 1280 106 106
QUERY_FILE_INFORMATION 8238
WriteX 8238 1312 508 508
ReadX 8238 1312 508 508
QUERY_FILE_INFORMATION 8238
WriteX 8238 1576 384 384
QUERY_FILE_INFORMATION 8238
WriteX 8238 1288 384 384
WriteX 8238 1568 124 124
QUERY_FILE_INFORMATION 8238
WriteX 8238 1575 4 4
QUERY_FILE_INFORMATION 8238
WriteX 8238 1344 252 252
ReadX 8238 1344 252 252
QUERY_FILE_INFORMATION 8238
QUERY_FILE_INFORMATION 8238
WriteX 8238 1576 252 252
QUERY_FILE_INFORMATION 8238
WriteX 8238 1591 4 4
WriteX 8238 1216 512 512
WriteX 8238 1312 512 512
WriteX 8238 1248 512 512
WriteX 8238 1184 512 512
WriteX 8238 0 512 512
QUERY_FILE_INFORMATION 8235
QUERY_FILE_INFORMATION 8235
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 8235
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 8239
Close 8239
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 8240
QUERY_FILE_INFORMATION 8240
ReadX 8240 0 512 512
ReadX 8240 1152 512 512
ReadX 8240 1664 512 512
QUERY_FILE_INFORMATION 8240
QUERY_FILE_INFORMATION 8240
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 8241
Close 8241
WriteX 8238 1216 512 512
Close 8238
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 8242
Close 8242
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 8243
QUERY_FILE_INFORMATION 8243
ReadX 8243 0 512 512
ReadX 8243 1184 512 512
ReadX 8243 1696 512 512
QUERY_FILE_INFORMATION 8243
QUERY_FILE_INFORMATION 8243
ReadX 8243 1536 512 512
ReadX 8243 736 512 512
ReadX 8243 2048 512 512
ReadX 8243 2560 512 512
ReadX 8243 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 8244
Close 8244
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 8243 914 3899 3899
ReadX 8243 1248 512 512
ReadX 8243 1288 384 384
ReadX 8243 1568 124 124
ReadX 8243 1312 512 512
ReadX 8243 1576 252 252
QUERY_FILE_INFORMATION 8243
QUERY_FILE_INFORMATION 8243
ReadX 8243 1568 512 512
WriteX 8243 1408 512 512
ReadX 8243 1280 512 512
WriteX 8243 1440 512 512
WriteX 8243 1408 124 124
WriteX 8243 1344 512 512
WriteX 8243 1856 512 512
WriteX 8243 0 512 512
QUERY_FILE_INFORMATION 8243
QUERY_FILE_INFORMATION 8243
ReadX 8243 544 4096 4096
ReadX 8243 4640 4096 4096
ReadX 8243 8736 1637 1637
ReadX 8243 512 4096 4096
QUERY_FILE_INFORMATION 8243
QUERY_FILE_INFORMATION 8243
WriteX 8243 1280 512 512
WriteX 8243 1472 3584 3584
WriteX 8243 5056 4096 4096
WriteX 8243 13247 1 1
QUERY_FILE_INFORMATION 8243
WriteX 8243 9152 4096 4096
WriteX 8243 13248 1736 1736
WriteX 8243 1184 512 512
WriteX 8243 1696 512 512
WriteX 8243 0 512 512
QUERY_FILE_INFORMATION 8243
ReadX 8243 1632 1024 1024
ReadX 8243 288 1024 1024
ReadX 8243 1312 2048 2048
ReadX 8243 3360 1024 1024
ReadX 8243 1696 1024 1024
ReadX 8243 2720 512 512
ReadX 8243 3232 512 512
ReadX 8243 3744 512 512
ReadX 8243 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 8243 2066 3998 3998
ReadX 8243 1448 384 384
ReadX 8243 1408 124 124
ReadX 8243 1416 252 252
QUERY_FILE_INFORMATION 8243
QUERY_FILE_INFORMATION 8243
ReadX 8243 1408 512 512
WriteX 8243 1536 512 512
ReadX 8243 1440 512 512
WriteX 8243 2048 512 512
WriteX 8243 1536 124 124
WriteX 8243 512 512 512
WriteX 8243 1024 512 512
WriteX 8243 0 512 512
QUERY_FILE_INFORMATION 8243
ReadX 8243 1696 4096 4096
ReadX 8243 5792 4096 4096
ReadX 8243 9888 1736 1736
ReadX 8243 1280 512 512
ReadX 8243 1472 3584 3584
QUERY_FILE_INFORMATION 8243
QUERY_FILE_INFORMATION 8243
WriteX 8243 3940 156 156
WriteX 8243 4096 512 512
WriteX 8243 544 3584 3584
WriteX 8243 4128 4096 4096
WriteX 8243 8224 3584 3584
WriteX 8243 1344 512 512
WriteX 8243 1856 1536 1536
WriteX 8243 2336 512 512
WriteX 8243 3584 356 356
WriteX 8243 2560 512 512
WriteX 8243 3072 512 512
WriteX 8243 0 512 512
QUERY_FILE_INFORMATION 8243
Close 8225
Close 8228
Close 8243
Close 8240
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 8245
Close 8245
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 8246
Close 8246
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 8247
WriteX 8247 0 65471 65471
WriteX 8247 65471 63 63
WriteX 8247 65534 65471 65471
WriteX 8247 131005 63 63
Close 8247
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 8248
WriteX 8248 0 65471 65471
WriteX 8248 65471 63 63
WriteX 8248 65534 65471 65471
WriteX 8248 131005 63 63
WriteX 8248 131068 65471 65471
WriteX 8248 196539 63 63
WriteX 8248 196602 65471 65471
WriteX 8248 262073 63 63
Close 8248
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 8249
WriteX 8249 0 65471 65471
WriteX 8249 65471 63 63
WriteX 8249 65534 65471 65471
WriteX 8249 131005 63 63
WriteX 8249 131068 65471 65471
WriteX 8249 196539 63 63
WriteX 8249 196602 65471 65471
WriteX 8249 262073 63 63
WriteX 8249 262136 65471 65471
WriteX 8249 327607 63 63
WriteX 8249 327670 65471 65471
WriteX 8249 393141 63 63
WriteX 8249 393204 65471 65471
WriteX 8249 458675 63 63
WriteX 8249 458738 65471 65471
WriteX 8249 524209 63 63
Close 8249
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 8250
QUERY_FILE_INFORMATION 8250
QUERY_FILE_INFORMATION 8250
ReadX 8250 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 8251
Close 8251
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 8252
WriteX 8252 63 1 1
QUERY_FILE_INFORMATION 8252
WriteX 8252 0 64 64
ReadX 8250 992 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 344 2048 2048
ReadX 8250 1344 2048 2048
ReadX 8250 1352 2048 2048
ReadX 8250 1320 2048 2048
ReadX 8250 1360 2048 2048
ReadX 8250 1344 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2304 2048 2048
ReadX 8250 1472 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 1480 2048 2048
ReadX 8250 1488 2048 2048
ReadX 8250 1496 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 1504 2048 2048
ReadX 8250 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 1000 2048 2048
ReadX 8250 1416 2048 2048
ReadX 8250 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 8250 360 2048 2048
ReadX 8250 368 2048 2048
ReadX 8250 360 2048 2048
ReadX 8250 376 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 1232 2048 2048
ReadX 8250 2432 6144 6144
ReadX 8250 2376 2048 2048
ReadX 8250 2360 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 2376 2048 2048
ReadX 8250 2384 2048 2048
ReadX 8250 2368 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 1296 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 8250 0 2048 2048
ReadX 8250 2688 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 2688 2048 2048
WriteX 8250 2688 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 2688 2048 2048
ReadX 8250 2688 2048 2048
ReadX 8250 2688 2048 2048
WriteX 8250 2688 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 8250 2688 2048 2048
ReadX 8250 2688 2048 2048
WriteX 8250 2688 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 320 4096 4096
ReadX 8250 0 2048 2048
ReadX 8250 3584 2048 2048
ReadX 8250 3584 2048 2048
ReadX 8250 3584 2048 2048
ReadX 8250 0 2048 2048
WriteX 8250 3584 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2688 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 2688 2048 2048
ReadX 8250 2688 2048 2048
WriteX 8250 2688 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 3200 2048 2048
ReadX 8250 3200 2048 2048
ReadX 8250 3200 2048 2048
WriteX 8250 3200 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 3456 2048 2048
ReadX 8250 3456 2048 2048
ReadX 8250 3456 2048 2048
WriteX 8250 3456 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2496 2048 2048
ReadX 8250 2472 2048 2048
ReadX 8250 2456 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 2472 2048 2048
ReadX 8250 2480 2048 2048
ReadX 8250 2464 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 2488 2048 2048
ReadX 8250 2568 8192 8192
ReadX 8250 1000 2048 2048
ReadX 8250 328 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 2048 2048 2048
ReadX 8250 2560 2048 2048
ReadX 8250 920 2048 2048
WriteX 8250 2048 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 312 2048 2048
WriteX 8250 336 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 328 2048 2048
WriteX 8250 2560 2048 2048
WriteX 8250 3840 2048 2048
WriteX 8250 920 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2432 2048 2048
WriteX 8250 2432 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2456 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 328 2048 2048
ReadX 8250 2560 2048 2048
ReadX 8250 2048 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 336 2048 2048
ReadX 8250 920 2048 2048
WriteX 8250 1536 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 2048 2048 2048
WriteX 8250 2560 2048 2048
WriteX 8250 336 2048 2048
WriteX 8250 920 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2048 2048 2048
ReadX 8250 2432 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 2048 2048 2048
WriteX 8250 2432 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2456 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1536 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 336 2048 2048
ReadX 8250 920 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 1536 2048 2048
WriteX 8250 336 2048 2048
WriteX 8250 920 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2432 2048 2048
WriteX 8250 2432 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2456 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1536 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 336 2048 2048
ReadX 8250 920 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 1536 2048 2048
WriteX 8250 336 2048 2048
WriteX 8250 920 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2432 2048 2048
WriteX 8250 2432 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2456 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1536 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 336 2048 2048
ReadX 8250 920 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 1536 2048 2048
WriteX 8250 336 2048 2048
WriteX 8250 920 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2432 2048 2048
WriteX 8250 2432 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2456 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1536 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 336 2048 2048
ReadX 8250 920 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 1536 2048 2048
WriteX 8250 336 2048 2048
WriteX 8250 920 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2432 2048 2048
WriteX 8250 2432 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
Flush 8250
ReadX 8250 2456 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1536 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 336 2048 2048
ReadX 8250 920 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 1536 2048 2048
WriteX 8250 336 2048 2048
WriteX 8250 920 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2432 2048 2048
WriteX 8250 2432 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2624 6144 6144
ReadX 8250 2616 2048 2048
ReadX 8250 2688 2048 2048
ReadX 8250 2600 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 2616 2048 2048
ReadX 8250 2608 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 344 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 520 2048 2048
ReadX 8250 1392 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 400 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 536 2048 2048
ReadX 8250 824 2048 2048
ReadX 8250 832 2048 2048
ReadX 8250 384 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 408 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 552 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 824 2048 2048
ReadX 8250 840 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 768 2048 2048
ReadX 8250 2048 2048 2048
WriteX 8250 1415 1 1
WriteX 8250 352 2048 2048
WriteX 8250 1112 2048 2048
WriteX 8250 1400 2048 2048
WriteX 8250 1408 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 2048 2048 2048
WriteX 8250 768 2048 2048
WriteX 8250 344 2048 2048
WriteX 8250 1000 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 416 2048 2048
ReadX 8250 424 2048 2048
ReadX 8250 432 2048 2048
ReadX 8250 440 2048 2048
ReadX 8250 576 16384 16384
ReadX 8250 448 2048 2048
ReadX 8250 456 2048 2048
ReadX 8250 464 2048 2048
ReadX 8250 640 16384 16384
ReadX 8250 704 16384 16384
ReadX 8250 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 8250 848 2048 2048
ReadX 8250 560 2048 2048
ReadX 8250 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 2600 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 352 2048 2048
ReadX 8250 1928 8192 8192
ReadX 8250 528 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 824 2048 2048
ReadX 8250 0 2048 2048
Flush 8250
ReadX 8250 2600 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 352 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 824 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 856 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 392 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 472 2048 2048
ReadX 8250 480 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 488 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 928 2048 2048
ReadX 8250 936 2048 2048
ReadX 8250 976 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 392 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 952 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 528 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 528 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 816 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 8250 1336 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 528 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 528 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1240 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2200 4096 4096
ReadX 8250 2152 2048 2048
ReadX 8250 2160 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1312 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 1928 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 824 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1416 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 352 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 824 2048 2048
ReadX 8250 384 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 8250 352 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 768 2048 2048
ReadX 8250 2048 2048 2048
ReadX 8250 352 2048 2048
WriteX 8250 1551 1 1
WriteX 8250 1512 2048 2048
WriteX 8250 1520 2048 2048
WriteX 8250 1528 2048 2048
WriteX 8250 1544 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 2048 2048 2048
WriteX 8250 768 2048 2048
WriteX 8250 344 2048 2048
WriteX 8250 1000 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2048 2048 2048
WriteX 8250 2048 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 1000 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1240 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 344 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 384 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 768 2048 2048
WriteX 8250 1567 1 1
WriteX 8250 1552 2048 2048
WriteX 8250 1560 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 768 2048 2048
WriteX 8250 344 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 1328 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1240 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2200 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1240 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 344 2048 2048
ReadX 8250 384 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 2048 2048 2048
ReadX 8250 768 2048 2048
WriteX 8250 1583 1 1
WriteX 8250 1568 2048 2048
WriteX 8250 1576 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 2048 2048 2048
WriteX 8250 768 2048 2048
WriteX 8250 344 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 864 2048 2048
ReadX 8250 872 2048 2048
ReadX 8250 912 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 2688 2048 2048
ReadX 8250 1000 2048 2048
WriteX 8250 2688 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 2944 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 0 2048 2048
Flush 8250
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 2688 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 2688 2048 2048
WriteX 8250 2688 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 392 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 416 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 416 2048 2048
ReadX 8250 864 2048 2048
ReadX 8250 872 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 312 2048 2048
ReadX 8250 888 2048 2048
ReadX 8250 400 2048 2048
ReadX 8250 896 2048 2048
WriteX 8250 1584 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 400 2048 2048
WriteX 8250 416 2048 2048
WriteX 8250 864 2048 2048
WriteX 8250 872 2048 2048
WriteX 8250 888 2048 2048
WriteX 8250 896 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 584 2048 2048
ReadX 8250 392 2048 2048
WriteX 8250 392 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 1328 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 0 2048 2048
ReadX 8250 408 2048 2048
ReadX 8250 1328 2048 2048
ReadX 8250 864 2048 2048
ReadX 8250 912 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 3840 2048 2048
ReadX 8250 312 2048 2048
ReadX 8250 1584 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 408 2048 2048
WriteX 8250 912 2048 2048
WriteX 8250 1584 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 408 2048 2048
ReadX 8250 392 2048 2048
WriteX 8250 392 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 528 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 528 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 552 2048 2048
ReadX 8250 1336 2048 2048
WriteX 8250 552 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 0 2048 2048
ReadX 8250 552 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 2664 2048 2048
ReadX 8250 2648 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 2672 2048 2048
ReadX 8250 2656 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8250 528 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 1336 2048 2048
ReadX 8250 2680 2048 2048
ReadX 8250 2760 8192 8192
ReadX 8250 544 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 568 2048 2048
ReadX 8250 544 2048 2048
ReadX 8250 0 2048 2048
Flush 8250
ReadX 8250 2816 6144 6144
ReadX 8250 2760 2048 2048
ReadX 8250 2744 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 2752 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 528 2048 2048
ReadX 8250 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 8254
Close 8254
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 8256
WriteX 8256 4065 1 1
QUERY_FILE_INFORMATION 8256
WriteX 8256 0 62591 62591
Close 8256
ReadX 8250 0 2048 2048
ReadX 8250 2808 2048 2048
ReadX 8250 2792 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 2800 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 384 2048 2048
ReadX 8250 392 2048 2048
ReadX 8250 1384 2048 2048
ReadX 8250 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 8258
Close 8258
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 8260
WriteX 8260 4094 1 1
QUERY_FILE_INFORMATION 8260
WriteX 8260 0 10845 10845
Close 8260
ReadX 8250 1432 2048 2048
ReadX 8250 1304 2048 2048
ReadX 8250 1368 2048 2048
ReadX 8250 2304 2048 2048
ReadX 8250 1440 2048 2048
ReadX 8250 1424 2048 2048
ReadX 8250 1448 2048 2048
ReadX 8250 1456 2048 2048
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 8262
Close 8262
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 8264
ReadX 8250 0 2048 2048
WriteX 8264 4081 1 1
QUERY_FILE_INFORMATION 8264
WriteX 8264 0 30118 30118
Close 8264
ReadX 8250 1344 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1152 2048 2048
ReadX 8250 1152 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 1000 2048 2048
ReadX 8250 768 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 344 2048 2048
WriteX 8250 1000 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 1416 2048 2048
ReadX 8250 1416 2048 2048
ReadX 8250 344 2048 2048
ReadX 8250 896 2048 2048
WriteX 8250 1538 2 2
WriteX 8250 344 2048 2048
WriteX 8250 1416 2048 2048
WriteX 8250 1538 2 2
ReadX 8250 2048 2048 2048
WriteX 8250 2048 2048 2048
WriteX 8250 1538 2 2
Close 8250
Close 8252
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 8265
ReadX 8265 0 65471 65471
ReadX 8265 65471 63 63
ReadX 8265 65534 65471 65471
ReadX 8265 131005 63 63
ReadX 8265 131068 65471 65471
ReadX 8265 196539 63 63
ReadX 8265 196602 65471 65471
ReadX 8265 262073 63 63
ReadX 8265 262136 65471 65471
ReadX 8265 327607 63 63
ReadX 8265 327670 10 10
Close 8265
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 8266
ReadX 8266 0 65471 65471
ReadX 8266 65471 63 63
ReadX 8266 65534 65471 65471
ReadX 8266 131005 63 63
ReadX 8266 131068 65471 65471
ReadX 8266 196539 63 63
ReadX 8266 196602 65471 65471
ReadX 8266 262073 63 63
ReadX 8266 262136 65471 65471
ReadX 8266 327607 63 63
ReadX 8266 327670 65471 65471
ReadX 8266 393141 63 63
ReadX 8266 393204 65471 65471
ReadX 8266 458675 63 63
ReadX 8266 458738 65471 65471
ReadX 8266 524209 63 63
ReadX 8266 524272 65471 65471
ReadX 8266 589743 63 63
ReadX 8266 589806 65471 65471
ReadX 8266 655277 63 63
ReadX 8266 655340 32 32
Close 8266
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 8267
ReadX 8267 0 65471 65471
ReadX 8267 65471 63 63
ReadX 8267 65534 65471 65471
ReadX 8267 131005 63 63
ReadX 8267 131068 65471 65471
ReadX 8267 196539 63 63
ReadX 8267 196602 65471 65471
ReadX 8267 262073 63 63
ReadX 8267 262136 65471 65471
ReadX 8267 327607 63 63
ReadX 8267 327670 65471 65471
ReadX 8267 393141 63 63
ReadX 8267 393204 65471 65471
ReadX 8267 458675 63 63
ReadX 8267 458738 65471 65471
ReadX 8267 524209 63 63
ReadX 8267 524272 65471 65471
ReadX 8267 589743 63 63
ReadX 8267 589806 65471 65471
ReadX 8267 655277 63 63
ReadX 8267 655340 65471 65471
ReadX 8267 720811 63 63
ReadX 8267 720874 65471 65471
ReadX 8267 786345 63 63
ReadX 8267 786408 65471 65471
ReadX 8267 851879 63 63
ReadX 8267 851942 65471 65471
ReadX 8267 917413 63 63
ReadX 8267 917476 65471 65471
ReadX 8267 982947 63 63
ReadX 8267 983010 65471 65471
ReadX 8267 1048481 63 63
ReadX 8267 1048544 65471 65471
ReadX 8267 1114015 63 63
ReadX 8267 1114078 65471 65471
ReadX 8267 1179549 63 63
ReadX 8267 1179612 65471 65471
ReadX 8267 1245083 63 63
ReadX 8267 1245146 65471 65471
ReadX 8267 1310617 63 63
ReadX 8267 1310680 65471 65471
ReadX 8267 1376151 63 63
ReadX 8267 1376214 65471 65471
ReadX 8267 1441685 63 63
ReadX 8267 1441748 65471 65471
ReadX 8267 1507219 63 63
ReadX 8267 1507282 65471 65471
ReadX 8267 1572753 63 63
ReadX 8267 1572816 65471 65471
ReadX 8267 1638287 63 63
ReadX 8267 1638350 65471 65471
ReadX 8267 1703821 63 63
ReadX 8267 1703884 65471 65471
ReadX 8267 1769355 63 63
ReadX 8267 1769418 65471 65471
ReadX 8267 1834889 63 63
ReadX 8267 1834952 32824 32824
Close 8267
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 8268
Close 8268
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 8269
ReadX 8269 0 24 24
Close 8269
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 8270
QUERY_FILE_INFORMATION 8270
ReadX 8270 0 512 512
ReadX 8270 464 512 512
ReadX 8270 498 512 512
ReadX 8270 472 512 512
ReadX 8270 466 512 512
ReadX 8270 978 512 512
ReadX 8270 497 57 57
Close 8270
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 8271
QUERY_FILE_INFORMATION 8271
ReadX 8271 0 512 512
ReadX 8271 464 512 512
ReadX 8271 498 512 512
ReadX 8271 472 512 512
ReadX 8271 462 512 512
ReadX 8271 468 512 512
ReadX 8271 466 512 512
QUERY_FILE_INFORMATION 8271
WriteX 8271 482 60 60
WriteX 8271 482 4 4
QUERY_FILE_INFORMATION 8271
WriteX 8271 482 11 11
ReadX 8271 497 57 57
ReadX 8271 497 57 57
ReadX 8271 368 4096 4096
ReadX 8271 460 512 512
ReadX 8271 512 4096 4096
ReadX 8271 4608 4096 4096
ReadX 8271 8704 4096 4096
ReadX 8271 12800 4096 4096
ReadX 8271 16896 4096 4096
ReadX 8271 20992 4096 4096
ReadX 8271 25088 4096 4096
ReadX 8271 29184 4096 4096
ReadX 8271 33280 4096 4096
ReadX 8271 37376 4096 4096
ReadX 8271 41472 4096 4096
ReadX 8271 45568 4096 4096
ReadX 8271 49664 4096 4096
ReadX 8271 53760 4096 4096
ReadX 8271 57856 4096 4096
ReadX 8271 61952 4096 4096
ReadX 8271 66048 4096 4096
ReadX 8271 70144 4096 4096
ReadX 8271 497 20 20
ReadX 8271 496 103 103
ReadX 8271 500 448 448
ReadX 8271 470 512 512
ReadX 8271 486 2692 2692
ReadX 8271 290 4096 4096
ReadX 8271 4386 4096 4096
ReadX 8271 8482 4096 4096
ReadX 8271 500 20 20
ReadX 8271 483 108 108
ReadX 8271 482 292 292
ReadX 8271 338 4096 4096
ReadX 8271 4434 3103 3103
ReadX 8271 384 28 28
ReadX 8271 412 20 20
ReadX 8271 432 8 8
ReadX 8271 440 136 136
ReadX 8271 576 8 8
ReadX 8271 584 4 4
ReadX 8271 588 4 4
ReadX 8271 592 39 39
ReadX 8271 384 4 4
ReadX 8271 388 4 4
ReadX 8271 392 23 23
ReadX 8271 385 4 4
ReadX 8271 389 4 4
ReadX 8271 393 12 12
ReadX 8271 405 4 4
ReadX 8271 409 4 4
ReadX 8271 413 1 1
ReadX 8271 385 4 4
ReadX 8271 389 4 4
ReadX 8271 393 1 1
ReadX 8271 385 4 4
ReadX 8271 389 4 4
ReadX 8271 393 12 12
ReadX 8271 405 4 4
ReadX 8271 409 4 4
ReadX 8271 413 2 2
ReadX 8271 385 4 4
ReadX 8271 389 4 4
ReadX 8271 393 25 25
ReadX 8271 385 4 4
ReadX 8271 389 8 8
ReadX 8271 397 4 4
ReadX 8271 401 8 8
ReadX 8271 409 4 4
ReadX 8271 413 8 8
ReadX 8271 421 4 4
ReadX 8271 425 8 8
ReadX 8271 433 4 4
ReadX 8271 437 4 4
ReadX 8271 441 4 4
ReadX 8271 445 4 4
ReadX 8271 449 4 4
ReadX 8271 453 4 4
ReadX 8271 457 4 4
ReadX 8271 461 4 4
ReadX 8271 465 10670 10670
ReadX 8271 428 4096 4096
WriteX 8271 498 512 512
WriteX 8271 472 512 512
WriteX 8271 462 512 512
WriteX 8271 468 512 512
Close 8271
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 8272
Close 8272
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 8273
QUERY_FILE_INFORMATION 8273
ReadX 8273 0 512 512
ReadX 8273 464 512 512
ReadX 8273 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 8274
Close 8274
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 8273
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 8276
WriteX 8276 4607 1 1
QUERY_FILE_INFORMATION 8276
WriteX 8276 0 65471 65471
WriteX 8276 65471 65 65
WriteX 8276 65536 19979 19979
Close 8276
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8277
QUERY_FILE_INFORMATION 8277
ReadX 8277 0 512 512
ReadX 8277 462 512 512
ReadX 8277 974 512 512
ReadX 8277 1486 512 512
ReadX 8277 460 512 512
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
WriteX 8277 470 448 448
QUERY_FILE_INFORMATION 8277
WriteX 8277 470 60 60
WriteX 8277 470 4 4
QUERY_FILE_INFORMATION 8277
WriteX 8277 470 11 11
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
WriteX 8277 464 512 512
WriteX 8277 976 512 512
WriteX 8277 1488 512 512
WriteX 8277 462 512 512
WriteX 8277 0 512 512
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
ReadX 8277 470 512 512
WriteX 8277 482 512 512
WriteX 8277 482 292 292
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
WriteX 8277 483 20 20
WriteX 8277 483 108 108
QUERY_FILE_INFORMATION 8277
WriteX 8277 484 448 448
QUERY_FILE_INFORMATION 8277
WriteX 8277 484 44 44
WriteX 8277 484 20 20
WriteX 8277 480 512 512
WriteX 8277 472 512 512
WriteX 8277 476 512 512
WriteX 8277 988 512 512
WriteX 8277 474 512 512
Flush 8277
WriteX 8277 0 512 512
Flush 8277
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
WriteX 8277 480 512 512
WriteX 8277 472 512 512
WriteX 8277 476 512 512
QUERY_FILE_INFORMATION 8277
WriteX 8277 496 320 320
QUERY_FILE_INFORMATION 8277
WriteX 8277 496 60 60
ReadX 8277 484 512 512
WriteX 8277 500 512 512
WriteX 8277 470 512 512
WriteX 8277 486 2692 2692
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
WriteX 8277 497 25 25
WriteX 8277 496 103 103
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
WriteX 8277 497 44 44
WriteX 8277 497 20 20
WriteX 8277 498 512 512
WriteX 8277 462 512 512
WriteX 8277 466 512 512
WriteX 8277 978 512 512
WriteX 8277 464 512 512
Flush 8277
WriteX 8277 0 512 512
Flush 8277
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
QUERY_FILE_INFORMATION 8277
WriteX 8277 497 7 7
WriteX 8277 497 57 57
WriteX 8277 498 512 512
WriteX 8277 472 512 512
WriteX 8277 462 512 512
WriteX 8277 466 512 512
WriteX 8277 978 512 512
Flush 8277
WriteX 8277 498 512 512
Flush 8277
Close 8277
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8278
QUERY_FILE_INFORMATION 8278
ReadX 8278 0 512 512
ReadX 8278 464 512 512
ReadX 8278 498 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 8279
ReadX 8279 0 20 20
ReadX 8279 14 40 40
ReadX 8279 54 64 64
ReadX 8279 118 1152 1152
Close 8279
Close 8278
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8280
Close 8280
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8281
ReadX 8281 0 24 24
Close 8281
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8282
QUERY_FILE_INFORMATION 8282
ReadX 8282 0 512 512
ReadX 8282 464 512 512
ReadX 8282 498 512 512
ReadX 8282 472 512 512
ReadX 8282 462 512 512
ReadX 8282 466 512 512
ReadX 8282 978 512 512
ReadX 8282 497 57 57
Close 8282
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8283
QUERY_FILE_INFORMATION 8283
ReadX 8283 0 512 512
ReadX 8283 464 512 512
ReadX 8283 498 512 512
ReadX 8283 472 512 512
ReadX 8283 468 512 512
ReadX 8283 462 512 512
ReadX 8283 466 512 512
QUERY_FILE_INFORMATION 8283
WriteX 8283 482 60 60
WriteX 8283 482 4 4
QUERY_FILE_INFORMATION 8283
WriteX 8283 482 11 11
WriteX 8283 498 512 512
WriteX 8283 472 512 512
WriteX 8283 462 512 512
WriteX 8283 466 512 512
WriteX 8283 978 512 512
Close 8283
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 8284
Close 8284
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 8285
Close 8285
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 8287
WriteX 8287 4607 1 1
QUERY_FILE_INFORMATION 8287
WriteX 8287 0 65471 65471
WriteX 8287 65471 65 65
WriteX 8287 65536 17654 17654
Close 8287
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8288
QUERY_FILE_INFORMATION 8288
ReadX 8288 0 512 512
ReadX 8288 474 512 512
ReadX 8288 986 512 512
ReadX 8288 1498 512 512
ReadX 8288 472 512 512
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
WriteX 8288 482 448 448
QUERY_FILE_INFORMATION 8288
WriteX 8288 482 60 60
WriteX 8288 482 4 4
QUERY_FILE_INFORMATION 8288
WriteX 8288 482 11 11
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
WriteX 8288 476 512 512
WriteX 8288 988 512 512
WriteX 8288 1500 512 512
WriteX 8288 474 512 512
WriteX 8288 0 512 512
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
ReadX 8288 482 512 512
WriteX 8288 494 512 512
WriteX 8288 494 292 292
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
WriteX 8288 495 20 20
WriteX 8288 495 108 108
QUERY_FILE_INFORMATION 8288
WriteX 8288 496 448 448
QUERY_FILE_INFORMATION 8288
WriteX 8288 496 44 44
WriteX 8288 496 20 20
WriteX 8288 492 512 512
WriteX 8288 484 512 512
WriteX 8288 488 512 512
WriteX 8288 1000 512 512
WriteX 8288 486 512 512
Flush 8288
WriteX 8288 0 512 512
Flush 8288
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
WriteX 8288 492 512 512
WriteX 8288 484 512 512
WriteX 8288 488 512 512
QUERY_FILE_INFORMATION 8288
WriteX 8288 508 320 320
QUERY_FILE_INFORMATION 8288
WriteX 8288 508 60 60
ReadX 8288 496 512 512
WriteX 8288 512 512 512
WriteX 8288 482 512 512
WriteX 8288 498 2692 2692
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
WriteX 8288 509 25 25
WriteX 8288 508 103 103
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
WriteX 8288 509 44 44
WriteX 8288 509 20 20
WriteX 8288 510 512 512
WriteX 8288 474 512 512
WriteX 8288 478 512 512
WriteX 8288 990 512 512
WriteX 8288 476 512 512
Flush 8288
WriteX 8288 0 512 512
Flush 8288
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
QUERY_FILE_INFORMATION 8288
WriteX 8288 509 7 7
WriteX 8288 509 57 57
WriteX 8288 510 512 512
WriteX 8288 484 512 512
WriteX 8288 474 512 512
WriteX 8288 478 512 512
WriteX 8288 990 512 512
Flush 8288
WriteX 8288 510 512 512
Flush 8288
Close 8288
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8289
Close 8289
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8290
QUERY_FILE_INFORMATION 8290
ReadX 8290 0 512 512
ReadX 8290 476 512 512
ReadX 8290 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 8291
Close 8291
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 8292
QUERY_FILE_INFORMATION 8292
ReadX 8292 0 512 512
ReadX 8292 512 512 512
ReadX 8292 770 512 512
ReadX 8292 1282 512 512
ReadX 8292 1794 512 512
ReadX 8292 2562 512 512
ReadX 8292 3586 512 512
ReadX 8292 3828 512 512
ReadX 8292 288 512 512
ReadX 8292 1024 512 512
ReadX 8292 954 512 512
ReadX 8292 295 512 512
ReadX 8292 320 512 512
ReadX 8292 322 512 512
ReadX 8292 834 512 512
ReadX 8292 1346 512 512
ReadX 8292 1858 512 512
ReadX 8292 323 512 512
ReadX 8292 835 512 512
ReadX 8292 1347 512 512
ReadX 8292 1859 512 512
ReadX 8292 2371 345 345
ReadX 8292 322 167 167
ReadX 8292 489 512 512
ReadX 8292 1001 512 512
ReadX 8292 1513 512 512
ReadX 8292 2025 512 512
ReadX 8292 2537 512 512
ReadX 8292 3049 512 512
ReadX 8292 3561 345 345
ReadX 8292 323 167 167
ReadX 8292 490 512 512
ReadX 8292 1002 512 512
ReadX 8292 1514 512 512
ReadX 8292 2026 512 512
ReadX 8292 2538 512 512
ReadX 8292 3050 512 512
ReadX 8292 3562 512 512
ReadX 8292 4074 512 512
ReadX 8292 4586 512 512
ReadX 8292 5098 512 512
ReadX 8292 5610 512 512
ReadX 8292 6122 512 512
ReadX 8292 6634 512 512
ReadX 8292 7146 512 512
ReadX 8292 7658 512 512
ReadX 8292 8170 512 512
ReadX 8292 8682 512 512
ReadX 8292 9194 512 512
ReadX 8292 9706 512 512
ReadX 8292 10218 512 512
ReadX 8292 10730 345 345
ReadX 8292 11075 512 512
ReadX 8292 11587 167 167
ReadX 8292 11754 512 512
ReadX 8292 12266 512 512
ReadX 8292 12778 512 512
ReadX 8292 13290 512 512
ReadX 8292 13802 512 512
ReadX 8292 14314 512 512
ReadX 8292 14826 512 512
ReadX 8292 15338 512 512
ReadX 8292 337 512 512
ReadX 8292 337 512 512
ReadX 8292 849 34 34
ReadX 8292 352 512 512
ReadX 8292 864 512 512
ReadX 8292 1376 512 512
ReadX 8292 1888 512 512
ReadX 8292 2400 512 512
ReadX 8292 2912 512 512
ReadX 8292 3424 512 512
ReadX 8292 3936 512 512
ReadX 8292 1632 512 512
ReadX 8292 2144 512 512
ReadX 8292 1682 512 512
ReadX 8292 258 512 512
ReadX 8292 360 144 144
ReadX 8292 2517 512 512
ReadX 8292 3029 512 512
ReadX 8292 1751 512 512
ReadX 8292 2263 512 512
ReadX 8292 2775 512 512
ReadX 8292 3287 512 512
ReadX 8292 3799 512 512
ReadX 8292 4311 512 512
ReadX 8292 4823 512 512
ReadX 8292 5335 512 512
ReadX 8292 5847 512 512
ReadX 8292 6359 512 512
ReadX 8292 6871 512 512
ReadX 8292 7383 512 512
ReadX 8292 7895 512 512
ReadX 8292 8407 512 512
ReadX 8292 8919 512 512
ReadX 8292 9431 512 512
ReadX 8292 9943 512 512
ReadX 8292 10455 512 512
ReadX 8292 10967 512 512
ReadX 8292 11479 512 512
ReadX 8292 2556 512 512
ReadX 8292 3068 512 512
ReadX 8292 3580 512 512
ReadX 8292 4092 512 512
ReadX 8292 4604 512 512
ReadX 8292 5116 512 512
ReadX 8292 5628 512 512
ReadX 8292 6140 512 512
ReadX 8292 6652 512 512
ReadX 8292 7164 512 512
ReadX 8292 7676 512 512
ReadX 8292 8188 512 512
ReadX 8292 8700 512 512
ReadX 8292 9212 512 512
ReadX 8292 9724 512 512
ReadX 8292 10236 512 512
ReadX 8292 10748 512 512
ReadX 8292 11260 512 512
ReadX 8292 11772 512 512
ReadX 8292 12284 512 512
ReadX 8292 12796 49 49
ReadX 8292 260 463 463
ReadX 8292 723 512 512
ReadX 8292 1235 512 512
ReadX 8292 1747 512 512
ReadX 8292 2259 512 512
ReadX 8292 2771 512 512
ReadX 8292 3283 512 512
ReadX 8292 3795 512 512
ReadX 8292 4307 512 512
ReadX 8292 4819 512 512
ReadX 8292 5331 512 512
ReadX 8292 5843 512 512
ReadX 8292 6355 512 512
ReadX 8292 6867 512 512
ReadX 8292 7379 512 512
ReadX 8292 7891 512 512
ReadX 8292 8403 512 512
ReadX 8292 8915 512 512
ReadX 8292 9427 512 512
ReadX 8292 9939 512 512
ReadX 8292 10451 512 512
ReadX 8292 10963 402 402
ReadX 8292 593 240 240
ReadX 8292 2048 272 272
ReadX 8292 2320 512 512
ReadX 8292 2832 512 512
ReadX 8292 3344 512 512
ReadX 8292 3856 512 512
ReadX 8292 4368 512 512
ReadX 8292 4880 512 512
ReadX 8292 5392 240 240
ReadX 8292 608 272 272
ReadX 8292 880 512 512
ReadX 8292 1392 512 512
ReadX 8292 1904 512 512
ReadX 8292 2416 512 512
ReadX 8292 2928 512 512
ReadX 8292 3440 512 512
ReadX 8292 3952 512 512
ReadX 8292 4464 512 512
ReadX 8292 4976 512 512
ReadX 8292 5488 512 512
ReadX 8292 6000 512 512
ReadX 8292 6512 512 512
ReadX 8292 7024 512 512
ReadX 8292 7536 512 512
ReadX 8292 8048 512 512
ReadX 8292 8560 512 512
ReadX 8292 9072 512 512
ReadX 8292 9584 512 512
ReadX 8292 10096 512 512
ReadX 8292 1683 512 512
ReadX 8292 514 512 512
ReadX 8292 620 512 512
ReadX 8292 770 512 512
ReadX 8292 1282 512 512
ReadX 8292 1794 512 512
ReadX 8292 2000 512 512
ReadX 8292 1434 512 512
ReadX 8292 2050 512 512
ReadX 8292 2118 512 512
ReadX 8292 1715 512 512
ReadX 8292 1024 512 512
ReadX 8292 954 512 512
ReadX 8292 1880 512 512
ReadX 8292 1286 512 512
ReadX 8292 1510 512 512
ReadX 8292 2562 512 512
ReadX 8292 2610 512 512
ReadX 8292 3586 512 512
ReadX 8292 3812 512 512
ReadX 8292 3828 512 512
ReadX 8292 4046 512 512
ReadX 8292 4066 512 512
ReadX 8292 1747 512 512
ReadX 8292 1026 512 512
ReadX 8292 1538 512 512
ReadX 8292 514 512 512
ReadX 8292 751 512 512
ReadX 8292 1263 512 512
ReadX 8292 620 512 512
ReadX 8292 1132 512 512
ReadX 8292 1644 512 512
ReadX 8292 2156 512 512
ReadX 8292 2668 512 512
ReadX 8292 3180 512 512
ReadX 8292 3692 512 512
ReadX 8292 4204 394 394
ReadX 8292 606 118 118
ReadX 8292 724 512 512
ReadX 8292 1236 512 512
ReadX 8292 1748 512 512
ReadX 8292 2260 512 512
ReadX 8292 2772 512 512
ReadX 8292 3284 512 512
ReadX 8292 3796 394 394
ReadX 8292 636 118 118
ReadX 8292 754 512 512
ReadX 8292 1266 512 512
ReadX 8292 1778 512 512
ReadX 8292 2290 512 512
ReadX 8292 2802 512 512
ReadX 8292 3314 512 512
ReadX 8292 3826 512 512
ReadX 8292 4338 512 512
ReadX 8292 4850 512 512
ReadX 8292 5362 512 512
ReadX 8292 5874 512 512
ReadX 8292 6386 512 512
ReadX 8292 6898 512 512
ReadX 8292 7410 512 512
ReadX 8292 7922 512 512
ReadX 8292 8434 512 512
ReadX 8292 8946 512 512
ReadX 8292 9458 512 512
ReadX 8292 9970 512 512
ReadX 8292 10482 512 512
ReadX 8292 723 512 512
ReadX 8292 1235 512 512
ReadX 8292 725 512 512
ReadX 8292 729 512 512
ReadX 8292 1241 512 512
ReadX 8292 1753 512 512
ReadX 8292 2265 512 512
ReadX 8292 2777 512 512
ReadX 8292 3289 512 512
ReadX 8292 3801 512 512
ReadX 8292 4313 512 512
ReadX 8292 4825 512 512
ReadX 8292 5337 512 512
ReadX 8292 5849 512 512
ReadX 8292 6361 512 512
ReadX 8292 755 512 512
ReadX 8292 1267 512 512
ReadX 8292 1779 512 512
ReadX 8292 2291 512 512
ReadX 8292 2803 512 512
ReadX 8292 3315 512 512
ReadX 8292 3827 512 512
ReadX 8292 4339 244 244
ReadX 8292 4583 512 512
ReadX 8292 5095 268 268
ReadX 8292 5363 512 512
ReadX 8292 5875 512 512
ReadX 8292 6387 512 512
ReadX 8292 6899 512 512
ReadX 8292 7411 512 512
ReadX 8292 7923 512 512
ReadX 8292 8435 512 512
ReadX 8292 8947 512 512
ReadX 8292 9459 512 512
ReadX 8292 9971 512 512
ReadX 8292 10483 512 512
ReadX 8292 10995 512 512
ReadX 8292 11507 512 512
ReadX 8292 12019 512 512
ReadX 8292 12531 512 512
ReadX 8292 13043 512 512
ReadX 8292 13555 512 512
ReadX 8292 14067 512 512
ReadX 8292 14579 512 512
ReadX 8292 15091 512 512
ReadX 8292 15603 342 342
ReadX 8292 725 512 512
ReadX 8292 2000 512 512
ReadX 8292 3918 512 512
ReadX 8292 727 512 512
ReadX 8292 258 512 512
ReadX 8292 376 512 512
ReadX 8292 1109 512 512
ReadX 8292 1028 512 512
ReadX 8292 1540 512 512
ReadX 8292 2052 512 512
ReadX 8292 2564 512 512
ReadX 8292 3076 512 512
ReadX 8292 3588 512 512
ReadX 8292 4100 512 512
ReadX 8292 4612 412 412
ReadX 8292 1012 100 100
ReadX 8292 1112 512 512
ReadX 8292 1624 512 512
ReadX 8292 2136 512 512
ReadX 8292 2648 512 512
ReadX 8292 3160 512 512
ReadX 8292 3672 512 512
ReadX 8292 4184 412 412
ReadX 8292 1044 100 100
ReadX 8292 1144 512 512
ReadX 8292 1656 512 512
ReadX 8292 2168 512 512
ReadX 8292 2680 512 512
ReadX 8292 3192 512 512
ReadX 8292 3704 512 512
ReadX 8292 4216 512 512
ReadX 8292 4728 512 512
ReadX 8292 5240 512 512
ReadX 8292 5752 512 512
ReadX 8292 6264 512 512
ReadX 8292 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 8292 7288 512 512
ReadX 8292 7800 512 512
ReadX 8292 8312 512 512
ReadX 8292 8824 512 512
ReadX 8292 9336 512 512
ReadX 8292 9848 512 512
ReadX 8292 10360 512 512
ReadX 8292 10872 512 512
ReadX 8292 11384 512 512
ReadX 8292 11896 512 512
ReadX 8292 12408 512 512
ReadX 8292 1088 512 512
ReadX 8292 1600 512 512
ReadX 8292 1090 512 512
ReadX 8292 1094 512 512
ReadX 8292 1606 512 512
ReadX 8292 2118 512 512
ReadX 8292 2630 512 512
ReadX 8292 3142 512 512
ReadX 8292 3654 512 512
ReadX 8292 4166 512 512
ReadX 8292 4678 512 512
ReadX 8292 1111 512 512
ReadX 8292 1623 512 512
ReadX 8292 2135 512 512
ReadX 8292 2647 512 512
ReadX 8292 3159 512 512
ReadX 8292 3671 512 512
ReadX 8292 4183 512 512
ReadX 8292 4695 512 512
ReadX 8292 5207 512 512
ReadX 8292 5719 512 512
ReadX 8292 6231 512 512
ReadX 8292 6743 512 512
ReadX 8292 7255 512 512
ReadX 8292 7767 512 512
ReadX 8292 8279 512 512
ReadX 8292 8791 512 512
ReadX 8292 9303 512 512
ReadX 8292 9815 512 512
ReadX 8292 10327 512 512
ReadX 8292 10839 512 512
ReadX 8292 11351 294 294
ReadX 8292 1091 512 512
ReadX 8292 970 512 512
ReadX 8292 1093 512 512
ReadX 8292 1434 512 512
ReadX 8292 2050 512 512
ReadX 8292 2158 512 512
ReadX 8292 2118 512 512
ReadX 8292 2630 512 512
ReadX 8292 3142 512 512
ReadX 8292 3654 512 512
ReadX 8292 4166 512 512
ReadX 8292 4678 512 512
ReadX 8292 5190 512 512
ReadX 8292 5702 382 382
ReadX 8292 2104 130 130
ReadX 8292 2234 512 512
ReadX 8292 2746 512 512
ReadX 8292 3258 512 512
ReadX 8292 3770 512 512
ReadX 8292 4282 512 512
ReadX 8292 4794 512 512
ReadX 8292 5306 382 382
ReadX 8292 2134 130 130
ReadX 8292 2264 512 512
ReadX 8292 2776 512 512
ReadX 8292 3288 512 512
ReadX 8292 3800 512 512
ReadX 8292 4312 512 512
ReadX 8292 4824 512 512
ReadX 8292 5336 512 512
ReadX 8292 2147 512 512
ReadX 8292 2149 512 512
ReadX 8292 2152 512 512
ReadX 8292 2664 512 512
ReadX 8292 3176 512 512
ReadX 8292 3688 512 512
ReadX 8292 2159 512 512
ReadX 8292 2671 512 512
ReadX 8292 3183 512 512
ReadX 8292 3695 512 512
ReadX 8292 4207 512 512
ReadX 8292 4719 512 512
ReadX 8292 5231 512 512
ReadX 8292 5743 512 512
ReadX 8292 6255 512 512
ReadX 8292 6767 512 512
ReadX 8292 7279 512 512
ReadX 8292 7791 512 512
ReadX 8292 8303 512 512
ReadX 8292 8815 512 512
ReadX 8292 9327 512 512
ReadX 8292 9839 512 512
ReadX 8292 10351 512 512
ReadX 8292 10863 512 512
ReadX 8292 11375 512 512
ReadX 8292 11887 512 512
ReadX 8292 12399 38 38
ReadX 8292 2149 512 512
ReadX 8292 1794 512 512
ReadX 8292 2016 512 512
ReadX 8292 2151 512 512
ReadX 8292 1918 512 512
ReadX 8292 1880 512 512
ReadX 8292 2392 512 512
ReadX 8292 2904 512 512
ReadX 8292 3416 512 512
ReadX 8292 3928 512 512
ReadX 8292 4440 512 512
ReadX 8292 4952 512 512
ReadX 8292 5464 416 416
ReadX 8292 1866 96 96
ReadX 8292 1962 512 512
ReadX 8292 2474 512 512
ReadX 8292 2986 512 512
ReadX 8292 3498 512 512
ReadX 8292 4010 512 512
ReadX 8292 4522 512 512
ReadX 8292 5034 416 416
ReadX 8292 1896 96 96
ReadX 8292 1992 512 512
ReadX 8292 2504 512 512
ReadX 8292 3016 512 512
ReadX 8292 3528 512 512
ReadX 8292 1903 512 512
ReadX 8292 1905 512 512
ReadX 8292 1908 512 512
ReadX 8292 2420 512 512
ReadX 8292 2932 512 512
ReadX 8292 3444 512 512
ReadX 8292 3956 512 512
ReadX 8292 1919 512 512
ReadX 8292 2431 512 512
ReadX 8292 2943 512 512
ReadX 8292 3455 512 512
ReadX 8292 3967 512 512
ReadX 8292 4479 512 512
ReadX 8292 4991 512 512
ReadX 8292 5503 512 512
ReadX 8292 6015 512 512
ReadX 8292 6527 512 512
ReadX 8292 7039 512 512
ReadX 8292 7551 512 512
ReadX 8292 8063 512 512
ReadX 8292 8575 512 512
ReadX 8292 9087 512 512
ReadX 8292 9599 512 512
ReadX 8292 10111 512 512
ReadX 8292 10623 512 512
ReadX 8292 11135 512 512
ReadX 8292 11647 512 512
ReadX 8292 12159 322 322
ReadX 8292 1905 512 512
ReadX 8292 1846 512 512
ReadX 8292 1907 512 512
ReadX 8292 1860 268 268
ReadX 8292 1832 244 244
ReadX 8292 1846 512 512
ReadX 8292 2358 512 512
ReadX 8292 2870 512 512
ReadX 8292 3382 512 512
ReadX 8292 3894 512 512
ReadX 8292 4406 512 512
ReadX 8292 4918 512 512
ReadX 8292 1858 512 512
ReadX 8292 1859 512 512
ReadX 8292 1860 488 488
ReadX 8292 1832 24 24
ReadX 8292 1861 228 228
ReadX 8292 1832 284 284
ReadX 8292 2116 512 512
ReadX 8292 2628 512 512
ReadX 8292 3140 512 512
ReadX 8292 3652 512 512
ReadX 8292 4164 512 512
ReadX 8292 4676 512 512
ReadX 8292 5188 228 228
ReadX 8292 1862 284 284
ReadX 8292 2146 512 512
ReadX 8292 2658 38 38
ReadX 8292 1859 512 512
ReadX 8292 2047 512 512
ReadX 8292 2016 512 512
ReadX 8292 2528 512 512
ReadX 8292 3040 512 512
ReadX 8292 3552 512 512
ReadX 8292 4064 512 512
ReadX 8292 4576 512 512
ReadX 8292 5088 512 512
ReadX 8292 5600 424 424
ReadX 8292 2002 88 88
ReadX 8292 2090 512 512
ReadX 8292 2602 512 512
ReadX 8292 3114 512 512
ReadX 8292 3626 512 512
ReadX 8292 4138 512 512
ReadX 8292 4650 512 512
ReadX 8292 5162 424 424
ReadX 8292 2032 88 88
ReadX 8292 2120 512 512
ReadX 8292 2632 512 512
ReadX 8292 3144 512 512
ReadX 8292 3656 512 512
ReadX 8292 4168 512 512
ReadX 8292 4680 512 512
ReadX 8292 5192 512 512
ReadX 8292 2044 512 512
ReadX 8292 2045 512 512
ReadX 8292 2046 512 512
ReadX 8292 2047 512 512
ReadX 8292 2559 110 110
ReadX 8292 2052 402 402
ReadX 8292 2454 512 512
ReadX 8292 2966 512 512
ReadX 8292 3478 512 512
ReadX 8292 3990 512 512
ReadX 8292 4502 512 512
ReadX 8292 5014 512 512
ReadX 8292 5526 512 512
ReadX 8292 6038 512 512
ReadX 8292 6550 512 512
ReadX 8292 7062 512 512
ReadX 8292 7574 512 512
ReadX 8292 8086 512 512
ReadX 8292 8598 512 512
ReadX 8292 9110 512 512
ReadX 8292 9622 512 512
ReadX 8292 10134 512 512
ReadX 8292 10646 512 512
ReadX 8292 11158 512 512
ReadX 8292 11670 512 512
ReadX 8292 12182 512 512
ReadX 8292 12694 118 118
ReadX 8292 2045 512 512
ReadX 8292 1282 512 512
ReadX 8292 1343 512 512
ReadX 8292 1286 512 512
ReadX 8292 1798 512 512
ReadX 8292 2310 512 512
ReadX 8292 2822 512 512
ReadX 8292 3334 512 512
ReadX 8292 3846 512 512
ReadX 8292 4358 512 512
ReadX 8292 4870 416 416
ReadX 8292 1270 96 96
ReadX 8292 1366 512 512
ReadX 8292 1878 512 512
ReadX 8292 2390 512 512
ReadX 8292 2902 512 512
ReadX 8292 3414 512 512
ReadX 8292 3926 416 416
ReadX 8292 1284 96 96
ReadX 8292 1380 416 416
ReadX 8292 1302 96 96
ReadX 8292 1398 512 512
ReadX 8292 1910 512 512
ReadX 8292 2422 512 512
ReadX 8292 2934 512 512
ReadX 8292 3446 512 512
ReadX 8292 3958 512 512
ReadX 8292 4470 512 512
ReadX 8292 4982 512 512
ReadX 8292 5494 512 512
ReadX 8292 6006 512 512
ReadX 8292 6518 512 512
ReadX 8292 7030 512 512
ReadX 8292 7542 512 512
ReadX 8292 1328 512 512
ReadX 8292 1330 512 512
ReadX 8292 1333 512 512
ReadX 8292 1845 512 512
ReadX 8292 2357 512 512
ReadX 8292 2869 512 512
ReadX 8292 3381 512 512
ReadX 8292 1344 512 512
ReadX 8292 1856 512 512
ReadX 8292 2368 512 512
ReadX 8292 2880 512 512
ReadX 8292 3392 512 512
ReadX 8292 3904 512 512
ReadX 8292 4416 512 512
ReadX 8292 4928 512 512
ReadX 8292 5440 512 512
ReadX 8292 5952 512 512
ReadX 8292 6464 512 512
ReadX 8292 6976 512 512
ReadX 8292 7488 512 512
ReadX 8292 8000 512 512
ReadX 8292 8512 512 512
ReadX 8292 9024 512 512
ReadX 8292 9536 512 512
ReadX 8292 10048 512 512
ReadX 8292 10560 512 512
ReadX 8292 11072 512 512
ReadX 8292 11584 426 426
ReadX 8292 1330 512 512
ReadX 8292 1842 512 512
ReadX 8292 1250 512 512
ReadX 8292 1264 268 268
ReadX 8292 1236 244 244
ReadX 8292 1250 512 512
ReadX 8292 1762 512 512
ReadX 8292 2274 512 512
ReadX 8292 2786 512 512
ReadX 8292 3298 512 512
ReadX 8292 3810 512 512
ReadX 8292 4322 512 512
ReadX 8292 1262 512 512
ReadX 8292 1263 512 512
ReadX 8292 1264 488 488
ReadX 8292 1236 24 24
ReadX 8292 1265 228 228
ReadX 8292 1236 284 284
ReadX 8292 1520 512 512
ReadX 8292 2032 512 512
ReadX 8292 2544 512 512
ReadX 8292 3056 512 512
ReadX 8292 3568 512 512
ReadX 8292 4080 512 512
ReadX 8292 4592 228 228
ReadX 8292 1266 284 284
ReadX 8292 1550 512 512
ReadX 8292 2062 42 42
ReadX 8292 1263 512 512
ReadX 8292 1538 512 512
ReadX 8292 1640 512 512
ReadX 8292 1510 512 512
ReadX 8292 2022 512 512
ReadX 8292 2534 512 512
ReadX 8292 3046 512 512
ReadX 8292 3558 512 512
ReadX 8292 4070 512 512
ReadX 8292 4582 512 512
ReadX 8292 5094 408 408
ReadX 8292 1496 104 104
ReadX 8292 1600 512 512
ReadX 8292 2112 512 512
ReadX 8292 2624 512 512
ReadX 8292 3136 512 512
ReadX 8292 3648 512 512
ReadX 8292 4160 512 512
ReadX 8292 4672 408 408
ReadX 8292 1526 104 104
ReadX 8292 1630 512 512
ReadX 8292 2142 512 512
ReadX 8292 2654 512 512
ReadX 8292 3166 512 512
ReadX 8292 3678 512 512
ReadX 8292 4190 408 408
ReadX 8292 1540 104 104
ReadX 8292 1644 512 512
ReadX 8292 2156 512 512
ReadX 8292 2668 512 512
ReadX 8292 3180 512 512
ReadX 8292 3692 512 512
ReadX 8292 4204 512 512
ReadX 8292 4716 512 512
ReadX 8292 5228 512 512
ReadX 8292 5740 512 512
ReadX 8292 6252 512 512
ReadX 8292 6764 512 512
ReadX 8292 7276 512 512
ReadX 8292 7788 512 512
ReadX 8292 8300 512 512
ReadX 8292 8812 512 512
ReadX 8292 9324 512 512
ReadX 8292 9836 512 512
ReadX 8292 10348 512 512
ReadX 8292 10860 512 512
ReadX 8292 11372 512 512
ReadX 8292 1615 512 512
ReadX 8292 2127 512 512
ReadX 8292 1617 512 512
ReadX 8292 1621 512 512
ReadX 8292 2133 512 512
ReadX 8292 2645 512 512
ReadX 8292 3157 512 512
ReadX 8292 3669 512 512
ReadX 8292 4181 512 512
ReadX 8292 4693 512 512
ReadX 8292 5205 512 512
ReadX 8292 5717 512 512
ReadX 8292 6229 512 512
ReadX 8292 1641 512 512
ReadX 8292 2153 512 512
ReadX 8292 2665 512 512
ReadX 8292 3177 512 512
ReadX 8292 3689 512 512
ReadX 8292 4201 512 512
ReadX 8292 4713 512 512
ReadX 8292 5225 512 512
ReadX 8292 5737 512 512
ReadX 8292 6249 512 512
ReadX 8292 6761 512 512
ReadX 8292 7273 512 512
ReadX 8292 7785 512 512
ReadX 8292 8297 512 512
ReadX 8292 8809 512 512
ReadX 8292 9321 512 512
ReadX 8292 9833 512 512
ReadX 8292 10345 512 512
ReadX 8292 10857 512 512
ReadX 8292 11369 512 512
ReadX 8292 11881 2 2
ReadX 8292 1796 510 510
ReadX 8292 2306 512 512
ReadX 8292 2818 512 512
ReadX 8292 3330 512 512
ReadX 8292 3842 512 512
ReadX 8292 4354 512 512
ReadX 8292 4866 512 512
ReadX 8292 5378 512 512
ReadX 8292 5890 512 512
ReadX 8292 6402 512 512
ReadX 8292 6914 512 512
ReadX 8292 7426 512 512
ReadX 8292 7938 512 512
ReadX 8292 8450 512 512
ReadX 8292 8962 512 512
ReadX 8292 9474 512 512
ReadX 8292 9986 512 512
ReadX 8292 10498 326 326
ReadX 8292 1617 512 512
ReadX 8292 2129 512 512
ReadX 8292 1450 512 512
ReadX 8292 1621 512 512
ReadX 8292 1446 512 512
ReadX 8292 1450 512 512
ReadX 8292 1962 512 512
ReadX 8292 2474 512 512
ReadX 8292 2986 512 512
ReadX 8292 3498 512 512
ReadX 8292 4010 512 512
ReadX 8292 4522 512 512
ReadX 8292 5034 424 424
ReadX 8292 1436 88 88
ReadX 8292 1524 512 512
ReadX 8292 2036 512 512
ReadX 8292 2548 512 512
ReadX 8292 3060 512 512
ReadX 8292 1442 512 512
ReadX 8292 1443 512 512
ReadX 8292 1444 512 512
ReadX 8292 1446 512 512
ReadX 8292 1958 386 386
ReadX 8292 1466 126 126
ReadX 8292 1592 512 512
ReadX 8292 2104 512 512
ReadX 8292 2616 512 512
ReadX 8292 3128 512 512
ReadX 8292 3640 512 512
ReadX 8292 4152 512 512
ReadX 8292 4664 512 512
ReadX 8292 5176 512 512
ReadX 8292 5688 512 512
ReadX 8292 6200 512 512
ReadX 8292 6712 512 512
ReadX 8292 7224 512 512
ReadX 8292 7736 512 512
ReadX 8292 8248 512 512
ReadX 8292 8760 294 294
ReadX 8292 1443 512 512
ReadX 8292 964 512 512
ReadX 8292 970 512 512
ReadX 8292 1482 512 512
ReadX 8292 1994 512 512
ReadX 8292 2506 512 512
ReadX 8292 3018 512 512
ReadX 8292 3530 512 512
ReadX 8292 4042 512 512
ReadX 8292 4554 424 424
ReadX 8292 956 88 88
ReadX 8292 1044 512 512
ReadX 8292 1556 512 512
ReadX 8292 2068 512 512
ReadX 8292 2580 512 512
ReadX 8292 962 512 512
ReadX 8292 963 512 512
ReadX 8292 964 512 512
ReadX 8292 965 512 512
ReadX 8292 1477 512 512
ReadX 8292 1989 228 228
ReadX 8292 986 284 284
ReadX 8292 1270 512 512
ReadX 8292 1782 512 512
ReadX 8292 2294 512 512
ReadX 8292 2806 512 512
ReadX 8292 3318 512 512
ReadX 8292 3830 512 512
ReadX 8292 4342 512 512
ReadX 8292 4854 512 512
ReadX 8292 5366 512 512
ReadX 8292 5878 512 512
ReadX 8292 6390 512 512
ReadX 8292 6902 512 512
ReadX 8292 7414 42 42
ReadX 8292 963 512 512
ReadX 8292 2610 512 512
ReadX 8292 3812 512 512
ReadX 8292 3828 512 512
ReadX 8292 3969 512 512
ReadX 8292 3918 512 512
ReadX 8292 4430 512 512
ReadX 8292 4942 512 512
ReadX 8292 5454 512 512
ReadX 8292 5966 512 512
ReadX 8292 6478 512 512
ReadX 8292 6990 512 512
ReadX 8292 7502 424 424
ReadX 8292 3904 88 88
ReadX 8292 3992 512 512
ReadX 8292 4504 512 512
ReadX 8292 5016 512 512
ReadX 8292 5528 512 512
ReadX 8292 6040 512 512
ReadX 8292 6552 512 512
ReadX 8292 7064 424 424
ReadX 8292 3934 88 88
ReadX 8292 4022 512 512
ReadX 8292 4534 512 512
ReadX 8292 5046 512 512
ReadX 8292 5558 512 512
ReadX 8292 6070 512 512
ReadX 8292 6582 512 512
ReadX 8292 7094 512 512
ReadX 8292 7606 512 512
ReadX 8292 8118 512 512
ReadX 8292 8630 512 512
ReadX 8292 3953 512 512
ReadX 8292 4465 512 512
ReadX 8292 3956 512 512
ReadX 8292 3964 512 512
ReadX 8292 4476 512 512
ReadX 8292 4988 512 512
ReadX 8292 3970 512 512
ReadX 8292 4482 512 512
ReadX 8292 4994 512 512
ReadX 8292 5506 512 512
ReadX 8292 6018 512 512
ReadX 8292 6530 512 512
ReadX 8292 7042 512 512
ReadX 8292 7554 512 512
ReadX 8292 8066 512 512
ReadX 8292 8578 512 512
ReadX 8292 9090 512 512
ReadX 8292 9602 512 512
ReadX 8292 10114 512 512
ReadX 8292 10626 512 512
ReadX 8292 11138 512 512
ReadX 8292 11650 512 512
ReadX 8292 12162 512 512
ReadX 8292 12674 512 512
ReadX 8292 13186 512 512
ReadX 8292 13698 512 512
ReadX 8292 14210 134 134
ReadX 8292 3956 512 512
ReadX 8292 4468 512 512
ReadX 8292 4980 512 512
ReadX 8292 5492 512 512
ReadX 8292 3074 512 512
ReadX 8292 3246 512 512
ReadX 8292 3964 512 512
ReadX 8292 3330 512 512
ReadX 8292 3465 512 512
ReadX 8292 3246 512 512
ReadX 8292 3758 512 512
ReadX 8292 4270 512 512
ReadX 8292 4782 512 512
ReadX 8292 5294 512 512
ReadX 8292 5806 512 512
ReadX 8292 6318 512 512
ReadX 8292 6830 368 368
ReadX 8292 3232 144 144
ReadX 8292 3376 512 512
ReadX 8292 3888 512 512
ReadX 8292 4400 512 512
ReadX 8292 4912 512 512
ReadX 8292 5424 512 512
ReadX 8292 5936 512 512
ReadX 8292 6448 368 368
ReadX 8292 3262 144 144
ReadX 8292 3406 512 512
ReadX 8292 3918 512 512
ReadX 8292 4430 512 512
ReadX 8292 4942 512 512
ReadX 8292 5454 512 512
ReadX 8292 5966 512 512
ReadX 8292 6478 512 512
ReadX 8292 6990 512 512
ReadX 8292 7502 512 512
ReadX 8292 8014 512 512
ReadX 8292 8526 512 512
ReadX 8292 9038 512 512
ReadX 8292 9550 512 512
ReadX 8292 10062 512 512
ReadX 8292 10574 512 512
ReadX 8292 11086 512 512
ReadX 8292 11598 512 512
ReadX 8292 12110 512 512
ReadX 8292 12622 512 512
ReadX 8292 13134 512 512
ReadX 8292 13646 368 368
ReadX 8292 3332 144 144
ReadX 8292 3476 512 512
ReadX 8292 3988 512 512
ReadX 8292 4500 512 512
ReadX 8292 5012 512 512
ReadX 8292 5524 512 512
ReadX 8292 6036 512 512
ReadX 8292 6548 512 512
ReadX 8292 7060 512 512
ReadX 8292 7572 512 512
ReadX 8292 8084 512 512
ReadX 8292 8596 512 512
ReadX 8292 9108 512 512
ReadX 8292 9620 512 512
ReadX 8292 10132 512 512
ReadX 8292 10644 512 512
ReadX 8292 11156 512 512
ReadX 8292 11668 512 512
ReadX 8292 12180 512 512
ReadX 8292 12692 512 512
ReadX 8292 13204 512 512
ReadX 8292 3430 512 512
ReadX 8292 3942 512 512
ReadX 8292 3434 512 512
ReadX 8292 3435 512 512
ReadX 8292 3947 512 512
ReadX 8292 4459 512 512
ReadX 8292 4971 512 512
ReadX 8292 5483 512 512
ReadX 8292 5995 512 512
ReadX 8292 6507 512 512
ReadX 8292 7019 512 512
ReadX 8292 7531 512 512
ReadX 8292 8043 512 512
ReadX 8292 8555 512 512
ReadX 8292 9067 512 512
ReadX 8292 9579 512 512
ReadX 8292 10091 512 512
ReadX 8292 10603 512 512
ReadX 8292 11115 512 512
ReadX 8292 3467 512 512
ReadX 8292 3979 512 512
ReadX 8292 4491 512 512
ReadX 8292 5003 512 512
ReadX 8292 5515 512 512
ReadX 8292 6027 512 512
ReadX 8292 6539 512 512
ReadX 8292 7051 512 512
ReadX 8292 7563 512 512
ReadX 8292 8075 512 512
ReadX 8292 8587 512 512
ReadX 8292 9099 512 512
ReadX 8292 9611 512 512
ReadX 8292 10123 512 512
ReadX 8292 10635 512 512
ReadX 8292 11147 512 512
ReadX 8292 11659 512 512
ReadX 8292 12171 512 512
ReadX 8292 12683 512 512
ReadX 8292 13195 512 512
ReadX 8292 13707 56 56
ReadX 8292 13763 512 512
ReadX 8292 14275 456 456
ReadX 8292 14731 512 512
ReadX 8292 15243 512 512
ReadX 8292 15755 512 512
ReadX 8292 16267 512 512
ReadX 8292 16779 512 512
ReadX 8292 17291 512 512
ReadX 8292 17803 512 512
ReadX 8292 18315 512 512
ReadX 8292 18827 512 512
ReadX 8292 19339 512 512
ReadX 8292 19851 512 512
ReadX 8292 20363 512 512
ReadX 8292 20875 512 512
ReadX 8292 21387 512 512
ReadX 8292 21899 512 512
ReadX 8292 22411 512 512
ReadX 8292 22923 512 512
ReadX 8292 23435 512 512
ReadX 8292 23947 512 512
ReadX 8292 24459 512 512
ReadX 8292 24971 282 282
ReadX 8292 3434 512 512
ReadX 8292 2818 512 512
ReadX 8292 2870 512 512
ReadX 8292 3026 512 512
ReadX 8292 3538 512 512
ReadX 8292 2870 512 512
ReadX 8292 3382 512 512
ReadX 8292 3894 512 512
ReadX 8292 4406 512 512
ReadX 8292 4918 512 512
ReadX 8292 5430 512 512
ReadX 8292 5942 512 512
ReadX 8292 6454 374 374
ReadX 8292 2856 138 138
ReadX 8292 2994 512 512
ReadX 8292 3506 512 512
ReadX 8292 4018 512 512
ReadX 8292 4530 512 512
ReadX 8292 5042 512 512
ReadX 8292 5554 512 512
ReadX 8292 6066 374 374
ReadX 8292 2886 138 138
ReadX 8292 3024 512 512
ReadX 8292 3536 512 512
ReadX 8292 4048 512 512
ReadX 8292 4560 512 512
ReadX 8292 5072 512 512
ReadX 8292 5584 512 512
ReadX 8292 6096 512 512
ReadX 8292 6608 512 512
ReadX 8292 7120 512 512
ReadX 8292 7632 512 512
ReadX 8292 8144 512 512
ReadX 8292 8656 512 512
ReadX 8292 9168 512 512
ReadX 8292 9680 512 512
ReadX 8292 10192 512 512
ReadX 8292 10704 512 512
ReadX 8292 11216 512 512
ReadX 8292 11728 512 512
ReadX 8292 12240 512 512
ReadX 8292 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 8292 13264 512 512
ReadX 8292 13776 512 512
ReadX 8292 14288 512 512
ReadX 8292 14800 512 512
ReadX 8292 15312 512 512
ReadX 8292 15824 512 512
ReadX 8292 16336 512 512
ReadX 8292 16848 512 512
ReadX 8292 17360 512 512
ReadX 8292 17872 512 512
ReadX 8292 18384 512 512
ReadX 8292 18896 512 512
ReadX 8292 19408 512 512
ReadX 8292 19920 512 512
ReadX 8292 20432 512 512
ReadX 8292 20944 512 512
ReadX 8292 21456 512 512
ReadX 8292 21968 512 512
ReadX 8292 22480 512 512
ReadX 8292 22992 512 512
ReadX 8292 2998 512 512
ReadX 8292 3510 512 512
ReadX 8292 3001 512 512
ReadX 8292 3003 512 512
ReadX 8292 3515 512 512
ReadX 8292 4027 512 512
ReadX 8292 4539 512 512
ReadX 8292 5051 512 512
ReadX 8292 5563 512 512
ReadX 8292 6075 512 512
ReadX 8292 6587 512 512
ReadX 8292 7099 512 512
ReadX 8292 7611 512 512
ReadX 8292 8123 512 512
ReadX 8292 8635 512 512
ReadX 8292 3029 512 512
ReadX 8292 3541 512 512
ReadX 8292 4053 512 512
ReadX 8292 4565 512 512
ReadX 8292 5077 512 512
ReadX 8292 5589 512 512
ReadX 8292 6101 512 512
ReadX 8292 6613 512 512
ReadX 8292 7125 512 512
ReadX 8292 7637 512 512
ReadX 8292 8149 512 512
ReadX 8292 8661 512 512
ReadX 8292 9173 512 512
ReadX 8292 9685 512 512
ReadX 8292 10197 512 512
ReadX 8292 10709 512 512
ReadX 8292 11221 512 512
ReadX 8292 11733 512 512
ReadX 8292 12245 512 512
ReadX 8292 12757 512 512
ReadX 8292 13269 40 40
ReadX 8292 3076 472 472
ReadX 8292 3548 512 512
ReadX 8292 4060 512 512
ReadX 8292 4572 512 512
ReadX 8292 5084 512 512
ReadX 8292 5596 512 512
ReadX 8292 6108 512 512
ReadX 8292 6620 512 512
ReadX 8292 7132 512 512
ReadX 8292 7644 512 512
ReadX 8292 8156 512 512
ReadX 8292 8668 512 512
ReadX 8292 9180 512 512
ReadX 8292 9692 512 512
ReadX 8292 10204 512 512
ReadX 8292 10716 512 512
ReadX 8292 11228 512 512
ReadX 8292 11740 512 512
ReadX 8292 12252 512 512
ReadX 8292 12764 512 512
ReadX 8292 13276 310 310
ReadX 8292 3001 512 512
ReadX 8292 2562 512 512
ReadX 8292 2626 512 512
ReadX 8292 3003 512 512
ReadX 8292 2721 512 512
ReadX 8292 2626 512 512
ReadX 8292 3138 512 512
ReadX 8292 3650 512 512
ReadX 8292 4162 512 512
ReadX 8292 4674 512 512
ReadX 8292 5186 512 512
ReadX 8292 5698 512 512
ReadX 8292 6210 424 424
ReadX 8292 2612 88 88
ReadX 8292 2700 512 512
ReadX 8292 3212 512 512
ReadX 8292 3724 512 512
ReadX 8292 4236 512 512
ReadX 8292 4748 512 512
ReadX 8292 5260 512 512
ReadX 8292 5772 424 424
ReadX 8292 2642 88 88
ReadX 8292 2730 512 512
ReadX 8292 3242 512 512
ReadX 8292 3754 512 512
ReadX 8292 4266 512 512
ReadX 8292 4778 512 512
ReadX 8292 5290 512 512
ReadX 8292 5802 512 512
ReadX 8292 6314 512 512
ReadX 8292 6826 512 512
ReadX 8292 7338 512 512
ReadX 8292 7850 512 512
ReadX 8292 8362 512 512
ReadX 8292 8874 512 512
ReadX 8292 9386 512 512
ReadX 8292 9898 512 512
ReadX 8292 10410 512 512
ReadX 8292 10922 512 512
ReadX 8292 11434 512 512
ReadX 8292 11946 512 512
ReadX 8292 12458 512 512
ReadX 8292 2716 512 512
ReadX 8292 2717 512 512
ReadX 8292 2718 512 512
ReadX 8292 3230 512 512
ReadX 8292 2721 512 512
ReadX 8292 3233 512 512
ReadX 8292 3745 512 512
ReadX 8292 4257 512 512
ReadX 8292 4769 512 512
ReadX 8292 5281 512 512
ReadX 8292 5793 512 512
ReadX 8292 6305 512 512
ReadX 8292 6817 512 512
ReadX 8292 7329 512 512
ReadX 8292 7841 512 512
ReadX 8292 8353 512 512
ReadX 8292 8865 512 512
ReadX 8292 9377 512 512
ReadX 8292 9889 512 512
ReadX 8292 10401 512 512
ReadX 8292 10913 512 512
ReadX 8292 11425 512 512
ReadX 8292 11937 512 512
ReadX 8292 12449 512 512
ReadX 8292 12961 512 512
ReadX 8292 13473 512 512
ReadX 8292 13985 106 106
ReadX 8292 2820 406 406
ReadX 8292 3226 512 512
ReadX 8292 3738 512 512
ReadX 8292 4250 512 512
ReadX 8292 4762 512 512
ReadX 8292 5274 512 512
ReadX 8292 5786 512 512
ReadX 8292 6298 512 512
ReadX 8292 6810 512 512
ReadX 8292 7322 512 512
ReadX 8292 7834 512 512
ReadX 8292 8346 512 512
ReadX 8292 8858 512 512
ReadX 8292 9370 512 512
ReadX 8292 9882 512 512
ReadX 8292 10394 512 512
ReadX 8292 10906 512 512
ReadX 8292 11418 182 182
ReadX 8292 2717 512 512
ReadX 8292 258 512 512
ReadX 8292 470 512 512
ReadX 8292 376 512 512
ReadX 8292 888 512 512
ReadX 8292 1400 512 512
ReadX 8292 1912 512 512
ReadX 8292 2424 512 512
ReadX 8292 2936 512 512
ReadX 8292 3448 512 512
ReadX 8292 3960 424 424
ReadX 8292 362 88 88
ReadX 8292 450 512 512
ReadX 8292 962 512 512
ReadX 8292 1474 512 512
ReadX 8292 1986 512 512
ReadX 8292 2498 512 512
ReadX 8292 3010 512 512
ReadX 8292 3522 424 424
ReadX 8292 392 88 88
ReadX 8292 480 512 512
ReadX 8292 992 512 512
ReadX 8292 1504 512 512
ReadX 8292 2016 512 512
ReadX 8292 2528 512 512
ReadX 8292 3040 512 512
ReadX 8292 3552 512 512
ReadX 8292 4064 512 512
ReadX 8292 4576 512 512
ReadX 8292 5088 512 512
ReadX 8292 5600 512 512
ReadX 8292 6112 512 512
ReadX 8292 6624 512 512
ReadX 8292 7136 512 512
ReadX 8292 7648 512 512
ReadX 8292 8160 512 512
ReadX 8292 8672 512 512
ReadX 8292 9184 512 512
ReadX 8292 9696 512 512
ReadX 8292 10208 512 512
ReadX 8292 464 512 512
ReadX 8292 465 512 512
ReadX 8292 466 512 512
ReadX 8292 978 512 512
ReadX 8292 470 512 512
ReadX 8292 982 512 512
ReadX 8292 1494 512 512
ReadX 8292 2006 512 512
ReadX 8292 2518 512 512
ReadX 8292 3030 512 512
ReadX 8292 3542 512 512
ReadX 8292 4054 512 512
ReadX 8292 4566 512 512
ReadX 8292 5078 512 512
ReadX 8292 5590 512 512
ReadX 8292 6102 512 512
ReadX 8292 6614 512 512
ReadX 8292 7126 512 512
ReadX 8292 7638 512 512
ReadX 8292 8150 512 512
ReadX 8292 8662 512 512
ReadX 8292 9174 512 512
ReadX 8292 9686 512 512
ReadX 8292 10198 512 512
ReadX 8292 10710 333 333
ReadX 8292 11043 512 512
ReadX 8292 11555 179 179
ReadX 8292 11734 512 512
ReadX 8292 12246 512 512
ReadX 8292 12758 512 512
ReadX 8292 13270 512 512
ReadX 8292 13782 512 512
ReadX 8292 14294 512 512
ReadX 8292 14806 512 512
ReadX 8292 15318 512 512
ReadX 8292 15830 512 512
ReadX 8292 16342 512 512
ReadX 8292 16854 512 512
ReadX 8292 17366 512 512
ReadX 8292 17878 512 512
ReadX 8292 18390 512 512
ReadX 8292 18902 512 512
ReadX 8292 19414 512 512
ReadX 8292 19926 512 512
ReadX 8292 20438 512 512
ReadX 8292 20950 512 512
ReadX 8292 21462 512 512
ReadX 8292 21974 350 350
ReadX 8292 465 512 512
ReadX 8292 3812 512 512
ReadX 8292 4046 512 512
ReadX 8292 3828 512 512
ReadX 8292 256 512 512
ReadX 8292 260 512 512
ReadX 8292 4066 512 512
ReadX 8292 4578 512 512
ReadX 8292 5090 512 512
ReadX 8292 5602 512 512
ReadX 8292 6114 512 512
ReadX 8292 6626 512 512
ReadX 8292 7138 512 512
ReadX 8292 7650 394 394
ReadX 8292 4052 118 118
ReadX 8292 4170 512 512
ReadX 8292 4682 512 512
ReadX 8292 5194 512 512
ReadX 8292 5706 512 512
ReadX 8292 6218 512 512
ReadX 8292 6730 512 512
ReadX 8292 7242 394 394
ReadX 8292 4082 118 118
ReadX 8292 4200 512 512
ReadX 8292 4712 512 512
ReadX 8292 5224 512 512
ReadX 8292 5736 512 512
ReadX 8292 6248 512 512
ReadX 8292 6760 512 512
ReadX 8292 7272 512 512
ReadX 8292 7784 394 394
ReadX 8292 256 118 118
ReadX 8292 374 512 512
ReadX 8292 886 512 512
ReadX 8292 1398 512 512
ReadX 8292 1910 512 512
ReadX 8292 2422 512 512
ReadX 8292 2934 512 512
ReadX 8292 3446 512 512
ReadX 8292 3958 512 512
ReadX 8292 4470 512 512
ReadX 8292 4982 512 512
ReadX 8292 5494 512 512
ReadX 8292 6006 512 512
ReadX 8292 6518 512 512
ReadX 8292 7030 512 512
ReadX 8292 7542 512 512
ReadX 8292 8054 512 512
ReadX 8292 8566 512 512
ReadX 8292 9078 512 512
ReadX 8292 9590 512 512
ReadX 8292 10102 512 512
ReadX 8292 259 512 512
ReadX 8292 771 512 512
ReadX 8292 259 512 512
ReadX 8292 259 512 512
ReadX 8292 771 512 512
ReadX 8292 1283 512 512
ReadX 8292 1795 512 512
ReadX 8292 2307 512 512
ReadX 8292 2819 512 512
ReadX 8292 3331 512 512
ReadX 8292 3843 512 512
ReadX 8292 4355 512 512
ReadX 8292 4867 512 512
ReadX 8292 260 512 512
ReadX 8292 772 512 512
ReadX 8292 1284 512 512
ReadX 8292 1796 512 512
ReadX 8292 2308 512 512
ReadX 8292 2820 512 512
ReadX 8292 3332 512 512
ReadX 8292 3844 512 512
ReadX 8292 4356 512 512
ReadX 8292 4868 512 512
ReadX 8292 5380 512 512
ReadX 8292 5892 512 512
ReadX 8292 6404 512 512
ReadX 8292 6916 512 512
ReadX 8292 7428 512 512
ReadX 8292 7940 512 512
ReadX 8292 8452 512 512
ReadX 8292 8964 512 512
ReadX 8292 9476 512 512
ReadX 8292 9988 512 512
ReadX 8292 10500 378 378
ReadX 8292 10878 512 512
ReadX 8292 11390 134 134
ReadX 8292 11524 512 512
ReadX 8292 12036 512 512
ReadX 8292 12548 512 512
ReadX 8292 13060 512 512
ReadX 8292 13572 138 138
ReadX 8292 259 512 512
ReadX 8292 273 512 512
ReadX 8292 276 512 512
ReadX 8292 295 512 512
ReadX 8292 288 512 512
ReadX 8292 296 512 512
ReadX 8292 259 512 512
ReadX 8292 273 512 512
ReadX 8292 273 512 512
ReadX 8292 785 512 512
ReadX 8292 1297 512 512
ReadX 8292 1809 512 512
ReadX 8292 2321 512 512
ReadX 8292 274 512 512
ReadX 8292 274 512 512
ReadX 8292 274 497 497
ReadX 8292 272 15 15
ReadX 8292 287 512 512
ReadX 8292 799 512 512
ReadX 8292 273 512 512
ReadX 8292 785 512 512
ReadX 8292 1297 512 512
ReadX 8292 1809 512 512
ReadX 8292 2321 512 512
ReadX 8292 2833 317 317
ReadX 8292 274 195 195
ReadX 8292 469 512 512
ReadX 8292 981 512 512
ReadX 8292 1493 512 512
ReadX 8292 2005 512 512
ReadX 8292 2517 512 512
ReadX 8292 3029 512 512
ReadX 8292 3541 512 512
ReadX 8292 4053 512 512
ReadX 8292 4565 250 250
ReadX 8292 274 512 512
ReadX 8292 283 512 512
ReadX 8292 795 512 512
ReadX 8292 276 512 512
ReadX 8292 788 512 512
ReadX 8292 1300 512 512
ReadX 8292 1812 512 512
ReadX 8292 2324 512 512
ReadX 8292 2836 512 512
ReadX 8292 3348 512 512
ReadX 8292 3860 420 420
ReadX 8292 275 92 92
ReadX 8292 367 512 512
ReadX 8292 879 512 512
ReadX 8292 1391 512 512
ReadX 8292 1903 512 512
ReadX 8292 2415 512 512
ReadX 8292 2927 512 512
ReadX 8292 3439 420 420
ReadX 8292 277 92 92
ReadX 8292 369 512 512
ReadX 8292 881 512 512
ReadX 8292 1393 512 512
ReadX 8292 1905 512 512
ReadX 8292 2417 512 512
ReadX 8292 2929 512 512
ReadX 8292 3441 512 512
ReadX 8292 3953 512 512
ReadX 8292 4465 512 512
ReadX 8292 4977 512 512
ReadX 8292 5489 512 512
ReadX 8292 6001 512 512
ReadX 8292 6513 512 512
ReadX 8292 7025 512 512
ReadX 8292 7537 512 512
ReadX 8292 8049 512 512
ReadX 8292 8561 512 512
ReadX 8292 9073 512 512
ReadX 8292 9585 512 512
ReadX 8292 10097 512 512
ReadX 8292 282 512 512
ReadX 8292 794 512 512
ReadX 8292 1306 512 512
ReadX 8292 1818 512 512
ReadX 8292 2330 512 512
ReadX 8292 2842 512 512
ReadX 8292 3354 512 512
ReadX 8292 3866 512 512
ReadX 8292 4378 512 512
ReadX 8292 284 512 512
ReadX 8292 796 512 512
ReadX 8292 1308 512 512
ReadX 8292 1820 512 512
ReadX 8292 2332 512 512
ReadX 8292 2844 512 512
ReadX 8292 3356 512 512
ReadX 8292 3868 512 512
ReadX 8292 4380 512 512
ReadX 8292 4892 512 512
ReadX 8292 5404 512 512
ReadX 8292 5916 512 512
ReadX 8292 6428 512 512
ReadX 8292 6940 512 512
ReadX 8292 7452 512 512
ReadX 8292 7964 512 512
ReadX 8292 8476 512 512
ReadX 8292 8988 512 512
ReadX 8292 9500 512 512
ReadX 8292 10012 512 512
ReadX 8292 10524 472 472
ReadX 8292 288 40 40
ReadX 8292 328 512 512
ReadX 8292 840 512 512
ReadX 8292 1352 512 512
ReadX 8292 1864 512 512
ReadX 8292 2376 512 512
ReadX 8292 2888 512 512
ReadX 8292 3400 512 512
ReadX 8292 3912 512 512
ReadX 8292 4424 512 512
ReadX 8292 4936 512 512
ReadX 8292 5448 512 512
ReadX 8292 5960 512 512
ReadX 8292 6472 512 512
ReadX 8292 6984 512 512
ReadX 8292 7496 512 512
ReadX 8292 8008 512 512
ReadX 8292 8520 512 512
ReadX 8292 9032 512 512
ReadX 8292 9544 512 512
ReadX 8292 10056 512 512
ReadX 8292 10568 506 506
ReadX 8292 282 512 512
ReadX 8292 794 512 512
ReadX 8292 301 512 512
ReadX 8292 296 512 512
ReadX 8292 808 512 512
ReadX 8292 1320 512 512
ReadX 8292 1832 512 512
ReadX 8292 2344 512 512
ReadX 8292 2856 512 512
ReadX 8292 3368 512 512
ReadX 8292 3880 424 424
ReadX 8292 295 88 88
ReadX 8292 383 512 512
ReadX 8292 895 512 512
ReadX 8292 1407 512 512
ReadX 8292 1919 512 512
ReadX 8292 2431 512 512
ReadX 8292 2943 512 512
ReadX 8292 3455 424 424
ReadX 8292 297 88 88
ReadX 8292 385 512 512
ReadX 8292 897 512 512
ReadX 8292 1409 512 512
ReadX 8292 1921 512 512
ReadX 8292 2433 512 512
ReadX 8292 2945 512 512
ReadX 8292 3457 512 512
ReadX 8292 3969 512 512
ReadX 8292 4481 512 512
ReadX 8292 4993 512 512
ReadX 8292 5505 512 512
ReadX 8292 6017 512 512
ReadX 8292 6529 512 512
ReadX 8292 7041 512 512
ReadX 8292 7553 512 512
ReadX 8292 8065 512 512
ReadX 8292 8577 512 512
ReadX 8292 9089 512 512
ReadX 8292 9601 512 512
ReadX 8292 10113 512 512
ReadX 8292 301 512 512
ReadX 8292 301 512 512
ReadX 8292 301 512 512
ReadX 8292 813 512 512
ReadX 8292 301 512 512
ReadX 8292 813 512 512
ReadX 8292 1325 512 512
ReadX 8292 1837 512 512
ReadX 8292 2349 512 512
ReadX 8292 2861 512 512
ReadX 8292 3373 512 512
ReadX 8292 3885 512 512
ReadX 8292 4397 512 512
ReadX 8292 4909 512 512
ReadX 8292 5421 512 512
ReadX 8292 5933 512 512
ReadX 8292 6445 512 512
ReadX 8292 6957 512 512
ReadX 8292 7469 512 512
ReadX 8292 7981 512 512
ReadX 8292 8493 512 512
ReadX 8292 9005 512 512
ReadX 8292 9517 463 463
ReadX 8292 9980 512 512
ReadX 8292 10492 49 49
ReadX 8292 10541 512 512
ReadX 8292 11053 512 512
ReadX 8292 11565 512 512
ReadX 8292 12077 512 512
ReadX 8292 12589 512 512
ReadX 8292 13101 512 512
ReadX 8292 13613 512 512
ReadX 8292 14125 512 512
ReadX 8292 14637 512 512
ReadX 8292 15149 512 512
ReadX 8292 15661 512 512
ReadX 8292 16173 512 512
ReadX 8292 16685 512 512
ReadX 8292 17197 512 512
ReadX 8292 17709 512 512
ReadX 8292 18221 512 512
ReadX 8292 18733 512 512
ReadX 8292 19245 512 512
ReadX 8292 19757 512 512
ReadX 8292 20269 512 512
ReadX 8292 20781 326 326
ReadX 8292 301 512 512
QUERY_FS_INFORMATION 259
Close 8290
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8293
Close 8293
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8294
ReadX 8294 0 24 24
Close 8294
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8295
QUERY_FILE_INFORMATION 8295
ReadX 8295 0 512 512
ReadX 8295 476 512 512
ReadX 8295 510 512 512
ReadX 8295 484 512 512
ReadX 8295 474 512 512
ReadX 8295 478 512 512
ReadX 8295 990 512 512
ReadX 8295 509 57 57
Close 8295
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8296
QUERY_FILE_INFORMATION 8296
ReadX 8296 0 512 512
ReadX 8296 476 512 512
ReadX 8296 510 512 512
ReadX 8296 484 512 512
ReadX 8296 480 512 512
ReadX 8296 474 512 512
ReadX 8296 478 512 512
QUERY_FILE_INFORMATION 8296
WriteX 8296 494 60 60
WriteX 8296 494 4 4
QUERY_FILE_INFORMATION 8296
WriteX 8296 494 11 11
WriteX 8296 510 512 512
WriteX 8296 484 512 512
WriteX 8296 474 512 512
WriteX 8296 478 512 512
WriteX 8296 990 512 512
Close 8296
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 8297
Close 8297
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 8298
Close 8298
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 8300
WriteX 8300 4607 1 1
QUERY_FILE_INFORMATION 8300
WriteX 8300 0 65471 65471
WriteX 8300 65471 65 65
WriteX 8300 65536 19490 19490
Close 8300
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8301
QUERY_FILE_INFORMATION 8301
ReadX 8301 0 512 512
ReadX 8301 482 512 512
ReadX 8301 994 512 512
ReadX 8301 1506 512 512
ReadX 8301 480 512 512
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 490 448 448
QUERY_FILE_INFORMATION 8301
WriteX 8301 490 60 60
WriteX 8301 490 4 4
QUERY_FILE_INFORMATION 8301
WriteX 8301 490 11 11
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 484 512 512
WriteX 8301 996 512 512
WriteX 8301 1508 512 512
WriteX 8301 482 512 512
WriteX 8301 0 512 512
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
ReadX 8301 490 512 512
WriteX 8301 502 512 512
WriteX 8301 502 292 292
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 503 20 20
WriteX 8301 503 108 108
QUERY_FILE_INFORMATION 8301
WriteX 8301 504 448 448
QUERY_FILE_INFORMATION 8301
WriteX 8301 504 44 44
WriteX 8301 504 20 20
WriteX 8301 500 512 512
WriteX 8301 492 512 512
WriteX 8301 496 512 512
WriteX 8301 1008 512 512
WriteX 8301 494 512 512
Flush 8301
WriteX 8301 0 512 512
Flush 8301
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 500 512 512
WriteX 8301 492 512 512
WriteX 8301 496 512 512
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 518 320 320
QUERY_FILE_INFORMATION 8301
WriteX 8301 518 60 60
ReadX 8301 504 512 512
WriteX 8301 522 512 512
WriteX 8301 506 3204 3204
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 519 25 25
WriteX 8301 518 103 103
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 519 44 44
WriteX 8301 519 20 20
WriteX 8301 520 512 512
WriteX 8301 482 512 512
WriteX 8301 486 512 512
WriteX 8301 998 512 512
WriteX 8301 484 512 512
WriteX 8301 490 512 512
Flush 8301
WriteX 8301 0 512 512
Flush 8301
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
QUERY_FILE_INFORMATION 8301
WriteX 8301 519 7 7
WriteX 8301 519 57 57
WriteX 8301 520 512 512
WriteX 8301 492 512 512
WriteX 8301 482 512 512
WriteX 8301 486 512 512
WriteX 8301 998 512 512
Flush 8301
WriteX 8301 520 512 512
Flush 8301
Close 8301
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8302
Close 8302
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 8303
QUERY_FILE_INFORMATION 8303
ReadX 8303 0 512 512
ReadX 8303 490 512 512
ReadX 8303 484 512 512
ReadX 8303 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 8304
Close 8304
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 8303
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 8305
Close 8305
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 8306
ReadX 8306 0 24 24
Close 8306
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 8307
QUERY_FILE_INFORMATION 8307
ReadX 8307 0 512 512
ReadX 8307 366 512 512
ReadX 8307 878 512 512
ReadX 8307 1390 512 512
ReadX 8307 1902 512 512
ReadX 8307 374 57 57
Close 8307
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 8308
QUERY_FILE_INFORMATION 8308
ReadX 8308 0 512 512
ReadX 8308 366 512 512
ReadX 8308 878 512 512
ReadX 8308 1390 512 512
ReadX 8308 1902 512 512
QUERY_FILE_INFORMATION 8308
WriteX 8308 374 60 60
WriteX 8308 374 4 4
QUERY_FILE_INFORMATION 8308
WriteX 8308 374 11 11
ReadX 8308 374 57 57
ReadX 8308 374 57 57
ReadX 8308 292 4096 4096
ReadX 8308 364 512 512
ReadX 8308 512 4096 4096
ReadX 8308 4608 4096 4096
ReadX 8308 8704 4096 4096
ReadX 8308 12800 4096 4096
ReadX 8308 16896 4096 4096
ReadX 8308 20992 4096 4096
ReadX 8308 25088 4096 4096
ReadX 8308 29184 4096 4096
ReadX 8308 33280 4096 4096
ReadX 8308 37376 4096 4096
ReadX 8308 41472 4096 4096
ReadX 8308 45568 4096 4096
ReadX 8308 49664 4096 4096
ReadX 8308 53760 4096 4096
ReadX 8308 57856 4096 4096
ReadX 8308 61952 4096 4096
ReadX 8308 66048 4096 4096
ReadX 8308 70144 4096 4096
ReadX 8308 74240 162 162
ReadX 8308 308 4096 4096
ReadX 8308 4404 4096 4096
WriteX 8308 368 512 512
WriteX 8308 880 512 512
WriteX 8308 1392 512 512
Close 8308
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 8309
Close 8309
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 8310
QUERY_FILE_INFORMATION 8310
ReadX 8310 0 512 512
ReadX 8310 366 512 512
ReadX 8310 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 8311
Close 8311
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 8310
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 8313
WriteX 8313 4607 1 1
QUERY_FILE_INFORMATION 8313
WriteX 8313 0 65471 65471
WriteX 8313 65471 65 65
WriteX 8313 65536 8866 8866
Close 8313
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8314
QUERY_FILE_INFORMATION 8314
ReadX 8314 0 512 512
ReadX 8314 366 512 512
ReadX 8314 878 512 512
ReadX 8314 1390 512 512
ReadX 8314 364 512 512
QUERY_FILE_INFORMATION 8314
QUERY_FILE_INFORMATION 8314
QUERY_FILE_INFORMATION 8314
WriteX 8314 374 448 448
QUERY_FILE_INFORMATION 8314
WriteX 8314 374 60 60
WriteX 8314 374 4 4
QUERY_FILE_INFORMATION 8314
WriteX 8314 374 11 11
QUERY_FILE_INFORMATION 8314
QUERY_FILE_INFORMATION 8314
WriteX 8314 374 7 7
WriteX 8314 374 57 57
WriteX 8314 368 512 512
WriteX 8314 880 512 512
WriteX 8314 1392 512 512
WriteX 8314 366 512 512
WriteX 8314 0 512 512
Flush 8314
WriteX 8314 368 512 512
Flush 8314
Close 8314
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8315
QUERY_FILE_INFORMATION 8315
ReadX 8315 0 512 512
ReadX 8315 366 512 512
ReadX 8315 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 8315
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8316
Close 8316
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8317
ReadX 8317 0 24 24
Close 8317
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8318
QUERY_FILE_INFORMATION 8318
ReadX 8318 0 512 512
ReadX 8318 366 512 512
ReadX 8318 878 512 512
ReadX 8318 1390 512 512
ReadX 8318 1902 512 512
ReadX 8318 374 57 57
Close 8318
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8319
QUERY_FILE_INFORMATION 8319
ReadX 8319 0 512 512
ReadX 8319 366 512 512
ReadX 8319 878 512 512
ReadX 8319 1390 512 512
ReadX 8319 1902 512 512
QUERY_FILE_INFORMATION 8319
WriteX 8319 374 60 60
WriteX 8319 374 4 4
QUERY_FILE_INFORMATION 8319
WriteX 8319 374 11 11
WriteX 8319 368 512 512
WriteX 8319 880 512 512
WriteX 8319 1392 512 512
Close 8319
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 8320
Close 8320
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 8321
Close 8321
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 8323
WriteX 8323 4607 1 1
QUERY_FILE_INFORMATION 8323
WriteX 8323 0 65471 65471
WriteX 8323 65471 65 65
WriteX 8323 65536 9298 9298
Close 8323
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8324
QUERY_FILE_INFORMATION 8324
ReadX 8324 0 512 512
ReadX 8324 368 512 512
ReadX 8324 880 512 512
ReadX 8324 1392 512 512
ReadX 8324 366 512 512
QUERY_FILE_INFORMATION 8324
QUERY_FILE_INFORMATION 8324
QUERY_FILE_INFORMATION 8324
WriteX 8324 376 448 448
QUERY_FILE_INFORMATION 8324
WriteX 8324 376 60 60
WriteX 8324 376 4 4
QUERY_FILE_INFORMATION 8324
WriteX 8324 376 11 11
QUERY_FILE_INFORMATION 8324
QUERY_FILE_INFORMATION 8324
WriteX 8324 376 7 7
WriteX 8324 376 57 57
WriteX 8324 370 512 512
WriteX 8324 882 512 512
WriteX 8324 1394 512 512
WriteX 8324 368 512 512
WriteX 8324 0 512 512
Flush 8324
WriteX 8324 370 512 512
Flush 8324
Close 8324
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8325
Close 8325
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8326
QUERY_FILE_INFORMATION 8326
ReadX 8326 0 512 512
ReadX 8326 368 512 512
ReadX 8326 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 8327
Close 8327
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 8329
Close 8329
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 8330
ReadX 8330 0 24 24
Close 8330
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 8331
QUERY_FILE_INFORMATION 8331
ReadX 8331 0 512 512
ReadX 8331 512 512 512
ReadX 8331 1024 512 512
ReadX 8331 2016 512 512
ReadX 8331 1056 512 512
ReadX 8331 1096 57 57
Close 8331
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 8332
QUERY_FILE_INFORMATION 8332
ReadX 8332 0 512 512
ReadX 8332 512 512 512
ReadX 8332 1024 512 512
ReadX 8332 2016 512 512
ReadX 8332 1056 512 512
ReadX 8332 1096 57 57
ReadX 8332 1096 57 57
ReadX 8332 1088 62 62
ReadX 8332 1536 4096 4096
ReadX 8332 5632 4096 4096
ReadX 8332 9728 4096 4096
ReadX 8332 13824 2859 2859
ReadX 8332 1120 28 28
ReadX 8332 1148 20 20
ReadX 8332 1168 8 8
ReadX 8332 1176 88 88
ReadX 8332 1264 8 8
ReadX 8332 1272 4 4
ReadX 8332 1276 4 4
ReadX 8332 1280 1 1
ReadX 8332 1130 4 4
ReadX 8332 1134 4 4
ReadX 8332 1138 1 1
ReadX 8332 1131 4 4
ReadX 8332 1135 4 4
ReadX 8332 1139 1 1
ReadX 8332 1131 4 4
ReadX 8332 1135 4 4
ReadX 8332 1139 2 2
ReadX 8332 1132 4 4
ReadX 8332 1136 4 4
ReadX 8332 1140 25 25
ReadX 8332 1134 4 4
ReadX 8332 1138 8 8
ReadX 8332 1146 4 4
ReadX 8332 1150 8 8
ReadX 8332 1158 4 4
ReadX 8332 1162 8 8
ReadX 8332 1170 4 4
ReadX 8332 1174 4 4
ReadX 8332 1178 4 4
ReadX 8332 1182 4 4
ReadX 8332 1186 4 4
ReadX 8332 1190 4 4
ReadX 8332 1194 13900 13900
ReadX 8332 2048 4096 4096
Close 8332
QUERY_FS_INFORMATION 259
Close 8326
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8333
Close 8333
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8334
ReadX 8334 0 24 24
Close 8334
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8335
QUERY_FILE_INFORMATION 8335
ReadX 8335 0 512 512
ReadX 8335 368 512 512
ReadX 8335 880 512 512
ReadX 8335 1392 512 512
ReadX 8335 1904 512 512
ReadX 8335 376 57 57
Close 8335
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8336
QUERY_FILE_INFORMATION 8336
ReadX 8336 0 512 512
ReadX 8336 368 512 512
ReadX 8336 880 512 512
ReadX 8336 1392 512 512
ReadX 8336 1904 512 512
QUERY_FILE_INFORMATION 8336
WriteX 8336 376 60 60
WriteX 8336 376 4 4
QUERY_FILE_INFORMATION 8336
WriteX 8336 376 11 11
WriteX 8336 370 512 512
WriteX 8336 882 512 512
WriteX 8336 1394 512 512
Close 8336
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 8337
Close 8337
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 8338
Close 8338
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 8340
WriteX 8340 4607 1 1
QUERY_FILE_INFORMATION 8340
WriteX 8340 0 65471 65471
WriteX 8340 65471 65 65
WriteX 8340 65536 11540 11540
Close 8340
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8341
QUERY_FILE_INFORMATION 8341
ReadX 8341 0 512 512
ReadX 8341 398 512 512
ReadX 8341 910 512 512
ReadX 8341 1422 512 512
ReadX 8341 396 512 512
QUERY_FILE_INFORMATION 8341
QUERY_FILE_INFORMATION 8341
QUERY_FILE_INFORMATION 8341
WriteX 8341 406 448 448
QUERY_FILE_INFORMATION 8341
WriteX 8341 406 60 60
WriteX 8341 406 4 4
QUERY_FILE_INFORMATION 8341
WriteX 8341 406 11 11
QUERY_FILE_INFORMATION 8341
QUERY_FILE_INFORMATION 8341
WriteX 8341 406 7 7
WriteX 8341 406 57 57
WriteX 8341 400 512 512
WriteX 8341 912 512 512
WriteX 8341 1424 512 512
WriteX 8341 398 512 512
WriteX 8341 0 512 512
Flush 8341
WriteX 8341 400 512 512
Flush 8341
Close 8341
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8342
Close 8342
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 8343
QUERY_FILE_INFORMATION 8343
ReadX 8343 0 512 512
ReadX 8343 398 512 512
ReadX 8343 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 8344
Close 8344
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 8343
ReadX 8292 1434 512 512
Close 8292
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 8345
WriteX 8345 0 65471 65471
WriteX 8345 65471 63 63
WriteX 8345 65534 65471 65471
WriteX 8345 131005 63 63
Close 8345
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 8346
WriteX 8346 0 65471 65471
WriteX 8346 65471 63 63
WriteX 8346 65534 65471 65471
WriteX 8346 131005 63 63
WriteX 8346 131068 65471 65471
WriteX 8346 196539 63 63
WriteX 8346 196602 65471 65471
WriteX 8346 262073 63 63
Close 8346
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 8347
WriteX 8347 0 65471 65471
WriteX 8347 65471 63 63
WriteX 8347 65534 65471 65471
WriteX 8347 131005 63 63
WriteX 8347 131068 65471 65471
WriteX 8347 196539 63 63
WriteX 8347 196602 65471 65471
WriteX 8347 262073 63 63
WriteX 8347 262136 65471 65471
WriteX 8347 327607 63 63
WriteX 8347 327670 65471 65471
WriteX 8347 393141 63 63
WriteX 8347 393204 65471 65471
WriteX 8347 458675 63 63
WriteX 8347 458738 65471 65471
WriteX 8347 524209 63 63
Close 8347
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8348
Close 8348
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 8349
ReadX 8349 0 512 512
ReadX 8349 512 511 511
ReadX 8349 1023 512 512
ReadX 8349 1535 512 512
Close 8349
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 8350
ReadX 8350 0 512 512
ReadX 8350 512 510 510
ReadX 8350 1022 512 512
ReadX 8350 1534 510 510
ReadX 8350 2044 510 510
Close 8350
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 8351
ReadX 8351 0 512 512
ReadX 8351 512 512 512
ReadX 8351 1024 512 512
ReadX 8351 1536 512 512
ReadX 8351 2048 512 512
ReadX 8351 2560 512 512
ReadX 8351 3072 512 512
ReadX 8351 3584 512 512
ReadX 8351 4096 512 512
ReadX 8351 4608 512 512
ReadX 8351 5120 512 512
ReadX 8351 5632 512 512
ReadX 8351 6144 512 512
ReadX 8351 6656 512 512
ReadX 8351 7168 512 512
ReadX 8351 7680 512 512
ReadX 8351 8192 512 512
ReadX 8351 8704 512 512
Close 8351
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8352
Close 8352
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 8353
QUERY_FILE_INFORMATION 8353
Close 8353
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 8354
ReadX 8354 0 8192 8192
Close 8354
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 8355
Close 8355
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 8356
QUERY_FILE_INFORMATION 8356
Close 8356
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 8357
ReadX 8357 0 8192 8192
Close 8357
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8358
Close 8358
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 8359
QUERY_FILE_INFORMATION 8359
Close 8359
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 8360
ReadX 8360 0 8192 8192
Close 8360
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 8361
ReadX 8361 0 8192 8192
ReadX 8361 8192 8192 8192
ReadX 8361 16384 8192 8192
ReadX 8361 24576 8192 8192
Close 8361
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 8363
Close 8363
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 8365
WriteX 8365 8191 1 1
QUERY_FILE_INFORMATION 8365
WriteX 8365 0 10438 10438
Close 8365
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 8366
Close 8366
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 8367
QUERY_FILE_INFORMATION 8367
QUERY_FILE_INFORMATION 8367
Close 8367
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 8368
QUERY_FILE_INFORMATION 8368
QUERY_FILE_INFORMATION 8368
Close 8368
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 8369
Close 8369
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 8370
QUERY_FILE_INFORMATION 8370
QUERY_FILE_INFORMATION 8370
Close 8370
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 8371
QUERY_FILE_INFORMATION 8371
QUERY_FILE_INFORMATION 8371
Close 8371
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 8372
Close 8372
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 8373
QUERY_FILE_INFORMATION 8373
QUERY_FILE_INFORMATION 8373
Close 8373
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 8374
QUERY_FILE_INFORMATION 8374
QUERY_FILE_INFORMATION 8374
Close 8374
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 8375
Close 8375
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 8376
QUERY_FILE_INFORMATION 8376
QUERY_FILE_INFORMATION 8376
Close 8376
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 8377
ReadX 8377 0 8 8
ReadX 8377 8 4 4
ReadX 8377 12 8 8
ReadX 8377 22 8 8
ReadX 8377 520 8 8
ReadX 8377 525 8 8
ReadX 8377 533 4 4
ReadX 8377 543 8 8
ReadX 8377 551 4 4
ReadX 8377 1058 8 8
ReadX 8377 1066 4 4
ReadX 8377 1081 8 8
ReadX 8377 1089 4 4
ReadX 8377 660 8 8
Close 8377
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 8378
ReadX 8378 0 8192 8192
Close 8378
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 8379
ReadX 8379 0 8192 8192
ReadX 8379 520 8192 8192
ReadX 8379 8712 8192 8192
ReadX 8379 16904 8192 8192
ReadX 8379 25096 8192 8192
ReadX 8379 33288 8192 8192
ReadX 8379 41480 8192 8192
ReadX 8379 49672 8192 8192
ReadX 8379 57864 8192 8192
ReadX 8379 66056 8192 8192
ReadX 8379 74248 8192 8192
ReadX 8379 82440 8192 8192
ReadX 8379 90632 8192 8192
ReadX 8379 98824 8192 8192
ReadX 8379 107016 8192 8192
ReadX 8379 115208 8192 8192
ReadX 8379 123400 8192 8192
ReadX 8379 131592 8192 8192
ReadX 8379 139784 8192 8192
ReadX 8379 147976 8192 8192
ReadX 8379 156168 8192 8192
Close 8379
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 8380
QUERY_FILE_INFORMATION 8380
Close 8380
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 8381
Close 8381
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 8383
WriteX 8383 8191 1 1
QUERY_FILE_INFORMATION 8383
WriteX 8383 0 28489 28489
Close 8383
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 8384
Close 8384
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 8385
Close 8385
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 8386
QUERY_FILE_INFORMATION 8386
Close 8386
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 8387
ReadX 8387 0 8192 8192
Close 8387
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8388
Close 8388
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 8389
QUERY_FILE_INFORMATION 8389
Close 8389
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 8390
ReadX 8390 0 8192 8192
Close 8390
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 8391
ReadX 8391 0 8192 8192
ReadX 8391 8192 8192 8192
ReadX 8391 16384 8192 8192
ReadX 8391 24576 8192 8192
ReadX 8391 32768 16384 16384
ReadX 8391 49152 8192 8192
ReadX 8391 57344 8192 8192
ReadX 8391 65536 8192 8192
Close 8391
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 8393
Close 8393
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 8395
WriteX 8395 8191 1 1
QUERY_FILE_INFORMATION 8395
WriteX 8395 0 29253 29253
Close 8395
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 8396
Close 8396
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 8397
QUERY_FILE_INFORMATION 8397
QUERY_FILE_INFORMATION 8397
Close 8397
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 8398
QUERY_FILE_INFORMATION 8398
QUERY_FILE_INFORMATION 8398
Close 8398
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 8399
QUERY_FILE_INFORMATION 8399
Close 8399
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 8400
Close 8400
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 8402
WriteX 8402 8191 1 1
QUERY_FILE_INFORMATION 8402
WriteX 8402 0 30183 30183
Close 8402
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 8403
Close 8403
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 8404
WriteX 8404 0 510 510
WriteX 8404 510 512 512
WriteX 8404 1022 510 510
WriteX 8404 1532 510 510
WriteX 8404 2042 168 168
Close 8404
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8405
Close 8405
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 8406
WriteX 8406 0 511 511
WriteX 8406 511 512 512
WriteX 8406 1023 512 512
WriteX 8406 1535 488 488
Close 8406
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 8407
ReadX 8407 0 65471 65471
ReadX 8407 65471 63 63
ReadX 8407 65534 65471 65471
ReadX 8407 131005 63 63
ReadX 8407 131068 65471 65471
ReadX 8407 196539 63 63
ReadX 8407 196602 65471 65471
ReadX 8407 262073 63 63
ReadX 8407 262136 65471 65471
ReadX 8407 327607 63 63
ReadX 8407 327670 10 10
Close 8407
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 8408
ReadX 8408 0 65471 65471
ReadX 8408 65471 63 63
ReadX 8408 65534 65471 65471
ReadX 8408 131005 63 63
ReadX 8408 131068 65471 65471
ReadX 8408 196539 63 63
ReadX 8408 196602 65471 65471
ReadX 8408 262073 63 63
ReadX 8408 262136 65471 65471
ReadX 8408 327607 63 63
ReadX 8408 327670 65471 65471
ReadX 8408 393141 63 63
ReadX 8408 393204 65471 65471
ReadX 8408 458675 63 63
ReadX 8408 458738 65471 65471
ReadX 8408 524209 63 63
ReadX 8408 524272 65471 65471
ReadX 8408 589743 63 63
ReadX 8408 589806 65471 65471
ReadX 8408 655277 63 63
ReadX 8408 655340 32 32
Close 8408
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 8409
ReadX 8409 0 65471 65471
ReadX 8409 65471 63 63
ReadX 8409 65534 65471 65471
ReadX 8409 131005 63 63
ReadX 8409 131068 65471 65471
ReadX 8409 196539 63 63
ReadX 8409 196602 65471 65471
ReadX 8409 262073 63 63
ReadX 8409 262136 65471 65471
ReadX 8409 327607 63 63
ReadX 8409 327670 65471 65471
ReadX 8409 393141 63 63
ReadX 8409 393204 65471 65471
ReadX 8409 458675 63 63
ReadX 8409 458738 65471 65471
ReadX 8409 524209 63 63
ReadX 8409 524272 65471 65471
ReadX 8409 589743 63 63
ReadX 8409 589806 65471 65471
ReadX 8409 655277 63 63
ReadX 8409 655340 65471 65471
ReadX 8409 720811 63 63
ReadX 8409 720874 65471 65471
ReadX 8409 786345 63 63
ReadX 8409 786408 65471 65471
ReadX 8409 851879 63 63
ReadX 8409 851942 65471 65471
ReadX 8409 917413 63 63
ReadX 8409 917476 65471 65471
ReadX 8409 982947 63 63
ReadX 8409 983010 65471 65471
ReadX 8409 1048481 63 63
ReadX 8409 1048544 65471 65471
ReadX 8409 1114015 63 63
ReadX 8409 1114078 65471 65471
ReadX 8409 1179549 63 63
ReadX 8409 1179612 65471 65471
ReadX 8409 1245083 63 63
ReadX 8409 1245146 65471 65471
ReadX 8409 1310617 63 63
ReadX 8409 1310680 65471 65471
ReadX 8409 1376151 63 63
ReadX 8409 1376214 65471 65471
ReadX 8409 1441685 63 63
ReadX 8409 1441748 65471 65471
ReadX 8409 1507219 63 63
ReadX 8409 1507282 65471 65471
ReadX 8409 1572753 63 63
ReadX 8409 1572816 65471 65471
ReadX 8409 1638287 63 63
ReadX 8409 1638350 65471 65471
ReadX 8409 1703821 63 63
ReadX 8409 1703884 65471 65471
ReadX 8409 1769355 63 63
ReadX 8409 1769418 65471 65471
ReadX 8409 1834889 63 63
ReadX 8409 1834952 32824 32824
Close 8409
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 8410
QUERY_FILE_INFORMATION 8410
ReadX 8410 0 512 512
ReadX 8410 512 512 512
ReadX 8410 1024 512 512
QUERY_FILE_INFORMATION 8410
QUERY_FILE_INFORMATION 8410
ReadX 8410 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 8410
QUERY_FILE_INFORMATION 8410
ReadX 8410 512 4096 4096
QUERY_FILE_INFORMATION 8410
QUERY_FILE_INFORMATION 8410
QUERY_FILE_INFORMATION 8410
WriteX 8410 512 4096 4096
WriteX 8410 1024 512 512
ReadX 8410 502 512 512
QUERY_FILE_INFORMATION 8410
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8410 2560 512 512
ReadX 8410 1536 512 512
ReadX 8410 2176 384 384
ReadX 8410 3072 128 128
ReadX 8410 3107 512 512
ReadX 8410 3619 512 512
ReadX 8410 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8410 286 123 123
ReadX 8410 292 24 24
ReadX 8410 512 2048 2048
ReadX 8410 512 2048 2048
ReadX 8410 2560 2048 2048
ReadX 8410 416 1536 1536
ReadX 8410 768 512 512
ReadX 8410 1280 2048 2048
ReadX 8410 3328 2048 2048
ReadX 8410 5376 2048 2048
ReadX 8410 7424 2048 2048
ReadX 8410 9472 2048 2048
ReadX 8410 11520 2048 2048
ReadX 8410 13568 2048 2048
ReadX 8410 15616 2048 2048
ReadX 8410 17664 2048 2048
ReadX 8410 19712 2048 2048
ReadX 8410 21760 2048 2048
ReadX 8410 23808 2048 2048
ReadX 8410 25856 2048 2048
ReadX 8410 27904 2048 2048
ReadX 8410 29952 2048 2048
ReadX 8410 32000 2048 2048
ReadX 8410 34048 2048 2048
ReadX 8410 36096 2048 2048
ReadX 8410 38144 2048 2048
ReadX 8410 40192 2048 2048
ReadX 8410 42240 512 512
ReadX 8410 42752 2048 2048
ReadX 8410 44800 2048 2048
ReadX 8410 46848 2048 2048
ReadX 8410 48896 2048 2048
ReadX 8410 50944 2048 2048
ReadX 8410 52992 2048 2048
ReadX 8410 55040 2048 2048
ReadX 8410 57088 2048 2048
ReadX 8410 316 2048 2048
ReadX 8410 2364 2048 2048
ReadX 8410 4412 2048 2048
ReadX 8410 6460 2048 2048
ReadX 8410 8508 2048 2048
ReadX 8410 10556 2048 2048
ReadX 8410 12604 2048 2048
ReadX 8410 14652 2048 2048
ReadX 8410 16700 2048 2048
ReadX 8410 18748 2048 2048
ReadX 8410 20796 2048 2048
ReadX 8410 22844 2048 2048
ReadX 8410 24892 2048 2048
ReadX 8410 26940 2048 2048
ReadX 8410 28988 2048 2048
ReadX 8410 31036 2048 2048
ReadX 8410 436 2048 2048
ReadX 8410 2484 2048 2048
ReadX 8410 4532 2048 2048
ReadX 8410 6580 2048 2048
ReadX 8410 8628 2048 2048
ReadX 8410 10676 2048 2048
ReadX 8410 476 2048 2048
ReadX 8410 476 2048 2048
ReadX 8410 476 2048 2048
ReadX 8410 2524 2048 2048
ReadX 8410 484 2048 2048
ReadX 8410 484 2048 2048
ReadX 8410 484 2048 2048
ReadX 8410 2532 665 665
ReadX 8410 492 665 665
ReadX 8410 492 665 665
ReadX 8410 492 665 665
ReadX 8410 296 512 512
ReadX 8410 318 512 512
ReadX 8410 300 512 512
ReadX 8410 312 512 512
ReadX 8410 320 512 512
ReadX 8410 832 354 354
ReadX 8410 504 4096 4096
ReadX 8410 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 8411
Close 8411
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 8412
WriteX 8412 1535 1 1
QUERY_FILE_INFORMATION 8412
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8410 296 1251 1251
ReadX 8410 2176 384 384
ReadX 8410 3072 1634 1634
QUERY_FILE_INFORMATION 8412
WriteX 8412 0 57088 57088
WriteX 8412 0 4096 4096
Flush 8412
Close 8410
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 8413
Close 8413
WriteX 8412 0 4096 4096
Close 8412
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 8414
Close 8414
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 8415
QUERY_FILE_INFORMATION 8415
ReadX 8415 0 512 512
ReadX 8415 512 512 512
ReadX 8415 1024 512 512
QUERY_FILE_INFORMATION 8415
QUERY_FILE_INFORMATION 8415
ReadX 8415 512 2048 2048
QUERY_FILE_INFORMATION 8415
QUERY_FILE_INFORMATION 8415
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8415 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 8416
WriteX 8416 1535 1 1
QUERY_FILE_INFORMATION 8416
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8415 1536 512 512
ReadX 8415 288 1251 1251
ReadX 8415 2048 2018 2018
QUERY_FILE_INFORMATION 8416
WriteX 8416 0 51456 51456
WriteX 8416 0 4096 4096
Flush 8416
QUERY_FILE_INFORMATION 8415
QUERY_FILE_INFORMATION 8415
Close 8415
WriteX 8416 0 4096 4096
Close 8416
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 8417
Close 8417
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 8418
QUERY_FILE_INFORMATION 8418
ReadX 8418 0 512 512
ReadX 8418 512 512 512
ReadX 8418 1024 512 512
QUERY_FILE_INFORMATION 8418
QUERY_FILE_INFORMATION 8418
ReadX 8418 512 2048 2048
QUERY_FILE_INFORMATION 8418
QUERY_FILE_INFORMATION 8418
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8418 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 8420
Close 8420
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 8422
WriteX 8422 4045 1 1
QUERY_FILE_INFORMATION 8422
WriteX 8422 0 53077 53077
Close 8422
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 8423
WriteX 8423 1535 1 1
QUERY_FILE_INFORMATION 8423
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8418 1536 512 512
ReadX 8418 288 1251 1251
ReadX 8418 2048 2018 2018
QUERY_FILE_INFORMATION 8423
WriteX 8423 0 65471 65471
WriteX 8423 65471 65 65
WriteX 8423 65536 1856 1856
WriteX 8423 0 4096 4096
Flush 8423
QUERY_FILE_INFORMATION 8418
QUERY_FILE_INFORMATION 8418
Close 8418
WriteX 8423 0 4096 4096
Close 8423
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 8424
Close 8424
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 8425
QUERY_FILE_INFORMATION 8425
ReadX 8425 0 512 512
ReadX 8425 512 512 512
ReadX 8425 1024 512 512
QUERY_FILE_INFORMATION 8425
QUERY_FILE_INFORMATION 8425
ReadX 8425 576 2048 2048
QUERY_FILE_INFORMATION 8425
QUERY_FILE_INFORMATION 8425
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 8427
Close 8427
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 8429
WriteX 8429 4076 1 1
QUERY_FILE_INFORMATION 8429
WriteX 8429 0 7983 7983
Close 8429
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 8431
Close 8431
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 8433
WriteX 8433 4095 1 1
QUERY_FILE_INFORMATION 8433
WriteX 8433 0 65471 65471
WriteX 8433 65471 65 65
WriteX 8433 65536 65471 65471
WriteX 8433 131007 65 65
WriteX 8433 131072 65471 65471
WriteX 8433 196543 65 65
WriteX 8433 196608 65471 65471
WriteX 8433 262079 65 65
WriteX 8433 262144 65471 65471
WriteX 8433 327615 65 65
WriteX 8433 327680 65471 65471
WriteX 8433 393151 65 65
WriteX 8433 393216 65471 65471
WriteX 8433 458687 65 65
WriteX 8433 458752 46731 46731
Close 8433
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 8434
WriteX 8434 1535 1 1
QUERY_FILE_INFORMATION 8434
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8425 1536 512 512
ReadX 8425 2048 2018 2018
ReadX 8425 4096 512 512
ReadX 8425 4608 2197 2197
QUERY_FILE_INFORMATION 8434
WriteX 8434 0 65471 65471
WriteX 8434 65471 65 65
WriteX 8434 65536 22848 22848
WriteX 8434 0 4096 4096
Flush 8434
QUERY_FILE_INFORMATION 8425
QUERY_FILE_INFORMATION 8425
Close 8425
WriteX 8434 0 4096 4096
Close 8434
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 8435
Close 8435
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 8436
QUERY_FILE_INFORMATION 8436
ReadX 8436 0 512 512
ReadX 8436 512 512 512
ReadX 8436 1024 512 512
QUERY_FILE_INFORMATION 8436
QUERY_FILE_INFORMATION 8436
ReadX 8436 576 2048 2048
QUERY_FILE_INFORMATION 8436
QUERY_FILE_INFORMATION 8436
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8436 4096 512 512
Close 8436
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 8437
QUERY_FILE_INFORMATION 8437
ReadX 8437 0 512 512
ReadX 8437 512 512 512
ReadX 8437 1024 512 512
QUERY_FILE_INFORMATION 8437
QUERY_FILE_INFORMATION 8437
ReadX 8437 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 8437
QUERY_FILE_INFORMATION 8437
ReadX 8437 288 4096 4096
QUERY_FILE_INFORMATION 8437
QUERY_FILE_INFORMATION 8437
QUERY_FILE_INFORMATION 8437
WriteX 8437 288 4096 4096
WriteX 8437 1024 512 512
ReadX 8437 1536 512 512
QUERY_FILE_INFORMATION 8437
ReadX 8437 288 2048 2048
ReadX 8437 2336 2048 2048
ReadX 8437 3072 1536 1536
ReadX 8437 544 512 512
ReadX 8437 1056 2048 2048
ReadX 8437 3104 2048 2048
ReadX 8437 5152 2048 2048
ReadX 8437 7200 2048 2048
ReadX 8437 9248 2048 2048
ReadX 8437 11296 2048 2048
ReadX 8437 13344 2048 2048
ReadX 8437 15392 2048 2048
ReadX 8437 17440 2048 2048
ReadX 8437 19488 2048 2048
ReadX 8437 21536 2048 2048
ReadX 8437 23584 2048 2048
ReadX 8437 25632 2048 2048
ReadX 8437 27680 2048 2048
ReadX 8437 29728 2048 2048
ReadX 8437 31776 2048 2048
ReadX 8437 33824 2048 2048
ReadX 8437 35872 2048 2048
ReadX 8437 37920 2048 2048
ReadX 8437 39968 2048 2048
ReadX 8437 42016 512 512
ReadX 8437 42528 512 512
ReadX 8437 43040 1536 1536
ReadX 8437 44576 2048 2048
ReadX 8437 46624 2048 2048
ReadX 8437 48672 2048 2048
ReadX 8437 50720 2048 2048
ReadX 8437 52768 2048 2048
ReadX 8437 54816 2048 2048
ReadX 8437 56864 2048 2048
ReadX 8437 58912 2048 2048
ReadX 8437 60960 2048 2048
ReadX 8437 63008 2048 2048
ReadX 8437 65056 2048 2048
ReadX 8437 67104 2048 2048
ReadX 8437 69152 2048 2048
ReadX 8437 71200 2048 2048
ReadX 8437 73248 2048 2048
ReadX 8437 75296 2048 2048
ReadX 8437 77344 2048 2048
ReadX 8437 79392 2048 2048
ReadX 8437 81440 2048 2048
ReadX 8437 83488 2048 2048
ReadX 8437 85536 512 512
ReadX 8437 86048 512 512
ReadX 8437 86560 1536 1536
ReadX 8437 88096 2048 2048
ReadX 8437 90144 2048 2048
ReadX 8437 92192 2048 2048
ReadX 8437 94240 2048 2048
ReadX 8437 96288 2048 2048
ReadX 8437 552 2048 2048
ReadX 8437 2600 2048 2048
ReadX 8437 4648 2048 2048
ReadX 8437 6696 2048 2048
ReadX 8437 8744 2048 2048
ReadX 8437 10792 2048 2048
ReadX 8437 12840 2048 2048
ReadX 8437 14888 2048 2048
ReadX 8437 16936 2048 2048
ReadX 8437 18984 2048 2048
ReadX 8437 21032 2048 2048
ReadX 8437 23080 2048 2048
ReadX 8437 25128 2048 2048
ReadX 8437 27176 2048 2048
ReadX 8437 29224 2048 2048
ReadX 8437 31272 2048 2048
ReadX 8437 33320 2048 2048
ReadX 8437 35368 2048 2048
ReadX 8437 37416 2048 2048
ReadX 8437 39464 2048 2048
ReadX 8437 41512 512 512
ReadX 8437 42024 512 512
ReadX 8437 42536 1536 1536
ReadX 8437 44072 2048 2048
ReadX 8437 46120 2048 2048
ReadX 8437 48168 2048 2048
ReadX 8437 50216 2048 2048
ReadX 8437 52264 2048 2048
ReadX 8437 54312 2048 2048
ReadX 8437 56360 2048 2048
ReadX 8437 58408 2048 2048
ReadX 8437 60456 2048 2048
ReadX 8437 62504 2048 2048
ReadX 8437 64552 2048 2048
ReadX 8437 66600 2048 2048
ReadX 8437 68648 2048 2048
ReadX 8437 70696 2048 2048
ReadX 8437 72744 2048 2048
ReadX 8437 74792 2048 2048
ReadX 8437 76840 2048 2048
ReadX 8437 78888 2048 2048
ReadX 8437 80936 2048 2048
ReadX 8437 82984 2048 2048
ReadX 8437 85032 512 512
ReadX 8437 85544 2048 2048
ReadX 8437 87592 2048 2048
ReadX 8437 89640 2048 2048
ReadX 8437 91688 2048 2048
ReadX 8437 93736 2048 2048
ReadX 8437 95784 2048 2048
ReadX 8437 97832 2048 2048
ReadX 8437 99880 2048 2048
ReadX 8437 101928 2048 2048
ReadX 8437 103976 2048 2048
ReadX 8437 106024 2048 2048
ReadX 8437 108072 2048 2048
ReadX 8437 110120 2048 2048
ReadX 8437 112168 2048 2048
ReadX 8437 114216 2048 2048
ReadX 8437 116264 2048 2048
ReadX 8437 118312 2048 2048
ReadX 8437 120360 2048 2048
ReadX 8437 122408 2048 2048
ReadX 8437 124456 512 512
ReadX 8437 124968 512 512
ReadX 8437 125480 1536 1536
ReadX 8437 127016 2048 2048
ReadX 8437 129064 2048 2048
ReadX 8437 131112 2048 2048
ReadX 8437 133160 2048 2048
ReadX 8437 135208 2048 2048
ReadX 8437 137256 2048 2048
ReadX 8437 139304 2048 2048
ReadX 8437 141352 2048 2048
ReadX 8437 143400 2048 2048
ReadX 8437 145448 2048 2048
ReadX 8437 147496 2048 2048
ReadX 8437 149544 2048 2048
ReadX 8437 151592 2048 2048
ReadX 8437 153640 2048 2048
ReadX 8437 155688 2048 2048
ReadX 8437 157736 2048 2048
ReadX 8437 159784 2048 2048
ReadX 8437 161832 2048 2048
ReadX 8437 163880 2048 2048
ReadX 8437 165928 2048 2048
ReadX 8437 167976 2048 2048
ReadX 8437 170024 512 512
ReadX 8437 1538 1536 1536
ReadX 8437 3074 2048 2048
ReadX 8437 5122 2048 2048
ReadX 8437 7170 2048 2048
ReadX 8437 9218 2048 2048
ReadX 8437 11266 2048 2048
ReadX 8437 13314 2048 2048
ReadX 8437 15362 2048 2048
ReadX 8437 17410 2048 2048
ReadX 8437 19458 2048 2048
ReadX 8437 21506 2048 2048
ReadX 8437 23554 2048 2048
ReadX 8437 25602 2048 2048
ReadX 8437 27650 2048 2048
ReadX 8437 29698 2048 2048
ReadX 8437 31746 2048 2048
ReadX 8437 33794 2048 2048
ReadX 8437 35842 2048 2048
ReadX 8437 37890 2048 2048
ReadX 8437 39938 2048 2048
ReadX 8437 41986 2048 2048
ReadX 8437 44034 875 875
ReadX 8437 1730 4096 4096
ReadX 8437 1724 1536 1536
ReadX 8437 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 8438
Close 8438
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 8439
WriteX 8439 2047 1 1
QUERY_FILE_INFORMATION 8439
Close 8437
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 8440
Close 8440
WriteX 8439 0 42388 42388
Close 8439
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 8441
Close 8441
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 8442
QUERY_FILE_INFORMATION 8442
ReadX 8442 0 512 512
ReadX 8442 1756 512 512
ReadX 8442 2268 512 512
QUERY_FILE_INFORMATION 8442
QUERY_FILE_INFORMATION 8442
ReadX 8442 1744 512 512
ReadX 8442 2256 512 512
ReadX 8442 2768 512 512
ReadX 8442 3280 512 512
ReadX 8442 3792 512 512
ReadX 8442 4304 512 512
ReadX 8442 512 2048 2048
QUERY_FILE_INFORMATION 8442
QUERY_FILE_INFORMATION 8442
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 8443
WriteX 8443 2047 1 1
QUERY_FILE_INFORMATION 8443
QUERY_FILE_INFORMATION 8442
QUERY_FILE_INFORMATION 8442
Close 8442
WriteX 8443 0 42652 42652
Close 8443
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 8444
Close 8444
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 8445
QUERY_FILE_INFORMATION 8445
ReadX 8445 0 512 512
ReadX 8445 1762 512 512
ReadX 8445 2274 512 512
QUERY_FILE_INFORMATION 8445
QUERY_FILE_INFORMATION 8445
ReadX 8445 1750 512 512
ReadX 8445 2262 512 512
ReadX 8445 2774 512 512
ReadX 8445 3286 512 512
ReadX 8445 3798 512 512
ReadX 8445 4310 512 512
ReadX 8445 512 2048 2048
QUERY_FILE_INFORMATION 8445
QUERY_FILE_INFORMATION 8445
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 8447
Close 8447
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 8449
WriteX 8449 4080 1 1
QUERY_FILE_INFORMATION 8449
WriteX 8449 0 65471 65471
WriteX 8449 65471 65 65
WriteX 8449 65536 49 49
Close 8449
Close 8445
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 8450
WriteX 8450 0 65471 65471
WriteX 8450 65471 63 63
WriteX 8450 65534 65471 65471
WriteX 8450 131005 63 63
Close 8450
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 8451
WriteX 8451 0 65471 65471
WriteX 8451 65471 63 63
WriteX 8451 65534 65471 65471
WriteX 8451 131005 63 63
WriteX 8451 131068 65471 65471
WriteX 8451 196539 63 63
WriteX 8451 196602 65471 65471
WriteX 8451 262073 63 63
Close 8451
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 8452
WriteX 8452 0 65471 65471
WriteX 8452 65471 63 63
WriteX 8452 65534 65471 65471
WriteX 8452 131005 63 63
WriteX 8452 131068 65471 65471
WriteX 8452 196539 63 63
WriteX 8452 196602 65471 65471
WriteX 8452 262073 63 63
WriteX 8452 262136 65471 65471
WriteX 8452 327607 63 63
WriteX 8452 327670 65471 65471
WriteX 8452 393141 63 63
WriteX 8452 393204 65471 65471
WriteX 8452 458675 63 63
WriteX 8452 458738 65471 65471
WriteX 8452 524209 63 63
Close 8452
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 8453
Close 8453
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 8454
Close 8454
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 8457
Close 8457
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 8459
Close 8459
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 8460
Close 8460
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 8463
Close 8463
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 8465
Close 8465
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 8466
Close 8466
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8469
Close 8469
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8473
Close 8473
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8477
Close 8477
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8481
Close 8481
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 8485
Close 8485
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 8489
Close 8489
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 8493
Close 8493
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 8497
Close 8497
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 8499
Close 8499
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 8501
Close 8501
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 8503
WriteX 8503 4095 1 1
QUERY_FILE_INFORMATION 8503
QUERY_FS_INFORMATION 259
WriteX 8503 0 65471 65471
WriteX 8503 65471 65 65
WriteX 8503 65536 65471 65471
WriteX 8503 131007 65 65
WriteX 8503 131072 65471 65471
WriteX 8503 196543 65 65
WriteX 8503 196608 65471 65471
WriteX 8503 262079 65 65
WriteX 8503 262144 26634 26634
Close 8503
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 8508
QUERY_FILE_INFORMATION 8508
QUERY_FILE_INFORMATION 8508
Close 8508
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 8509
Close 8509
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 8510
Close 8510
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 8511
QUERY_FILE_INFORMATION 8511
ReadX 8511 0 512 512
ReadX 8511 288 512 512
ReadX 8511 800 512 512
Close 8511
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 8512
ReadX 8512 0 24 24
Close 8512
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 8513
ReadX 8513 0 24 24
Close 8513
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 8514
QUERY_FILE_INFORMATION 8514
ReadX 8514 0 512 512
ReadX 8514 288 512 512
ReadX 8514 800 512 512
ReadX 8514 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 8514 1759 2849 2849
Close 8514
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 8515
Close 8515
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 8518
Close 8518
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 8520
Close 8520
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 8521
Close 8521
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 8524
Close 8524
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 8526
Close 8526
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8527
Close 8527
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8530
Close 8530
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8534
Close 8534
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8538
Close 8538
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8542
Close 8542
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 8546
Close 8546
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 8550
Close 8550
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 8553
Close 8553
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 8557
Close 8557
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 8561
Close 8561
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 8563
Close 8563
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 8564
Close 8564
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 8573
QUERY_FILE_INFORMATION 8573
QUERY_FILE_INFORMATION 8573
Close 8573
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 8574
Close 8574
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 8575
Close 8575
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 8576
QUERY_FILE_INFORMATION 8576
ReadX 8576 0 512 512
ReadX 8576 288 512 512
ReadX 8576 800 512 512
Close 8576
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 8577
ReadX 8577 0 24 24
Close 8577
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 8578
QUERY_FILE_INFORMATION 8578
ReadX 8578 0 512 512
ReadX 8578 288 512 512
ReadX 8578 800 512 512
ReadX 8578 512 36 36
Close 8578
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 8579
QUERY_FILE_INFORMATION 8579
ReadX 8579 0 512 512
ReadX 8579 288 512 512
ReadX 8579 800 512 512
ReadX 8579 512 682 682
ReadX 8579 3584 106 106
ReadX 8579 3712 10 10
ReadX 8579 3722 10 10
ReadX 8579 512 2048 2048
ReadX 8579 3072 512 512
ReadX 8579 276 84 84
ReadX 8579 273 49 49
ReadX 8579 2560 512 512
Close 8579
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 8589
QUERY_FILE_INFORMATION 8589
QUERY_FILE_INFORMATION 8589
Close 8589
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 8590
Close 8590
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 8591
Close 8591
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 8592
QUERY_FILE_INFORMATION 8592
ReadX 8592 0 512 512
ReadX 8592 288 512 512
ReadX 8592 800 512 512
Close 8592
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 8593
ReadX 8593 0 24 24
Close 8593
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 8594
QUERY_FILE_INFORMATION 8594
ReadX 8594 0 512 512
ReadX 8594 288 512 512
ReadX 8594 800 512 512
ReadX 8594 512 36 36
Close 8594
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 8595
QUERY_FILE_INFORMATION 8595
ReadX 8595 0 512 512
ReadX 8595 288 512 512
ReadX 8595 800 512 512
ReadX 8595 512 682 682
ReadX 8595 3072 106 106
ReadX 8595 3200 10 10
ReadX 8595 3210 10 10
ReadX 8595 512 2048 2048
ReadX 8595 2560 512 512
ReadX 8595 3887 84 84
ReadX 8595 3838 49 49
ReadX 8595 2048 512 512
Close 8595
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 8596
Close 8596
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 8597
QUERY_FILE_INFORMATION 8597
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 8597
QUERY_FILE_INFORMATION 8597
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 8598
QUERY_FILE_INFORMATION 8598
QUERY_FILE_INFORMATION 8598
QUERY_FILE_INFORMATION 8598
ReadX 8598 2156 24 24
ReadX 8598 2139 276 276
ReadX 8598 2136 14 14
ReadX 8598 2136 7 7
ReadX 8598 2138 12 12
ReadX 8598 2137 8 8
ReadX 8598 2135 15 15
ReadX 8598 0 16 16
ReadX 8598 16 2048 2048
ReadX 8598 2064 2048 2048
ReadX 8598 257 2048 2048
ReadX 8598 385 2048 2048
ReadX 8598 513 2048 2048
ReadX 8598 641 2048 2048
ReadX 8598 769 2048 2048
ReadX 8598 897 2048 2048
ReadX 8598 1025 2048 2048
ReadX 8598 1153 2048 2048
ReadX 8598 1281 2048 2048
ReadX 8598 1409 2048 2048
ReadX 8598 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 8600
Close 8600
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 8602
WriteX 8602 15 1 1
QUERY_FILE_INFORMATION 8602
WriteX 8602 0 10575 10575
Flush 8602
Close 8602
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 8603
Close 8603
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 8604
QUERY_FILE_INFORMATION 8604
QUERY_FILE_INFORMATION 8604
QUERY_FILE_INFORMATION 8604
ReadX 8604 2157 24 24
ReadX 8604 2139 276 276
ReadX 8604 2137 14 14
ReadX 8604 2137 7 7
ReadX 8604 2139 12 12
ReadX 8604 2138 8 8
ReadX 8604 2136 15 15
Close 8598
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 8605
Close 8605
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 8606
QUERY_FILE_INFORMATION 8606
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 8607
QUERY_FILE_INFORMATION 8607
ReadX 8607 0 512 512
ReadX 8607 512 512 512
ReadX 8607 1024 512 512
QUERY_FILE_INFORMATION 8607
QUERY_FILE_INFORMATION 8607
Close 8607
QUERY_FILE_INFORMATION 8606
ReadX 8606 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 8608
QUERY_FILE_INFORMATION 8608
ReadX 8608 0 512 512
ReadX 8608 512 512 512
ReadX 8608 1024 512 512
ReadX 8608 288 20 20
ReadX 8608 308 2084 2084
ReadX 8608 388 2084 2084
ReadX 8608 388 2084 2084
ReadX 8597 2157 1386 1386
ReadX 8608 2472 399 399
ReadX 8608 3072 1536 1536
ReadX 8608 544 149 149
ReadX 8608 693 485 485
Close 8608
ReadX 8597 2157 4096 4096
ReadX 8597 6253 4096 4096
ReadX 8597 10349 4096 4096
ReadX 8597 14445 4096 4096
ReadX 8597 18541 4096 4096
ReadX 8597 22637 256 256
ReadX 8597 22893 4096 4096
ReadX 8597 26989 4096 4096
ReadX 8597 31085 4096 4096
ReadX 8597 35181 4096 4096
ReadX 8597 39277 4096 4096
ReadX 8597 43373 4096 4096
ReadX 8597 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 8597 2157 1024 1024
ReadX 8597 1667 4688 4688
ReadX 8597 6355 3516 3516
ReadX 8597 9871 16384 16384
ReadX 8597 26255 3771 3771
ReadX 8597 30026 2048 2048
ReadX 8597 32074 1024 1024
ReadX 8597 33098 6652 6652
ReadX 8597 39750 16384 16384
ReadX 8597 56134 10496 10496
ReadX 8597 66630 1784 1784
ReadX 8597 68414 90 90
ReadX 8597 68504 273 273
ReadX 8597 68777 1600 1600
ReadX 8597 70377 640 640
ReadX 8597 71017 1280 1280
ReadX 8597 72297 8464 8464
ReadX 8597 80761 158 158
ReadX 8597 80919 912 912
ReadX 8597 81831 1980 1980
ReadX 8597 83811 2256 2256
ReadX 8597 86067 400 400
ReadX 8597 86467 252 252
ReadX 8597 86719 42 42
ReadX 8597 86761 725 725
ReadX 8597 2009 512 512
ReadX 8597 3895 9 9
ReadX 8597 3781 46 46
ReadX 8597 4059 92 92
ReadX 8597 3781 92 92
ReadX 8597 3986 184 184
ReadX 8597 3987 16384 16384
ReadX 8597 3902 16384 16384
ReadX 8597 3781 10240 10240
ReadX 8597 3821 16384 16384
ReadX 8597 3891 935 935
ReadX 8597 4060 10240 10240
ReadX 8597 4059 184 184
ReadX 8597 256 184 184
ReadX 8597 256 1026 1026
ReadX 8597 3901 326 326
ReadX 8597 3899 652 652
ReadX 8597 256 2 2
ReadX 8597 258 4948 4948
Close 8597
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 8610
Close 8610
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 8612
WriteX 8612 4055 1 1
QUERY_FILE_INFORMATION 8612
WriteX 8612 0 65471 65471
WriteX 8612 65471 65 65
WriteX 8612 65536 65471 65471
WriteX 8612 131007 65 65
WriteX 8612 131072 65471 65471
WriteX 8612 196543 65 65
WriteX 8612 196608 65471 65471
WriteX 8612 262079 65 65
WriteX 8612 262144 65471 65471
WriteX 8612 327615 65 65
WriteX 8612 327680 65471 65471
WriteX 8612 393151 65 65
WriteX 8612 393216 65471 65471
WriteX 8612 458687 65 65
WriteX 8612 458752 65471 65471
WriteX 8612 524223 65 65
WriteX 8612 524288 65471 65471
WriteX 8612 589759 65 65
WriteX 8612 589824 35257 35257
Close 8612
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 8614
Close 8614
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 8616
WriteX 8616 4055 1 1
QUERY_FILE_INFORMATION 8616
WriteX 8616 0 65471 65471
WriteX 8616 65471 65 65
WriteX 8616 65536 65471 65471
WriteX 8616 131007 65 65
WriteX 8616 131072 65471 65471
WriteX 8616 196543 65 65
WriteX 8616 196608 65471 65471
WriteX 8616 262079 65 65
WriteX 8616 262144 65471 65471
WriteX 8616 327615 65 65
WriteX 8616 327680 65471 65471
WriteX 8616 393151 65 65
WriteX 8616 393216 65471 65471
WriteX 8616 458687 65 65
WriteX 8616 458752 65471 65471
WriteX 8616 524223 65 65
WriteX 8616 524288 65471 65471
WriteX 8616 589759 65 65
WriteX 8616 589824 57598 57598
Close 8616
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 8618
WriteX 8618 15 1 1
QUERY_FILE_INFORMATION 8618
WriteX 8618 0 12543 12543
Flush 8618
Close 8618
Close 8604
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 8619
Close 8619
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 8620
QUERY_FILE_INFORMATION 8620
QUERY_FILE_INFORMATION 8620
QUERY_FILE_INFORMATION 8620
ReadX 8620 288 24 24
ReadX 8620 287 276 276
ReadX 8620 286 14 14
ReadX 8620 286 7 7
ReadX 8620 287 12 12
ReadX 8620 287 8 8
ReadX 8620 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 8621
Close 8621
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 8622
QUERY_FILE_INFORMATION 8622
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 8622
QUERY_FILE_INFORMATION 8622
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 8623
QUERY_FILE_INFORMATION 8623
QUERY_FILE_INFORMATION 8623
QUERY_FILE_INFORMATION 8623
ReadX 8623 1938 24 24
ReadX 8623 1920 276 276
ReadX 8623 1918 14 14
ReadX 8623 1918 7 7
ReadX 8623 1919 12 12
ReadX 8623 1919 8 8
ReadX 8623 1917 15 15
ReadX 8623 0 16 16
ReadX 8623 16 2048 2048
ReadX 8623 2064 2048 2048
ReadX 8623 257 2048 2048
ReadX 8623 385 2048 2048
ReadX 8623 513 2048 2048
ReadX 8623 641 2048 2048
ReadX 8623 769 2048 2048
ReadX 8623 897 2048 2048
ReadX 8623 1025 2048 2048
ReadX 8623 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 8625
Close 8625
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 8627
WriteX 8627 15 1 1
QUERY_FILE_INFORMATION 8627
WriteX 8627 0 11588 11588
Flush 8627
Close 8627
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 8628
Close 8628
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 8629
QUERY_FILE_INFORMATION 8629
QUERY_FILE_INFORMATION 8629
QUERY_FILE_INFORMATION 8629
ReadX 8629 1909 24 24
ReadX 8629 1892 276 276
ReadX 8629 1889 14 14
ReadX 8629 1889 7 7
ReadX 8629 1891 12 12
ReadX 8629 1890 8 8
ReadX 8629 1888 15 15
Close 8623
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 8631
WriteX 8631 15 1 1
QUERY_FILE_INFORMATION 8631
WriteX 8631 0 11615 11615
Flush 8631
Close 8631
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 8629
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 8632
Close 8632
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 8633
QUERY_FILE_INFORMATION 8633
QUERY_FILE_INFORMATION 8633
QUERY_FILE_INFORMATION 8633
ReadX 8633 1947 24 24
ReadX 8633 1929 276 276
ReadX 8633 1927 14 14
ReadX 8633 1927 7 7
ReadX 8633 1929 12 12
ReadX 8633 1928 8 8
ReadX 8633 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 8635
Close 8635
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 8637
WriteX 8637 4088 1 1
QUERY_FILE_INFORMATION 8637
WriteX 8637 0 65471 65471
WriteX 8637 65471 65 65
WriteX 8637 65536 16050 16050
Close 8637
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8622 1939 64 64
ReadX 8622 128 248 248
ReadX 8622 128 568 568
ReadX 8622 3872 1536 1536
ReadX 8622 3456 2560 2560
ReadX 8622 3136 512 512
ReadX 8622 2880 4096 4096
ReadX 8622 3264 3072 3072
ReadX 8622 320 4096 4096
ReadX 8622 1024 4096 4096
ReadX 8622 3616 4096 4096
ReadX 8622 1939 64 64
ReadX 8622 128 248 248
ReadX 8622 128 608 608
ReadX 8622 2858 1024 1024
ReadX 8622 2810 4096 4096
ReadX 8622 2826 4096 4096
ReadX 8622 2580 2048 2048
ReadX 8622 2800 2560 2560
ReadX 8622 2100 4096 4096
ReadX 8622 2084 4096 4096
ReadX 8622 868 4096 4096
ReadX 8622 2324 4096 4096
ReadX 8622 884 4096 4096
ReadX 8622 2604 1024 1024
ReadX 8622 580 4096 4096
ReadX 8622 596 4096 4096
ReadX 8622 2752 4096 4096
ReadX 8622 2842 1024 1024
ReadX 8622 660 4096 4096
ReadX 8622 2720 4096 4096
ReadX 8622 2736 4096 4096
ReadX 8622 628 4096 4096
ReadX 8622 2704 4096 4096
ReadX 8622 1556 4096 4096
ReadX 8622 576 4096 4096
ReadX 8622 3168 1536 1536
ReadX 8622 832 4096 4096
ReadX 8622 1088 4096 4096
ReadX 8622 1344 4096 4096
ReadX 8622 1600 4096 4096
ReadX 8622 1856 4096 4096
ReadX 8622 2112 4096 4096
ReadX 8622 1892 4096 4096
ReadX 8622 820 4096 4096
ReadX 8622 788 4096 4096
ReadX 8622 1604 4096 4096
ReadX 8622 3648 4096 4096
ReadX 8622 2608 4096 4096
ReadX 8622 548 4096 4096
ReadX 8622 740 4096 4096
ReadX 8622 1344 4096 4096
ReadX 8622 3392 4096 4096
ReadX 8622 3904 4096 4096
ReadX 8622 644 4096 4096
ReadX 8622 676 4096 4096
ReadX 8622 2688 4096 4096
ReadX 8622 320 4096 4096
ReadX 8622 900 4096 4096
ReadX 8622 1908 4096 4096
ReadX 8622 852 4096 4096
ReadX 8622 724 4096 4096
ReadX 8622 2292 4096 4096
ReadX 8622 612 4096 4096
ReadX 8622 388 4096 4096
ReadX 8622 2368 4096 4096
ReadX 8622 2624 4096 4096
ReadX 8622 500 4096 4096
ReadX 8622 356 4096 4096
ReadX 8622 1024 4096 4096
ReadX 8622 576 4096 4096
ReadX 8622 340 4096 4096
ReadX 8622 420 4096 4096
ReadX 8622 1600 4096 4096
ReadX 8622 404 4096 4096
ReadX 8622 1428 4096 4096
ReadX 8622 2656 4096 4096
ReadX 8622 2624 4096 4096
ReadX 8622 452 4096 4096
ReadX 8622 692 4096 4096
ReadX 8622 564 4096 4096
ReadX 8622 372 4096 4096
ReadX 8622 468 4096 4096
ReadX 8622 484 4096 4096
ReadX 8622 1088 4096 4096
ReadX 8622 1924 4096 4096
ReadX 8622 2768 4096 4096
ReadX 8622 832 4096 4096
ReadX 8622 836 4096 4096
ReadX 8622 1856 4096 4096
ReadX 8622 2640 4096 4096
ReadX 8622 436 4096 4096
ReadX 8622 1828 4096 4096
ReadX 8622 804 4096 4096
ReadX 8622 1860 4096 4096
ReadX 8622 1812 4096 4096
ReadX 8622 756 4096 4096
ReadX 8622 1636 4096 4096
ReadX 8622 772 4096 4096
ReadX 8622 2036 4096 4096
ReadX 8622 1220 4096 4096
ReadX 8622 1652 4096 4096
ReadX 8622 2588 4096 4096
ReadX 8622 916 4096 4096
ReadX 8622 260 4096 4096
ReadX 8622 932 4096 4096
ReadX 8622 2624 4096 4096
ReadX 8622 308 4096 4096
ReadX 8622 292 4096 4096
ReadX 8622 1140 4096 4096
ReadX 8622 276 4096 4096
ReadX 8622 2020 4096 4096
ReadX 8622 2880 4096 4096
ReadX 8622 516 4096 4096
ReadX 8622 1844 4096 4096
ReadX 8622 1124 4096 4096
ReadX 8622 3136 4096 4096
ReadX 8622 324 4096 4096
ReadX 8622 1156 4096 4096
ReadX 8622 1172 4096 4096
ReadX 8622 2112 4096 4096
ReadX 8622 2368 4096 4096
ReadX 8622 964 4096 4096
ReadX 8622 980 4096 4096
ReadX 8622 1012 4096 4096
ReadX 8622 532 4096 4096
ReadX 8622 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 8622 1620 4096 4096
ReadX 8622 1604 4096 4096
ReadX 8622 2116 4096 4096
ReadX 8622 2132 4096 4096
ReadX 8622 2148 4096 4096
ReadX 8622 2276 4096 4096
ReadX 8622 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 8639
Close 8639
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 8641
QUERY_FILE_INFORMATION 8606
WriteX 8641 4088 1 1
QUERY_FILE_INFORMATION 8641
QUERY_FILE_INFORMATION 8606
Close 8606
WriteX 8641 0 65471 65471
WriteX 8641 65471 65 65
WriteX 8641 65536 64850 64850
Close 8641
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 8643
WriteX 8643 15 1 1
QUERY_FILE_INFORMATION 8643
ReadX 8622 2068 4096 4096
ReadX 8622 1588 4096 4096
ReadX 8622 1572 4096 4096
WriteX 8643 0 18630 18630
Flush 8643
Close 8643
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 8633
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 8644
Close 8644
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 8645
QUERY_FILE_INFORMATION 8645
QUERY_FILE_INFORMATION 8645
QUERY_FILE_INFORMATION 8645
ReadX 8645 661 24 24
ReadX 8645 659 356 356
ReadX 8645 659 14 14
ReadX 8645 659 7 7
ReadX 8645 659 12 12
ReadX 8645 659 8 8
ReadX 8645 659 15 15
ReadX 8645 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 8622 612 4096 4096
ReadX 8622 564 4096 4096
ReadX 8622 1876 4096 4096
ReadX 8622 628 4096 4096
ReadX 8622 740 4096 4096
ReadX 8622 724 4096 4096
ReadX 8622 644 4096 4096
ReadX 8622 2324 4096 4096
ReadX 8622 660 4096 4096
ReadX 8622 852 4096 4096
ReadX 8622 868 4096 4096
Close 8645
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 8620
ReadX 8622 2368 4096 4096
ReadX 8622 1024 4096 4096
ReadX 8622 320 4096 4096
ReadX 8622 580 4096 4096
ReadX 8622 3136 512 512
ReadX 8622 2880 4096 4096
Close 8622
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 8646
WriteX 8646 0 65471 65471
WriteX 8646 65471 63 63
WriteX 8646 65534 65471 65471
WriteX 8646 131005 63 63
Close 8646
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 8647
WriteX 8647 0 65471 65471
WriteX 8647 65471 63 63
WriteX 8647 65534 65471 65471
WriteX 8647 131005 63 63
WriteX 8647 131068 65471 65471
WriteX 8647 196539 63 63
WriteX 8647 196602 65471 65471
WriteX 8647 262073 63 63
Close 8647
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 8648
WriteX 8648 0 65471 65471
WriteX 8648 65471 63 63
WriteX 8648 65534 65471 65471
WriteX 8648 131005 63 63
WriteX 8648 131068 65471 65471
WriteX 8648 196539 63 63
WriteX 8648 196602 65471 65471
WriteX 8648 262073 63 63
WriteX 8648 262136 65471 65471
WriteX 8648 327607 63 63
WriteX 8648 327670 65471 65471
WriteX 8648 393141 63 63
WriteX 8648 393204 65471 65471
WriteX 8648 458675 63 63
WriteX 8648 458738 65471 65471
WriteX 8648 524209 63 63
Close 8648
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8649
Close 8649
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8650
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8651
ReadX 8651 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8652
ReadX 8652 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8653
ReadX 8653 0 511 511
ReadX 8650 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8650
Close 8651
Close 8652
Close 8653
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8654
ReadX 8654 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8655
ReadX 8655 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8656
ReadX 8656 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8657
ReadX 8657 0 511 511
ReadX 8654 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 8658
FIND_FIRST \clients\client1\~dmtmp\*
Close 8658
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 8659
QUERY_FILE_INFORMATION 8659
WriteX 8659 2047 1 1
QUERY_FILE_INFORMATION 8659
WriteX 8659 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 8660
Close 8660
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 8661
WriteX 8661 52 1 1
QUERY_FILE_INFORMATION 8661
WriteX 8661 0 53 53
WriteX 8661 53 28 28
WriteX 8661 81 4 4
WriteX 8661 85 28 28
WriteX 8661 113 38 38
WriteX 8661 151 28 28
WriteX 8661 179 2 2
WriteX 8661 181 28 28
WriteX 8661 209 3 3
WriteX 8661 212 279 279
WriteX 8661 9 4 4
Close 8661
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 8662
ReadX 8662 0 53 53
ReadX 8662 53 28 28
ReadX 8662 81 4 4
ReadX 8662 85 28 28
ReadX 8662 113 38 38
ReadX 8662 151 28 28
ReadX 8662 179 2 2
ReadX 8662 181 28 28
ReadX 8662 209 3 3
Close 8662
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 8654
Close 8655
Close 8656
Close 8657
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8663
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8663 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8664
ReadX 8664 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8665
ReadX 8665 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8666
ReadX 8666 0 511 511
ReadX 8663 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 8668
Close 8668
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8669
WriteX 8669 52 1 1
QUERY_FILE_INFORMATION 8669
WriteX 8669 0 53 53
WriteX 8669 53 28 28
WriteX 8669 81 28 28
WriteX 8669 109 28 28
WriteX 8669 137 28 28
WriteX 8669 165 28 28
WriteX 8669 193 28 28
WriteX 8669 221 28 28
WriteX 8669 249 4 4
WriteX 8669 253 4 4
WriteX 8669 257 4 4
WriteX 8669 261 28 28
WriteX 8669 289 2 2
WriteX 8669 291 2 2
WriteX 8669 293 2 2
WriteX 8669 295 248 248
WriteX 8669 9 4 4
Close 8669
Close 8663
Close 8664
Close 8665
Close 8666
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8670
ReadX 8670 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8671
ReadX 8671 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8672
ReadX 8672 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8673
ReadX 8673 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8674
ReadX 8674 0 53 53
ReadX 8674 53 28 28
ReadX 8674 81 28 28
ReadX 8674 109 28 28
ReadX 8674 137 28 28
ReadX 8674 165 28 28
ReadX 8674 193 28 28
ReadX 8674 221 28 28
ReadX 8674 249 4 4
ReadX 8674 253 4 4
ReadX 8674 257 4 4
ReadX 8674 261 28 28
ReadX 8674 289 2 2
ReadX 8674 291 2 2
ReadX 8674 293 2 2
Close 8674
ReadX 8670 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8670
Close 8671
Close 8672
Close 8673
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 8659
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8675
Close 8675
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8676
ReadX 8676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8677
ReadX 8677 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8678
ReadX 8678 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8679
ReadX 8679 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8680
ReadX 8680 0 53 53
ReadX 8680 53 28 28
ReadX 8680 81 28 28
ReadX 8680 109 28 28
ReadX 8680 137 28 28
ReadX 8680 165 28 28
ReadX 8680 193 28 28
ReadX 8680 221 28 28
ReadX 8680 249 4 4
ReadX 8680 253 4 4
ReadX 8680 257 4 4
ReadX 8680 261 28 28
ReadX 8680 289 2 2
ReadX 8680 291 2 2
ReadX 8680 293 2 2
Close 8680
ReadX 8676 2048 2048 2048
Close 8676
Close 8677
Close 8678
Close 8679
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8681
ReadX 8681 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8682
ReadX 8682 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8683
ReadX 8683 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8684
ReadX 8684 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8685
ReadX 8685 0 53 53
ReadX 8685 53 28 28
ReadX 8685 81 28 28
ReadX 8685 109 28 28
ReadX 8685 137 28 28
ReadX 8685 165 28 28
ReadX 8685 193 28 28
ReadX 8685 221 28 28
ReadX 8685 249 4 4
ReadX 8685 253 4 4
ReadX 8685 257 4 4
ReadX 8685 261 28 28
ReadX 8685 289 2 2
ReadX 8685 291 2 2
ReadX 8685 293 2 2
Close 8685
ReadX 8681 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 8689
FIND_FIRST \clients\client1\~dmtmp\*
Close 8689
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 8690
QUERY_FILE_INFORMATION 8690
WriteX 8690 2047 1 1
QUERY_FILE_INFORMATION 8690
WriteX 8690 0 2048 2048
Close 8690
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 8691
ReadX 8691 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 8691
Close 8681
Close 8682
Close 8683
Close 8684
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 8692
ReadX 8692 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 8692 4095 1 1
QUERY_FILE_INFORMATION 8692
WriteX 8692 2048 2048 2048
QUERY_FILE_INFORMATION 8692
Flush 8692
WriteX 8692 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8693
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8694
ReadX 8694 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8695
ReadX 8695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8696
ReadX 8696 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8697
ReadX 8697 0 53 53
ReadX 8697 53 28 28
ReadX 8697 81 28 28
ReadX 8697 109 28 28
ReadX 8697 137 28 28
ReadX 8697 165 28 28
ReadX 8697 193 28 28
ReadX 8697 221 28 28
ReadX 8697 249 4 4
ReadX 8697 253 4 4
ReadX 8697 257 4 4
ReadX 8697 261 28 28
ReadX 8697 289 2 2
ReadX 8697 291 2 2
ReadX 8697 293 2 2
Close 8697
ReadX 8693 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 8701
FIND_FIRST \clients\client1\~dmtmp\*
Close 8701
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 8702
QUERY_FILE_INFORMATION 8702
WriteX 8702 2047 1 1
QUERY_FILE_INFORMATION 8702
WriteX 8702 0 2048 2048
Close 8702
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 8703
ReadX 8703 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 8707
Close 8707
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 8708
QUERY_FILE_INFORMATION 8708
WriteX 8708 2047 1 1
QUERY_FILE_INFORMATION 8708
WriteX 8708 0 2048 2048
Close 8708
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 8709
ReadX 8709 0 511 511
ReadX 8693 384 2048 2048
ReadX 8693 768 16384 16384
ReadX 8693 1792 14336 14336
Close 8709
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 8710
ReadX 8710 0 511 511
Close 8710
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 8712
Close 8712
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 8703 4095 1 1
QUERY_FILE_INFORMATION 8703
WriteX 8703 2048 2048 2048
WriteX 8703 0 88 88
Close 8703
WriteX 8693 1152 2048 2048
WriteX 8693 1408 6144 6144
WriteX 8693 1920 2048 2048
WriteX 8693 0 88 88
Close 8693
WriteX 8694 0 88 88
Close 8694
WriteX 8695 0 88 88
Close 8695
Close 8696
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 8713
ReadX 8713 0 511 511
ReadX 8713 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8713
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8714
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8714 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8715
ReadX 8715 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8716
ReadX 8716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8717
ReadX 8717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8718
ReadX 8718 0 53 53
ReadX 8718 53 28 28
ReadX 8718 81 28 28
ReadX 8718 109 28 28
ReadX 8718 137 28 28
ReadX 8718 165 28 28
ReadX 8718 193 28 28
ReadX 8718 221 28 28
ReadX 8718 249 4 4
ReadX 8718 253 4 4
ReadX 8718 257 4 4
ReadX 8718 261 28 28
ReadX 8718 289 2 2
ReadX 8718 291 2 2
ReadX 8718 293 2 2
Close 8718
ReadX 8714 2048 2048 2048
Close 8714
Close 8715
Close 8716
Close 8717
Close 8692
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 8719
QUERY_FILE_INFORMATION 8719
Close 8719
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8720
Close 8720
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8721
ReadX 8721 0 511 511
ReadX 8721 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8722
ReadX 8722 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8723
ReadX 8723 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8724
ReadX 8724 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8725
ReadX 8725 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8726
ReadX 8726 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8727
ReadX 8727 0 53 53
ReadX 8727 53 2 2
ReadX 8727 55 2 2
ReadX 8727 57 184 184
ReadX 8727 241 298 298
Close 8727
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8728
ReadX 8728 0 41 41
ReadX 8721 2048 2048 2048
Close 8728
Close 8721
Close 8722
Close 8725
Close 8726
Close 8723
Close 8724
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8729
ReadX 8729 0 511 511
ReadX 8729 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8730
ReadX 8730 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8731
ReadX 8731 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8732
ReadX 8732 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8733
ReadX 8733 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8734
ReadX 8734 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8735
ReadX 8735 0 53 53
ReadX 8735 53 2 2
ReadX 8735 55 2 2
ReadX 8735 57 184 184
ReadX 8735 241 298 298
Close 8735
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8736
ReadX 8736 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8737
ReadX 8737 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8738
ReadX 8738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8739
ReadX 8739 0 511 511
ReadX 8738 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8740
ReadX 8740 0 53 53
ReadX 8740 53 2 2
ReadX 8740 55 480 480
ReadX 8740 535 2 2
Close 8740
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8741
ReadX 8741 0 41 41
ReadX 8729 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 8745
FIND_FIRST \clients\client1\~dmtmp\*
Close 8745
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 8746
QUERY_FILE_INFORMATION 8746
WriteX 8746 2047 1 1
QUERY_FILE_INFORMATION 8746
WriteX 8746 0 2048 2048
Close 8746
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 8747
ReadX 8747 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 8747
Close 8736
Close 8737
Close 8738
Close 8739
Close 8741
Close 8729
Close 8730
Close 8733
Close 8734
Close 8731
Close 8732
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 8748
ReadX 8748 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8749
Close 8749
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8750
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8750 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8751
ReadX 8751 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8752
ReadX 8752 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8753
ReadX 8753 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8754
ReadX 8754 0 53 53
ReadX 8754 53 2 2
ReadX 8754 55 480 480
ReadX 8754 535 2 2
Close 8754
ReadX 8750 2048 2048 2048
Close 8750
Close 8751
Close 8752
Close 8753
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8755
ReadX 8755 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8756
ReadX 8756 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8757
ReadX 8757 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8758
ReadX 8758 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8759
ReadX 8759 0 53 53
ReadX 8759 53 2 2
ReadX 8759 55 480 480
ReadX 8759 535 2 2
Close 8759
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8760
ReadX 8760 0 511 511
ReadX 8760 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8761
ReadX 8761 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8762
ReadX 8762 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8763
ReadX 8763 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8764
ReadX 8764 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8765
ReadX 8765 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8766
ReadX 8766 0 41 41
ReadX 8760 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8767
ReadX 8767 0 53 53
ReadX 8767 53 2 2
ReadX 8767 55 2 2
ReadX 8767 57 184 184
ReadX 8767 241 298 298
Close 8767
ReadX 8755 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 8771
FIND_FIRST \clients\client1\~dmtmp\*
Close 8771
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 8772
QUERY_FILE_INFORMATION 8772
WriteX 8772 2047 1 1
QUERY_FILE_INFORMATION 8772
WriteX 8772 0 2048 2048
Close 8772
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 8773
ReadX 8773 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 8773
Close 8766
Close 8760
Close 8761
Close 8764
Close 8765
Close 8762
Close 8763
Close 8755
Close 8756
Close 8757
Close 8758
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 8774
ReadX 8774 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 8748 4095 1 1
QUERY_FILE_INFORMATION 8748
WriteX 8748 2048 2048 2048
QUERY_FILE_INFORMATION 8748
Flush 8748
WriteX 8748 0 88 88
WriteX 8774 4095 1 1
QUERY_FILE_INFORMATION 8774
WriteX 8774 2048 2048 2048
QUERY_FILE_INFORMATION 8774
Flush 8774
WriteX 8774 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8775
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8775 0 511 511
ReadX 8775 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8776
ReadX 8776 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8777
ReadX 8777 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8778
ReadX 8778 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8779
ReadX 8779 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8780
ReadX 8780 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8781
ReadX 8781 0 53 53
ReadX 8781 53 2 2
ReadX 8781 55 2 2
ReadX 8781 57 184 184
ReadX 8781 241 298 298
Close 8781
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8782
ReadX 8782 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8783
ReadX 8783 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8784
ReadX 8784 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8785
ReadX 8785 0 511 511
ReadX 8784 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8786
ReadX 8786 0 53 53
ReadX 8786 53 2 2
ReadX 8786 55 480 480
ReadX 8786 535 2 2
Close 8786
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8787
ReadX 8787 0 41 41
ReadX 8775 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8788
ReadX 8788 0 53 53
ReadX 8788 53 2 2
ReadX 8788 55 480 480
ReadX 8788 535 2 2
Close 8788
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8789
ReadX 8789 0 53 53
ReadX 8789 53 2 2
ReadX 8789 55 2 2
ReadX 8789 57 184 184
ReadX 8789 241 298 298
Close 8789
ReadX 8782 2048 2048 2048
ReadX 8783 2048 2048 2048
ReadX 8782 320 16384 16384
ReadX 8782 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 8790
FIND_FIRST \clients\client1\~dmtmp\*
Close 8790
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 8791
QUERY_FILE_INFORMATION 8791
WriteX 8791 4095 1 1
QUERY_FILE_INFORMATION 8791
WriteX 8791 0 4096 4096
Close 8791
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 8792
ReadX 8792 0 41 41
Close 8782
Close 8783
Close 8784
Close 8785
Close 8787
Close 8775
Close 8776
Close 8779
Close 8780
Close 8777
Close 8778
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 8793
Close 8793
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 8794
QUERY_FILE_INFORMATION 8794
WriteX 8794 4095 1 1
QUERY_FILE_INFORMATION 8794
WriteX 8794 0 4096 4096
Close 8794
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 8795
ReadX 8795 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 8792
ReadX 8792 0 4096 4096
WriteX 8795 0 4096 4096
Close 8795
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 8797
ReadX 8797 0 41 41
Close 8792
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 8797
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 8798
Close 8798
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 8799
ReadX 8799 0 41 41
Close 8799
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 8800
Close 8800
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8801
QUERY_FILE_INFORMATION 8801
WriteX 8801 2047 1 1
QUERY_FILE_INFORMATION 8801
WriteX 8801 0 2048 2048
Close 8801
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8802
ReadX 8802 0 511 511
ReadX 8802 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 8803
ReadX 8803 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8803
Close 8802
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8804
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8804 0 511 511
ReadX 8804 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8805
ReadX 8805 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8806
ReadX 8806 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8807
ReadX 8807 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8808
ReadX 8808 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8809
ReadX 8809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8810
ReadX 8810 0 53 53
ReadX 8810 53 2 2
ReadX 8810 55 2 2
ReadX 8810 57 184 184
ReadX 8810 241 298 298
Close 8810
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8811
ReadX 8811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8812
ReadX 8812 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8813
ReadX 8813 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8814
ReadX 8814 0 511 511
ReadX 8813 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8815
ReadX 8815 0 53 53
ReadX 8815 53 2 2
ReadX 8815 55 480 480
ReadX 8815 535 2 2
Close 8815
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8816
ReadX 8816 0 41 41
ReadX 8804 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8817
ReadX 8817 0 53 53
ReadX 8817 53 2 2
ReadX 8817 55 480 480
ReadX 8817 535 2 2
Close 8817
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8818
ReadX 8818 0 53 53
ReadX 8818 53 2 2
ReadX 8818 55 2 2
ReadX 8818 57 184 184
ReadX 8818 241 298 298
Close 8818
ReadX 8811 2048 2048 2048
Close 8811
Close 8812
Close 8813
Close 8814
Close 8816
Close 8804
Close 8805
Close 8808
Close 8809
Close 8806
Close 8807
Close 8748
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 8819
QUERY_FILE_INFORMATION 8819
Close 8819
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 8774
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 8820
QUERY_FILE_INFORMATION 8820
Close 8820
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8821
Close 8821
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8822
ReadX 8822 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8823
ReadX 8823 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8824
ReadX 8824 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8825
ReadX 8825 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8826
ReadX 8826 0 53 53
ReadX 8826 53 2 2
ReadX 8826 55 480 480
ReadX 8826 535 2 2
Close 8826
ReadX 8822 2048 2048 2048
Close 8822
Close 8823
Close 8824
Close 8825
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8827
ReadX 8827 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8828
ReadX 8828 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8829
ReadX 8829 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8830
ReadX 8830 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8831
ReadX 8831 0 53 53
ReadX 8831 53 2 2
ReadX 8831 55 480 480
ReadX 8831 535 2 2
Close 8831
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8832
ReadX 8832 0 511 511
ReadX 8832 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8833
ReadX 8833 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8834
ReadX 8834 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8835
ReadX 8835 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8836
ReadX 8836 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8837
ReadX 8837 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8838
ReadX 8838 0 41 41
ReadX 8832 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8839
ReadX 8839 0 53 53
ReadX 8839 53 2 2
ReadX 8839 55 2 2
ReadX 8839 57 184 184
ReadX 8839 241 298 298
Close 8839
ReadX 8827 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 8843
FIND_FIRST \clients\client1\~dmtmp\*
Close 8843
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 8844
QUERY_FILE_INFORMATION 8844
WriteX 8844 2047 1 1
QUERY_FILE_INFORMATION 8844
WriteX 8844 0 2048 2048
Close 8844
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 8845
ReadX 8845 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 8845
Close 8838
Close 8832
Close 8833
Close 8836
Close 8837
Close 8834
Close 8835
Close 8827
Close 8828
Close 8829
Close 8830
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 8846
ReadX 8846 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8847
Close 8847
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8848
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8848 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8849
ReadX 8849 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8850
ReadX 8850 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8851
ReadX 8851 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8852
ReadX 8852 0 53 53
ReadX 8852 53 28 28
ReadX 8852 81 28 28
ReadX 8852 109 28 28
ReadX 8852 137 28 28
ReadX 8852 165 28 28
ReadX 8852 193 28 28
ReadX 8852 221 28 28
ReadX 8852 249 4 4
ReadX 8852 253 4 4
ReadX 8852 257 4 4
ReadX 8852 261 28 28
ReadX 8852 289 2 2
ReadX 8852 291 2 2
ReadX 8852 293 2 2
Close 8852
ReadX 8848 2048 2048 2048
Close 8848
Close 8849
Close 8850
Close 8851
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8853
ReadX 8853 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8854
ReadX 8854 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8855
ReadX 8855 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8856
ReadX 8856 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8857
ReadX 8857 0 53 53
ReadX 8857 53 28 28
ReadX 8857 81 28 28
ReadX 8857 109 28 28
ReadX 8857 137 28 28
ReadX 8857 165 28 28
ReadX 8857 193 28 28
ReadX 8857 221 28 28
ReadX 8857 249 4 4
ReadX 8857 253 4 4
ReadX 8857 257 4 4
ReadX 8857 261 28 28
ReadX 8857 289 2 2
ReadX 8857 291 2 2
ReadX 8857 293 2 2
Close 8857
ReadX 8853 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 8861
FIND_FIRST \clients\client1\~dmtmp\*
Close 8861
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 8862
QUERY_FILE_INFORMATION 8862
WriteX 8862 2047 1 1
QUERY_FILE_INFORMATION 8862
WriteX 8862 0 2048 2048
Close 8862
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 8863
ReadX 8863 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 8863
Close 8853
Close 8854
Close 8855
Close 8856
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 8864
ReadX 8864 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8865
Close 8865
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8866
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8866 0 511 511
ReadX 8866 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8867
ReadX 8867 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8868
ReadX 8868 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8869
ReadX 8869 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8870
ReadX 8870 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8871
ReadX 8871 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8872
ReadX 8872 0 53 53
ReadX 8872 53 2 2
ReadX 8872 55 2 2
ReadX 8872 57 184 184
ReadX 8872 241 298 298
Close 8872
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8873
ReadX 8873 0 41 41
ReadX 8866 2048 2048 2048
Close 8873
Close 8866
Close 8867
Close 8870
Close 8871
Close 8868
Close 8869
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8874
ReadX 8874 0 511 511
ReadX 8874 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8875
ReadX 8875 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8876
ReadX 8876 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8877
ReadX 8877 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8878
ReadX 8878 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8879
ReadX 8879 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8880
ReadX 8880 0 53 53
ReadX 8880 53 2 2
ReadX 8880 55 2 2
ReadX 8880 57 184 184
ReadX 8880 241 298 298
Close 8880
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8881
ReadX 8881 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8882
ReadX 8882 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8883
ReadX 8883 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8884
ReadX 8884 0 511 511
ReadX 8883 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8885
ReadX 8885 0 53 53
ReadX 8885 53 2 2
ReadX 8885 55 480 480
ReadX 8885 535 2 2
Close 8885
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8886
ReadX 8886 0 41 41
ReadX 8874 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 8890
FIND_FIRST \clients\client1\~dmtmp\*
Close 8890
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8891
QUERY_FILE_INFORMATION 8891
WriteX 8891 2047 1 1
QUERY_FILE_INFORMATION 8891
WriteX 8891 0 2048 2048
Close 8891
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8892
ReadX 8892 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 8892
Close 8881
Close 8882
Close 8883
Close 8884
Close 8886
Close 8874
Close 8875
Close 8878
Close 8879
Close 8876
Close 8877
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8893
ReadX 8893 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 8846 4095 1 1
QUERY_FILE_INFORMATION 8846
WriteX 8846 2048 2048 2048
QUERY_FILE_INFORMATION 8846
Flush 8846
WriteX 8846 0 88 88
WriteX 8864 4095 1 1
QUERY_FILE_INFORMATION 8864
WriteX 8864 2048 2048 2048
QUERY_FILE_INFORMATION 8864
Flush 8864
WriteX 8864 0 88 88
WriteX 8893 4095 1 1
QUERY_FILE_INFORMATION 8893
WriteX 8893 2048 2048 2048
QUERY_FILE_INFORMATION 8893
Flush 8893
WriteX 8893 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8894
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8894 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8895
ReadX 8895 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8896
ReadX 8896 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8897
ReadX 8897 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8898
ReadX 8898 0 53 53
ReadX 8898 53 2 2
ReadX 8898 55 480 480
ReadX 8898 535 2 2
Close 8898
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8899
ReadX 8899 0 511 511
ReadX 8899 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8900
ReadX 8900 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8901
ReadX 8901 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8902
ReadX 8902 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8903
ReadX 8903 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8904
ReadX 8904 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8905
ReadX 8905 0 41 41
ReadX 8899 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8906
ReadX 8906 0 53 53
ReadX 8906 53 2 2
ReadX 8906 55 2 2
ReadX 8906 57 184 184
ReadX 8906 241 298 298
Close 8906
ReadX 8894 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8907
ReadX 8907 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8908
ReadX 8908 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8909
ReadX 8909 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8910
ReadX 8910 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8911
ReadX 8911 0 53 53
ReadX 8911 53 28 28
ReadX 8911 81 28 28
ReadX 8911 109 28 28
ReadX 8911 137 28 28
ReadX 8911 165 28 28
ReadX 8911 193 28 28
ReadX 8911 221 28 28
ReadX 8911 249 4 4
ReadX 8911 253 4 4
ReadX 8911 257 4 4
ReadX 8911 261 28 28
ReadX 8911 289 2 2
ReadX 8911 291 2 2
ReadX 8911 293 2 2
Close 8911
ReadX 8907 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8912
ReadX 8912 0 53 53
ReadX 8912 53 2 2
ReadX 8912 55 2 2
ReadX 8912 57 184 184
ReadX 8912 241 298 298
Close 8912
ReadX 8896 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8913
ReadX 8913 0 53 53
ReadX 8913 53 2 2
ReadX 8913 55 480 480
ReadX 8913 535 2 2
Close 8913
ReadX 8907 4096 16384 16384
ReadX 8907 1280 16384 16384
ReadX 8907 2304 6144 6144
ReadX 8907 2688 2048 2048
ReadX 8894 4096 16384 16384
ReadX 8894 1280 16384 16384
ReadX 8894 2304 16384 16384
ReadX 8894 3328 16384 16384
ReadX 8894 272 16384 16384
ReadX 8894 336 16384 16384
ReadX 8894 400 16384 16384
ReadX 8894 464 16384 16384
ReadX 8894 528 16384 16384
ReadX 8894 592 16384 16384
ReadX 8894 656 16384 16384
ReadX 8894 720 16384 16384
ReadX 8894 784 16384 16384
ReadX 8894 848 16384 16384
ReadX 8894 912 16384 16384
ReadX 8900 2048 2048 2048
ReadX 8899 760 2048 2048
ReadX 8899 1144 2048 2048
ReadX 8899 408 2048 2048
ReadX 8899 912 2048 2048
ReadX 8899 1096 2048 2048
ReadX 8899 776 2048 2048
ReadX 8899 560 2048 2048
ReadX 8899 376 2048 2048
ReadX 8899 320 2048 2048
ReadX 8899 3072 2048 2048
ReadX 8899 784 2048 2048
ReadX 8899 2176 2048 2048
ReadX 8899 792 2048 2048
ReadX 8899 576 2048 2048
ReadX 8899 600 2048 2048
ReadX 8899 728 2048 2048
ReadX 8899 1112 2048 2048
ReadX 8899 664 2048 2048
ReadX 8899 976 2048 2048
ReadX 8899 3840 2048 2048
ReadX 8899 296 2048 2048
ReadX 8899 480 2048 2048
ReadX 8899 680 2048 2048
ReadX 8899 696 2048 2048
ReadX 8899 832 2048 2048
ReadX 8899 1016 2048 2048
ReadX 8899 1104 2048 2048
ReadX 8899 3200 2048 2048
ReadX 8899 264 2048 2048
ReadX 8899 448 2048 2048
ReadX 8899 648 2048 2048
ReadX 8899 1136 2048 2048
ReadX 8899 288 2048 2048
ReadX 8899 352 2048 2048
ReadX 8899 536 2048 2048
ReadX 8899 800 2048 2048
ReadX 8899 736 2048 2048
ReadX 8899 392 2048 2048
ReadX 8899 752 2048 2048
ReadX 8899 880 2048 2048
ReadX 8899 1064 2048 2048
ReadX 8899 1128 2048 2048
ReadX 8899 1536 2048 2048
ReadX 8899 2432 2048 2048
ReadX 8899 688 2048 2048
ReadX 8899 872 2048 2048
ReadX 8899 1072 2048 2048
ReadX 8899 984 2048 2048
ReadX 8899 704 2048 2048
ReadX 8899 3328 2048 2048
ReadX 8899 888 2048 2048
ReadX 8899 496 2048 2048
ReadX 8899 624 2048 2048
ReadX 8899 808 2048 2048
ReadX 8899 1008 2048 2048
ReadX 8899 1152 2048 2048
ReadX 8899 416 2048 2048
ReadX 8899 584 2048 2048
ReadX 8899 384 2048 2048
ReadX 8899 568 2048 2048
ReadX 8899 512 2048 2048
ReadX 8899 1408 2048 2048
ReadX 8899 472 2048 2048
ReadX 8899 672 2048 2048
ReadX 8899 2560 2048 2048
ReadX 8899 544 2048 2048
ReadX 8899 920 2048 2048
ReadX 8899 1120 2048 2048
ReadX 8899 2304 2048 2048
ReadX 8899 1080 2048 2048
ReadX 8899 1664 2048 2048
ReadX 8899 608 2048 2048
ReadX 8899 2688 2048 2048
ReadX 8899 3712 2048 2048
ReadX 8899 616 2048 2048
ReadX 8899 632 2048 2048
ReadX 8899 944 2048 2048
ReadX 8899 856 2048 2048
ReadX 8899 768 2048 2048
ReadX 8899 720 2048 2048
ReadX 8899 640 2048 2048
ReadX 8899 1048 2048 2048
ReadX 8899 1040 2048 2048
ReadX 8899 1032 2048 2048
ReadX 8899 1000 2048 2048
ReadX 8899 992 2048 2048
ReadX 8899 968 2048 2048
ReadX 8899 952 2048 2048
ReadX 8899 1056 2048 2048
ReadX 8899 816 2048 2048
ReadX 8899 864 2048 2048
ReadX 8899 2816 2048 2048
ReadX 8899 640 2048 2048
ReadX 8899 1024 2048 2048
ReadX 8899 504 2048 2048
ReadX 8899 424 2048 2048
ReadX 8899 840 2048 2048
ReadX 8899 896 2048 2048
ReadX 8899 520 2048 2048
ReadX 8899 960 2048 2048
ReadX 8899 552 2048 2048
ReadX 8899 488 2048 2048
ReadX 8899 824 2048 2048
ReadX 8899 304 2048 2048
ReadX 8899 768 2048 2048
ReadX 8899 712 2048 2048
ReadX 8899 512 2048 2048
ReadX 8899 432 2048 2048
ReadX 8899 384 2048 2048
ReadX 8899 2944 2048 2048
ReadX 8899 1088 2048 2048
ReadX 8899 928 2048 2048
ReadX 8899 280 2048 2048
ReadX 8899 744 2048 2048
ReadX 8899 3968 2048 2048
ReadX 8899 336 2048 2048
ReadX 8899 592 2048 2048
ReadX 8899 312 2048 2048
ReadX 8899 400 2048 2048
ReadX 8899 904 2048 2048
ReadX 8899 464 2048 2048
ReadX 8899 3456 2048 2048
ReadX 8899 848 2048 2048
ReadX 8899 936 2048 2048
ReadX 8899 656 2048 2048
ReadX 8899 344 2048 2048
ReadX 8899 440 2048 2048
ReadX 8899 4096 2048 2048
ReadX 8899 528 2048 2048
ReadX 8899 2048 2048 2048
ReadX 8899 1024 2048 2048
ReadX 8899 456 2048 2048
ReadX 8899 1792 2048 2048
ReadX 8899 1152 2048 2048
ReadX 8899 3584 2048 2048
ReadX 8899 1920 2048 2048
ReadX 8899 1280 2048 2048
ReadX 8899 896 2048 2048
ReadX 8899 328 2048 2048
Close 8907
Close 8908
Close 8909
Close 8910
Close 8905
Close 8899
Close 8900
Close 8903
Close 8904
Close 8901
Close 8902
Close 8894
Close 8895
Close 8896
Close 8897
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8914
FIND_FIRST \clients\client1\~dmtmp\*
Close 8914
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8915
QUERY_FILE_INFORMATION 8915
WriteX 8915 0 2048 2048
WriteX 8915 18431 1 1
QUERY_FILE_INFORMATION 8915
WriteX 8915 2048 16384 16384
WriteX 8915 1152 16384 16384
WriteX 8915 2176 16384 16384
WriteX 8915 3200 16384 16384
WriteX 8915 264 16384 16384
WriteX 8915 328 16384 16384
WriteX 8915 392 16384 16384
WriteX 8915 456 16384 16384
WriteX 8915 520 16384 16384
WriteX 8915 584 16384 16384
WriteX 8915 648 16384 16384
WriteX 8915 712 16384 16384
WriteX 8915 776 16384 16384
WriteX 8915 840 16384 16384
WriteX 8915 904 16384 16384
WriteX 8915 968 16384 16384
WriteX 8915 1032 16384 16384
WriteX 8915 1096 16384 16384
WriteX 8915 1160 16384 16384
WriteX 8915 1224 16384 16384
WriteX 8915 1288 16384 16384
WriteX 8915 1352 16384 16384
WriteX 8915 1416 16384 16384
WriteX 8915 1480 16384 16384
WriteX 8915 1544 16384 16384
WriteX 8915 1608 16384 16384
WriteX 8915 1672 16384 16384
WriteX 8915 1736 16384 16384
WriteX 8915 1800 16384 16384
WriteX 8915 1864 16384 16384
WriteX 8915 1928 16384 16384
WriteX 8915 1992 16384 16384
WriteX 8915 2056 16384 16384
WriteX 8915 2120 16384 16384
WriteX 8915 2184 16384 16384
WriteX 8915 2248 16384 16384
WriteX 8915 2312 16384 16384
WriteX 8915 2376 16384 16384
WriteX 8915 2440 16384 16384
WriteX 8915 0 88 88
Close 8915
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8916
ReadX 8916 0 511 511
ReadX 8916 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 8916
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8917
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8917 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8918
ReadX 8918 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8919
ReadX 8919 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8920
ReadX 8920 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8921
ReadX 8921 0 53 53
ReadX 8921 53 2 2
ReadX 8921 55 480 480
ReadX 8921 535 2 2
Close 8921
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8922
ReadX 8922 0 511 511
ReadX 8922 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8923
ReadX 8923 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8924
ReadX 8924 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8925
ReadX 8925 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8926
ReadX 8926 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8927
ReadX 8927 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8928
ReadX 8928 0 41 41
ReadX 8922 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8929
ReadX 8929 0 53 53
ReadX 8929 53 2 2
ReadX 8929 55 2 2
ReadX 8929 57 184 184
ReadX 8929 241 298 298
Close 8929
ReadX 8917 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8930
ReadX 8930 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8931
ReadX 8931 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8932
ReadX 8932 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8933
ReadX 8933 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8934
ReadX 8934 0 53 53
ReadX 8934 53 28 28
ReadX 8934 81 28 28
ReadX 8934 109 28 28
ReadX 8934 137 28 28
ReadX 8934 165 28 28
ReadX 8934 193 28 28
ReadX 8934 221 28 28
ReadX 8934 249 4 4
ReadX 8934 253 4 4
ReadX 8934 257 4 4
ReadX 8934 261 28 28
ReadX 8934 289 2 2
ReadX 8934 291 2 2
ReadX 8934 293 2 2
Close 8934
ReadX 8930 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8935
ReadX 8935 0 53 53
ReadX 8935 53 2 2
ReadX 8935 55 2 2
ReadX 8935 57 184 184
ReadX 8935 241 298 298
Close 8935
ReadX 8919 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8936
ReadX 8936 0 53 53
ReadX 8936 53 2 2
ReadX 8936 55 480 480
ReadX 8936 535 2 2
Close 8936
Close 8930
Close 8931
Close 8932
Close 8933
Close 8928
Close 8922
Close 8923
Close 8926
Close 8927
Close 8924
Close 8925
Close 8917
Close 8918
Close 8919
Close 8920
Close 8846
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 8937
QUERY_FILE_INFORMATION 8937
Close 8937
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 8864
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 8938
QUERY_FILE_INFORMATION 8938
Close 8938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 8893
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 8939
QUERY_FILE_INFORMATION 8939
Close 8939
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8940
Close 8940
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8941
ReadX 8941 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8942
ReadX 8942 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8943
ReadX 8943 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8944
ReadX 8944 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8945
ReadX 8945 0 53 53
ReadX 8945 53 28 28
ReadX 8945 81 28 28
ReadX 8945 109 28 28
ReadX 8945 137 28 28
ReadX 8945 165 28 28
ReadX 8945 193 28 28
ReadX 8945 221 28 28
ReadX 8945 249 4 4
ReadX 8945 253 4 4
ReadX 8945 257 4 4
ReadX 8945 261 28 28
ReadX 8945 289 2 2
ReadX 8945 291 2 2
ReadX 8945 293 2 2
Close 8945
ReadX 8941 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 8941 384 2048 2048
ReadX 8941 768 16384 16384
ReadX 8941 1792 14336 14336
ReadX 8944 2048 2048 2048
ReadX 8943 2048 2048 2048
WriteX 8941 1152 2048 2048
WriteX 8944 2048 2048 2048
WriteX 8943 2048 2048 2048
WriteX 8941 0 88 88
WriteX 8942 0 88 88
WriteX 8943 0 88 88
WriteX 8944 0 88 88
Close 8941
Close 8942
Close 8943
Close 8944
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8946
Close 8946
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8947
ReadX 8947 0 511 511
ReadX 8947 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8948
ReadX 8948 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8949
ReadX 8949 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8950
ReadX 8950 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8951
ReadX 8951 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8952
ReadX 8952 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8953
ReadX 8953 0 53 53
ReadX 8953 53 2 2
ReadX 8953 55 2 2
ReadX 8953 57 184 184
ReadX 8953 241 298 298
Close 8953
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8954
ReadX 8954 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8955
ReadX 8955 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8956
ReadX 8956 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8957
ReadX 8957 0 511 511
ReadX 8956 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8958
ReadX 8958 0 53 53
ReadX 8958 53 2 2
ReadX 8958 55 480 480
ReadX 8958 535 2 2
Close 8958
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8959
ReadX 8959 0 41 41
ReadX 8947 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 8960
QUERY_FILE_INFORMATION 8960
QUERY_FILE_INFORMATION 8960
ReadX 8960 0 8192 8192
Close 8960
ReadX 8947 1152 2048 2048
ReadX 8947 4096 16384 16384
Close 8954
Close 8955
Close 8956
Close 8957
Close 8959
Close 8947
Close 8948
Close 8951
Close 8952
Close 8949
Close 8950
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8961
Close 8961
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8962
QUERY_FILE_INFORMATION 8962
ReadX 8962 0 64 64
ReadX 8962 144 64 64
ReadX 8962 224 156 156
ReadX 8962 1193 128 128
ReadX 8962 1201 128 128
ReadX 8962 1072 4 4
ReadX 8962 1076 1925 1925
ReadX 8962 758 4 4
ReadX 8962 762 4557 4557
ReadX 8962 1052 4 4
ReadX 8962 1056 314 314
ReadX 8962 1056 11056 11056
Close 8962
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8963
ReadX 8963 0 511 511
ReadX 8963 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8964
ReadX 8964 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8965
ReadX 8965 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8966
ReadX 8966 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8967
ReadX 8967 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8968
ReadX 8968 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8969
ReadX 8969 0 53 53
ReadX 8969 53 2 2
ReadX 8969 55 2 2
ReadX 8969 57 184 184
ReadX 8969 241 298 298
Close 8969
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8970
ReadX 8970 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8971
ReadX 8971 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8972
ReadX 8972 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8973
ReadX 8973 0 511 511
ReadX 8972 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8974
ReadX 8974 0 53 53
ReadX 8974 53 2 2
ReadX 8974 55 480 480
ReadX 8974 535 2 2
Close 8974
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8975
ReadX 8975 0 41 41
ReadX 8963 2048 2048 2048
ReadX 8964 2048 2048 2048
ReadX 8963 1144 2048 2048
ReadX 8963 1152 2048 2048
ReadX 8963 4096 16384 16384
WriteX 8963 2048 2048 2048
WriteX 8964 2048 2048 2048
WriteX 8963 0 88 88
WriteX 8964 0 88 88
Close 8970
Close 8971
Close 8972
Close 8973
Close 8975
Close 8963
Close 8964
Close 8967
Close 8968
Close 8965
Close 8966
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 8976
Close 8976
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 8977
QUERY_FILE_INFORMATION 8977
ReadX 8977 0 64 64
ReadX 8977 144 64 64
ReadX 8977 224 84 84
ReadX 8977 478 16 16
ReadX 8977 1056 6176 6176
Close 8977
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8978
ReadX 8978 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8979
ReadX 8979 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 8980
ReadX 8980 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8981
ReadX 8981 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 8982
ReadX 8982 0 53 53
ReadX 8982 53 28 28
ReadX 8982 81 28 28
ReadX 8982 109 28 28
ReadX 8982 137 28 28
ReadX 8982 165 28 28
ReadX 8982 193 28 28
ReadX 8982 221 28 28
ReadX 8982 249 4 4
ReadX 8982 253 4 4
ReadX 8982 257 4 4
ReadX 8982 261 28 28
ReadX 8982 289 2 2
ReadX 8982 291 2 2
ReadX 8982 293 2 2
Close 8982
ReadX 8978 2048 2048 2048
ReadX 8979 2048 2048 2048
ReadX 8978 1280 2048 2048
ReadX 8981 2048 2048 2048
ReadX 8980 2048 2048 2048
WriteX 8978 1280 2048 2048
WriteX 8981 2048 2048 2048
WriteX 8980 2048 2048 2048
WriteX 8979 2048 2048 2048
WriteX 8978 0 88 88
WriteX 8979 0 88 88
WriteX 8980 0 88 88
WriteX 8981 0 88 88
WriteX 8978 1280 2048 2048
WriteX 8981 2048 2048 2048
WriteX 8980 2048 2048 2048
WriteX 8979 2048 2048 2048
WriteX 8978 0 88 88
WriteX 8979 0 88 88
WriteX 8980 0 88 88
WriteX 8981 0 88 88
WriteX 8978 1280 2048 2048
WriteX 8981 2048 2048 2048
WriteX 8980 2048 2048 2048
WriteX 8979 2048 2048 2048
WriteX 8978 0 88 88
WriteX 8979 0 88 88
WriteX 8980 0 88 88
WriteX 8981 0 88 88
Close 8978
Close 8979
Close 8980
Close 8981
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8983
ReadX 8983 0 511 511
ReadX 8983 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 8984
ReadX 8984 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 8985
ReadX 8985 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 8986
ReadX 8986 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 8987
ReadX 8987 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 8988
ReadX 8988 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 8989
ReadX 8989 0 53 53
ReadX 8989 53 2 2
ReadX 8989 55 2 2
ReadX 8989 57 184 184
ReadX 8989 241 298 298
Close 8989
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8990
ReadX 8990 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8991
ReadX 8991 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 8992
ReadX 8992 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 8993
ReadX 8993 0 511 511
ReadX 8992 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 8994
ReadX 8994 0 53 53
ReadX 8994 53 2 2
ReadX 8994 55 480 480
ReadX 8994 535 2 2
Close 8994
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8995
ReadX 8995 0 41 41
ReadX 8983 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 8999
FIND_FIRST \clients\client1\~dmtmp\*
Close 8999
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9000
QUERY_FILE_INFORMATION 9000
WriteX 9000 2047 1 1
QUERY_FILE_INFORMATION 9000
WriteX 9000 0 2048 2048
Close 9000
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9001
ReadX 9001 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 9001 4095 1 1
QUERY_FILE_INFORMATION 9001
WriteX 9001 2048 2048 2048
WriteX 9001 0 88 88
Close 9001
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9002
ReadX 9002 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 9002 2048 2048 2048
Close 8990
Close 8991
Close 8992
Close 8993
Close 8995
Close 8983
Close 8984
Close 8987
Close 8988
Close 8985
Close 8986
WriteX 9002 2048 2048 2048
WriteX 9002 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9003
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9003 0 511 511
ReadX 9003 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9004
ReadX 9004 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9005
ReadX 9005 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9006
ReadX 9006 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9007
ReadX 9007 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9008
ReadX 9008 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9009
ReadX 9009 0 53 53
ReadX 9009 53 2 2
ReadX 9009 55 2 2
ReadX 9009 57 184 184
ReadX 9009 241 298 298
Close 9009
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9010
ReadX 9010 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9011
ReadX 9011 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9012
ReadX 9012 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9013
ReadX 9013 0 511 511
ReadX 9012 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9014
ReadX 9014 0 53 53
ReadX 9014 53 2 2
ReadX 9014 55 480 480
ReadX 9014 535 2 2
Close 9014
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9015
ReadX 9015 0 41 41
ReadX 9003 2048 2048 2048
ReadX 9003 1152 2048 2048
ReadX 9003 4096 16384 16384
ReadX 9003 1280 16384 16384
ReadX 9003 2304 16384 16384
ReadX 9003 3328 16384 16384
ReadX 9003 272 16384 16384
ReadX 9003 336 16384 16384
ReadX 9003 400 16384 16384
ReadX 9003 464 16384 16384
ReadX 9003 528 16384 16384
ReadX 9003 592 16384 16384
ReadX 9003 656 16384 16384
ReadX 9003 720 16384 16384
ReadX 9003 784 16384 16384
ReadX 9003 848 16384 16384
ReadX 9003 912 16384 16384
ReadX 9003 976 16384 16384
ReadX 9003 1040 16384 16384
ReadX 9003 1104 12288 12288
Close 9010
Close 9011
Close 9012
Close 9013
Close 9015
Close 9003
Close 9004
Close 9007
Close 9008
Close 9005
Close 9006
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9016
FIND_FIRST \clients\client1\~dmtmp\*
Close 9016
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9017
QUERY_FILE_INFORMATION 9017
WriteX 9017 0 2048 2048
WriteX 9017 2048 4096 4096
WriteX 9017 0 88 88
Close 9017
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9018
ReadX 9018 0 511 511
ReadX 9018 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9018
WriteX 9002 2048 2048 2048
WriteX 9002 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9019
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9019 0 511 511
ReadX 9019 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9020
ReadX 9020 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9021
ReadX 9021 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9022
ReadX 9022 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9023
ReadX 9023 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9024
ReadX 9024 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9025
ReadX 9025 0 53 53
ReadX 9025 53 2 2
ReadX 9025 55 2 2
ReadX 9025 57 184 184
ReadX 9025 241 298 298
Close 9025
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9026
ReadX 9026 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9027
ReadX 9027 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9028
ReadX 9028 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9029
ReadX 9029 0 511 511
ReadX 9028 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9030
ReadX 9030 0 53 53
ReadX 9030 53 2 2
ReadX 9030 55 480 480
ReadX 9030 535 2 2
Close 9030
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9031
ReadX 9031 0 41 41
ReadX 9019 2048 2048 2048
ReadX 9019 1152 2048 2048
ReadX 9019 4096 16384 16384
ReadX 9019 1280 16384 16384
ReadX 9019 2304 16384 16384
ReadX 9019 3328 16384 16384
ReadX 9019 272 16384 16384
ReadX 9019 336 16384 16384
ReadX 9019 400 16384 16384
ReadX 9019 464 16384 16384
ReadX 9019 528 16384 16384
ReadX 9019 592 16384 16384
ReadX 9019 656 16384 16384
ReadX 9019 720 16384 16384
ReadX 9019 784 16384 16384
ReadX 9019 848 16384 16384
ReadX 9019 912 16384 16384
ReadX 9019 976 16384 16384
ReadX 9019 1040 16384 16384
ReadX 9019 1104 12288 12288
Close 9026
Close 9027
Close 9028
Close 9029
Close 9031
Close 9019
Close 9020
Close 9023
Close 9024
Close 9021
Close 9022
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9032
FIND_FIRST \clients\client1\~dmtmp\*
Close 9032
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9033
QUERY_FILE_INFORMATION 9033
WriteX 9033 0 2048 2048
WriteX 9033 2048 4096 4096
WriteX 9033 0 88 88
Close 9033
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9034
ReadX 9034 0 511 511
ReadX 9034 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9034
Close 9002
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9035
QUERY_FILE_INFORMATION 9035
Close 9035
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9036
Close 9036
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9037
QUERY_FILE_INFORMATION 9037
ReadX 9037 0 64 64
ReadX 9037 144 64 64
ReadX 9037 224 156 156
ReadX 9037 1193 128 128
ReadX 9037 1201 128 128
ReadX 9037 1072 4 4
ReadX 9037 1076 1925 1925
ReadX 9037 758 4 4
ReadX 9037 762 4557 4557
ReadX 9037 1052 4 4
ReadX 9037 1056 314 314
ReadX 9037 1056 11056 11056
Close 9037
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9038
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9038 0 511 511
ReadX 9038 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9039
ReadX 9039 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9040
ReadX 9040 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9041
ReadX 9041 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9042
ReadX 9042 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9043
ReadX 9043 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9044
ReadX 9044 0 53 53
ReadX 9044 53 2 2
ReadX 9044 55 2 2
ReadX 9044 57 184 184
ReadX 9044 241 298 298
Close 9044
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9045
ReadX 9045 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9046
ReadX 9046 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9047
ReadX 9047 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9048
ReadX 9048 0 511 511
ReadX 9047 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9049
ReadX 9049 0 53 53
ReadX 9049 53 2 2
ReadX 9049 55 480 480
ReadX 9049 535 2 2
Close 9049
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9050
ReadX 9050 0 41 41
ReadX 9038 2048 2048 2048
ReadX 9038 1152 2048 2048
ReadX 9038 4096 16384 16384
Close 9045
Close 9046
Close 9047
Close 9048
Close 9050
Close 9038
Close 9039
Close 9042
Close 9043
Close 9040
Close 9041
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9051
ReadX 9051 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9052
ReadX 9052 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9053
ReadX 9053 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9054
ReadX 9054 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9055
ReadX 9055 0 53 53
ReadX 9055 53 2 2
ReadX 9055 55 480 480
ReadX 9055 535 2 2
Close 9055
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9056
ReadX 9056 0 511 511
ReadX 9056 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9057
ReadX 9057 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9058
ReadX 9058 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9059
ReadX 9059 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9060
ReadX 9060 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9061
ReadX 9061 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9062
ReadX 9062 0 41 41
ReadX 9056 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9063
ReadX 9063 0 53 53
ReadX 9063 53 2 2
ReadX 9063 55 2 2
ReadX 9063 57 184 184
ReadX 9063 241 298 298
Close 9063
ReadX 9051 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 9067
FIND_FIRST \clients\client1\~dmtmp\*
Close 9067
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9068
QUERY_FILE_INFORMATION 9068
WriteX 9068 2047 1 1
QUERY_FILE_INFORMATION 9068
WriteX 9068 0 2048 2048
Close 9068
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9069
ReadX 9069 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 9069 4095 1 1
QUERY_FILE_INFORMATION 9069
WriteX 9069 2048 2048 2048
WriteX 9069 0 88 88
Close 9069
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9070
ReadX 9070 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 9070 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 9074
Close 9074
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9075
QUERY_FILE_INFORMATION 9075
WriteX 9075 2047 1 1
QUERY_FILE_INFORMATION 9075
WriteX 9075 0 2048 2048
Close 9075
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9076
ReadX 9076 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 9076 4095 1 1
QUERY_FILE_INFORMATION 9076
WriteX 9076 2048 2048 2048
WriteX 9076 0 88 88
Close 9076
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9077
ReadX 9077 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 9077 2048 2048 2048
Close 9062
Close 9056
Close 9057
Close 9060
Close 9061
Close 9058
Close 9059
Close 9051
Close 9052
Close 9053
Close 9054
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9078
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9078 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9079
ReadX 9079 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9080
ReadX 9080 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9081
ReadX 9081 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9082
ReadX 9082 0 53 53
ReadX 9082 53 2 2
ReadX 9082 55 480 480
ReadX 9082 535 2 2
Close 9082
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9083
ReadX 9083 0 511 511
ReadX 9083 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9084
ReadX 9084 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9085
ReadX 9085 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9086
ReadX 9086 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9087
ReadX 9087 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9088
ReadX 9088 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9089
ReadX 9089 0 41 41
ReadX 9083 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9090
ReadX 9090 0 53 53
ReadX 9090 53 2 2
ReadX 9090 55 2 2
ReadX 9090 57 184 184
ReadX 9090 241 298 298
Close 9090
ReadX 9078 2048 2048 2048
ReadX 9078 384 16384 16384
ReadX 9078 1408 16384 16384
ReadX 9078 2560 16384 16384
ReadX 9078 3584 16384 16384
ReadX 9078 288 16384 16384
ReadX 9078 352 16384 16384
ReadX 9078 416 16384 16384
ReadX 9078 480 16384 16384
ReadX 9078 552 16384 16384
ReadX 9078 616 16384 16384
ReadX 9078 680 16384 16384
ReadX 9078 744 16384 16384
ReadX 9078 808 16384 16384
ReadX 9078 872 16384 16384
ReadX 9078 936 10240 10240
Close 9089
Close 9083
Close 9084
Close 9087
Close 9088
Close 9085
Close 9086
Close 9078
Close 9079
Close 9080
Close 9081
Close 9070
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9091
QUERY_FILE_INFORMATION 9091
Close 9091
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 9077
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9092
QUERY_FILE_INFORMATION 9092
Close 9092
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9093
ReadX 9093 0 65471 65471
ReadX 9093 65471 63 63
ReadX 9093 65534 65471 65471
ReadX 9093 131005 63 63
ReadX 9093 131068 65471 65471
ReadX 9093 196539 63 63
ReadX 9093 196602 65471 65471
ReadX 9093 262073 63 63
ReadX 9093 262136 65471 65471
ReadX 9093 327607 63 63
ReadX 9093 327670 10 10
Close 9093
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9094
ReadX 9094 0 65471 65471
ReadX 9094 65471 63 63
ReadX 9094 65534 65471 65471
ReadX 9094 131005 63 63
ReadX 9094 131068 65471 65471
ReadX 9094 196539 63 63
ReadX 9094 196602 65471 65471
ReadX 9094 262073 63 63
ReadX 9094 262136 65471 65471
ReadX 9094 327607 63 63
ReadX 9094 327670 65471 65471
ReadX 9094 393141 63 63
ReadX 9094 393204 65471 65471
ReadX 9094 458675 63 63
ReadX 9094 458738 65471 65471
ReadX 9094 524209 63 63
ReadX 9094 524272 65471 65471
ReadX 9094 589743 63 63
ReadX 9094 589806 65471 65471
ReadX 9094 655277 63 63
ReadX 9094 655340 32 32
Close 9094
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9095
ReadX 9095 0 65471 65471
ReadX 9095 65471 63 63
ReadX 9095 65534 65471 65471
ReadX 9095 131005 63 63
ReadX 9095 131068 65471 65471
ReadX 9095 196539 63 63
ReadX 9095 196602 65471 65471
ReadX 9095 262073 63 63
ReadX 9095 262136 65471 65471
ReadX 9095 327607 63 63
ReadX 9095 327670 65471 65471
ReadX 9095 393141 63 63
ReadX 9095 393204 65471 65471
ReadX 9095 458675 63 63
ReadX 9095 458738 65471 65471
ReadX 9095 524209 63 63
ReadX 9095 524272 65471 65471
ReadX 9095 589743 63 63
ReadX 9095 589806 65471 65471
ReadX 9095 655277 63 63
ReadX 9095 655340 65471 65471
ReadX 9095 720811 63 63
ReadX 9095 720874 65471 65471
ReadX 9095 786345 63 63
ReadX 9095 786408 65471 65471
ReadX 9095 851879 63 63
ReadX 9095 851942 65471 65471
ReadX 9095 917413 63 63
ReadX 9095 917476 65471 65471
ReadX 9095 982947 63 63
ReadX 9095 983010 65471 65471
ReadX 9095 1048481 63 63
ReadX 9095 1048544 65471 65471
ReadX 9095 1114015 63 63
ReadX 9095 1114078 65471 65471
ReadX 9095 1179549 63 63
ReadX 9095 1179612 65471 65471
ReadX 9095 1245083 63 63
ReadX 9095 1245146 65471 65471
ReadX 9095 1310617 63 63
ReadX 9095 1310680 65471 65471
ReadX 9095 1376151 63 63
ReadX 9095 1376214 65471 65471
ReadX 9095 1441685 63 63
ReadX 9095 1441748 65471 65471
ReadX 9095 1507219 63 63
ReadX 9095 1507282 65471 65471
ReadX 9095 1572753 63 63
ReadX 9095 1572816 65471 65471
ReadX 9095 1638287 63 63
ReadX 9095 1638350 65471 65471
ReadX 9095 1703821 63 63
ReadX 9095 1703884 65471 65471
ReadX 9095 1769355 63 63
ReadX 9095 1769418 65471 65471
ReadX 9095 1834889 63 63
ReadX 9095 1834952 32824 32824
Close 9095
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 9096
QUERY_FILE_INFORMATION 9096
ReadX 9096 0 512 512
ReadX 9096 512 512 512
ReadX 9096 1024 512 512
QUERY_FILE_INFORMATION 9096
QUERY_FILE_INFORMATION 9096
ReadX 9096 2560 2048 2048
ReadX 9096 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 9097
WriteX 9097 52 1 1
QUERY_FILE_INFORMATION 9097
WriteX 9097 0 53 53
Close 9097
ReadX 9096 2208 650 650
ReadX 9096 1920 2048 2048
ReadX 9096 2112 2048 2048
ReadX 9096 1856 2048 2048
ReadX 9096 1824 2048 2048
ReadX 9096 1536 512 512
ReadX 9096 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 9098
Close 9098
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 9096 1568 512 512
ReadX 9096 1536 512 512
ReadX 9096 2176 384 384
ReadX 9096 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 9099
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 9096 288 2048 2048
ReadX 9096 2336 2048 2048
ReadX 9096 4384 2048 2048
ReadX 9096 6432 2048 2048
ReadX 9096 8480 2048 2048
ReadX 9096 10528 2048 2048
ReadX 9096 12576 2048 2048
WriteX 9099 15359 1 1
QUERY_FILE_INFORMATION 9099
ReadX 9096 14624 2048 2048
ReadX 9096 16672 2048 2048
ReadX 9096 18720 2048 2048
ReadX 9096 1728 2048 2048
WriteX 9099 0 15360 15360
Close 9099
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 9100
QUERY_FILE_INFORMATION 9100
ReadX 9100 0 512 512
ReadX 9100 2048 512 512
ReadX 9100 2560 512 512
QUERY_FILE_INFORMATION 9100
QUERY_FILE_INFORMATION 9100
QUERY_FILE_INFORMATION 9100
QUERY_FILE_INFORMATION 9100
QUERY_FILE_INFORMATION 9100
WriteX 9100 2152 384 384
QUERY_FILE_INFORMATION 9100
WriteX 9100 2150 22 22
WriteX 9100 2144 106 106
QUERY_FILE_INFORMATION 9100
WriteX 9100 2176 496 496
ReadX 9100 2176 496 496
QUERY_FILE_INFORMATION 9100
WriteX 9100 2440 384 384
QUERY_FILE_INFORMATION 9100
WriteX 9100 2152 384 384
WriteX 9100 2432 112 112
QUERY_FILE_INFORMATION 9100
WriteX 9100 2439 16 16
QUERY_FILE_INFORMATION 9100
WriteX 9100 2208 220 220
ReadX 9100 2208 220 220
QUERY_FILE_INFORMATION 9100
QUERY_FILE_INFORMATION 9100
WriteX 9100 2440 220 220
QUERY_FILE_INFORMATION 9100
WriteX 9100 2453 36 36
WriteX 9100 2080 512 512
WriteX 9100 2176 512 512
WriteX 9100 2112 512 512
WriteX 9100 2048 512 512
WriteX 9100 0 512 512
QUERY_FILE_INFORMATION 9096
QUERY_FILE_INFORMATION 9096
WriteX 9100 2080 512 512
Close 9100
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 9101
Close 9101
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 9102
QUERY_FILE_INFORMATION 9102
ReadX 9102 0 512 512
ReadX 9102 2048 512 512
ReadX 9102 2560 512 512
QUERY_FILE_INFORMATION 9102
QUERY_FILE_INFORMATION 9102
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 9103
Close 9103
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 9096
ReadX 9102 1408 512 512
ReadX 9102 2048 512 512
ReadX 9102 1536 512 512
ReadX 9102 2560 512 512
ReadX 9102 3072 512 512
ReadX 9102 3584 512 512
ReadX 9102 4096 512 512
ReadX 9102 4608 512 512
ReadX 9102 5120 512 512
ReadX 9102 5632 512 512
ReadX 9102 6144 512 512
ReadX 9102 6656 512 512
ReadX 9102 7168 512 512
ReadX 9102 7680 512 512
ReadX 9102 8192 512 512
ReadX 9102 8704 512 512
ReadX 9102 9216 512 512
ReadX 9102 9728 512 512
ReadX 9102 10240 512 512
ReadX 9102 10752 512 512
ReadX 9102 11264 512 512
ReadX 9102 11776 512 512
ReadX 9102 12288 512 512
ReadX 9102 12800 512 512
ReadX 9102 13312 512 512
ReadX 9102 13824 512 512
ReadX 9102 14336 512 512
ReadX 9102 14848 512 512
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 15360 512 0
ReadX 9102 2560 2048 2048
ReadX 9102 4608 2048 2048
ReadX 9102 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 9104
QUERY_FILE_INFORMATION 9104
ReadX 9104 0 512 512
ReadX 9104 512 512 512
ReadX 9104 1024 512 512
QUERY_FILE_INFORMATION 9104
QUERY_FILE_INFORMATION 9104
ReadX 9104 352 2048 2048
ReadX 9104 608 1097 1097
ReadX 9104 576 1609 1609
ReadX 9104 4096 512 512
ReadX 9104 1536 512 512
ReadX 9104 3840 256 256
ReadX 9104 288 576 576
ReadX 9104 512 512 512
ReadX 9104 480 512 512
ReadX 9104 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 9105
ReadX 9105 0 4096 4096
ReadX 9105 4096 4096 4096
ReadX 9105 8192 4096 4096
Close 9104
Close 9105
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 9106
WriteX 9106 15359 1 1
QUERY_FILE_INFORMATION 9106
WriteX 9106 0 15360 15360
Close 9106
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 9107
QUERY_FILE_INFORMATION 9107
ReadX 9107 0 512 512
ReadX 9107 2048 512 512
ReadX 9107 2560 512 512
QUERY_FILE_INFORMATION 9107
QUERY_FILE_INFORMATION 9107
QUERY_FILE_INFORMATION 9107
QUERY_FILE_INFORMATION 9107
QUERY_FILE_INFORMATION 9107
WriteX 9107 2152 384 384
QUERY_FILE_INFORMATION 9107
WriteX 9107 2150 22 22
WriteX 9107 2144 106 106
QUERY_FILE_INFORMATION 9107
WriteX 9107 2176 476 476
ReadX 9107 2176 476 476
QUERY_FILE_INFORMATION 9107
WriteX 9107 2440 384 384
QUERY_FILE_INFORMATION 9107
WriteX 9107 2152 384 384
WriteX 9107 2432 92 92
QUERY_FILE_INFORMATION 9107
WriteX 9107 2437 36 36
QUERY_FILE_INFORMATION 9107
WriteX 9107 2208 220 220
ReadX 9107 2208 220 220
QUERY_FILE_INFORMATION 9107
QUERY_FILE_INFORMATION 9107
WriteX 9107 2440 220 220
QUERY_FILE_INFORMATION 9107
WriteX 9107 2453 36 36
WriteX 9107 2080 512 512
WriteX 9107 2176 512 512
WriteX 9107 2112 512 512
WriteX 9107 2048 512 512
WriteX 9107 0 512 512
QUERY_FILE_INFORMATION 9102
QUERY_FILE_INFORMATION 9102
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 9102
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 9108
Close 9108
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 9109
QUERY_FILE_INFORMATION 9109
ReadX 9109 0 512 512
ReadX 9109 2048 512 512
ReadX 9109 2560 512 512
QUERY_FILE_INFORMATION 9109
QUERY_FILE_INFORMATION 9109
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 9110
Close 9110
WriteX 9107 2080 512 512
Close 9107
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 9111
Close 9111
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 9112
QUERY_FILE_INFORMATION 9112
ReadX 9112 0 512 512
ReadX 9112 2048 512 512
ReadX 9112 2560 512 512
QUERY_FILE_INFORMATION 9112
QUERY_FILE_INFORMATION 9112
ReadX 9112 1312 512 512
ReadX 9112 1536 512 512
ReadX 9112 2048 512 512
ReadX 9112 576 512 512
ReadX 9112 1088 512 512
ReadX 9112 1056 512 512
ReadX 9112 1120 512 512
ReadX 9112 1184 512 512
ReadX 9112 2560 2048 2048
ReadX 9112 4608 2048 2048
ReadX 9112 6656 2048 2048
ReadX 9112 8704 2048 2048
ReadX 9112 10752 2048 2048
ReadX 9112 12800 2048 2048
ReadX 9112 14848 2048 512
ReadX 9112 15360 1536 0
ReadX 9112 1088 2048 2048
ReadX 9112 3136 2048 2048
ReadX 9112 1665 5835 5835
ReadX 9112 1856 2048 2048
ReadX 9112 2112 512 512
ReadX 9112 2152 384 384
ReadX 9112 2432 92 92
ReadX 9112 2176 512 512
ReadX 9112 2440 220 220
QUERY_FILE_INFORMATION 9112
QUERY_FILE_INFORMATION 9112
ReadX 9112 2432 512 512
WriteX 9112 2272 512 512
ReadX 9112 2144 512 512
WriteX 9112 2304 512 512
WriteX 9112 2272 92 92
WriteX 9112 2208 512 512
WriteX 9112 2720 512 512
WriteX 9112 0 512 512
QUERY_FILE_INFORMATION 9112
QUERY_FILE_INFORMATION 9112
ReadX 9112 1312 4096 4096
ReadX 9112 5408 4096 4096
ReadX 9112 9504 3305 3305
ReadX 9112 512 4096 4096
QUERY_FILE_INFORMATION 9112
QUERY_FILE_INFORMATION 9112
QUERY_FILE_INFORMATION 9112
WriteX 9112 3132 50 50
WriteX 9112 3182 4096 4096
WriteX 9112 7278 4096 4096
WriteX 9112 15469 1 1
QUERY_FILE_INFORMATION 9112
WriteX 9112 11374 4096 4096
WriteX 9112 15470 3584 3584
WriteX 9112 2144 512 512
WriteX 9112 2336 4096 4096
WriteX 9112 6432 4096 4096
WriteX 9112 10528 4096 4096
WriteX 9112 14624 462 462
WriteX 9112 2048 512 512
WriteX 9112 2560 512 512
WriteX 9112 0 512 512
QUERY_FILE_INFORMATION 9112
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 9113
QUERY_FILE_INFORMATION 9113
ReadX 9113 0 512 512
ReadX 9113 1152 512 512
ReadX 9113 1664 512 512
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
ReadX 9113 512 2048 2048
ReadX 9113 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 9114
WriteX 9114 52 1 1
QUERY_FILE_INFORMATION 9114
WriteX 9114 0 53 53
Close 9114
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
ReadX 9113 1120 504 504
ReadX 9113 896 2048 2048
ReadX 9113 1056 1528 1528
ReadX 9113 864 2048 2048
ReadX 9113 832 2048 2048
ReadX 9113 736 2048 2048
ReadX 9113 1216 512 512
ReadX 9113 1256 384 384
ReadX 9113 1536 140 140
ReadX 9113 1280 512 512
ReadX 9113 1548 252 252
ReadX 9112 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 9115
Close 9115
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 9116
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 9113 2560 2048 2048
ReadX 9113 4608 2048 2048
ReadX 9113 6656 2048 2048
ReadX 9113 8704 2048 2048
ReadX 9113 10752 2048 2048
WriteX 9116 12005 1 1
QUERY_FILE_INFORMATION 9116
WriteX 9116 0 12006 12006
Close 9116
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 9117
QUERY_FILE_INFORMATION 9117
ReadX 9117 0 512 512
ReadX 9117 1152 512 512
ReadX 9117 1664 512 512
QUERY_FILE_INFORMATION 9117
QUERY_FILE_INFORMATION 9117
QUERY_FILE_INFORMATION 9117
QUERY_FILE_INFORMATION 9117
QUERY_FILE_INFORMATION 9117
QUERY_FILE_INFORMATION 9117
QUERY_FILE_INFORMATION 9117
WriteX 9117 1256 384 384
QUERY_FILE_INFORMATION 9117
WriteX 9117 1254 22 22
WriteX 9117 1248 106 106
QUERY_FILE_INFORMATION 9117
WriteX 9117 1280 508 508
ReadX 9117 1280 508 508
QUERY_FILE_INFORMATION 9117
WriteX 9117 1544 384 384
QUERY_FILE_INFORMATION 9117
WriteX 9117 1256 384 384
WriteX 9117 1536 124 124
QUERY_FILE_INFORMATION 9117
WriteX 9117 1543 4 4
QUERY_FILE_INFORMATION 9117
WriteX 9117 1312 252 252
ReadX 9117 1312 252 252
QUERY_FILE_INFORMATION 9117
QUERY_FILE_INFORMATION 9117
WriteX 9117 1544 252 252
QUERY_FILE_INFORMATION 9117
WriteX 9117 1559 4 4
WriteX 9117 1184 512 512
WriteX 9117 1280 512 512
WriteX 9117 1216 512 512
WriteX 9117 1152 512 512
WriteX 9117 0 512 512
QUERY_FILE_INFORMATION 9113
QUERY_FILE_INFORMATION 9113
WriteX 9117 1184 512 512
Close 9117
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 9118
Close 9118
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 9119
QUERY_FILE_INFORMATION 9119
ReadX 9119 0 512 512
ReadX 9119 1152 512 512
ReadX 9119 1664 512 512
QUERY_FILE_INFORMATION 9119
QUERY_FILE_INFORMATION 9119
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 9120
Close 9120
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 9113
ReadX 9119 736 512 512
ReadX 9119 1536 2048 2048
ReadX 9119 3584 2048 2048
ReadX 9119 5632 2048 2048
ReadX 9119 7680 2048 2048
ReadX 9119 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 9121
WriteX 9121 11990 1 1
QUERY_FILE_INFORMATION 9121
WriteX 9121 0 11991 11991
Close 9121
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 9122
QUERY_FILE_INFORMATION 9122
ReadX 9122 0 512 512
ReadX 9122 1184 512 512
ReadX 9122 1696 512 512
QUERY_FILE_INFORMATION 9122
QUERY_FILE_INFORMATION 9122
QUERY_FILE_INFORMATION 9122
QUERY_FILE_INFORMATION 9122
QUERY_FILE_INFORMATION 9122
QUERY_FILE_INFORMATION 9122
QUERY_FILE_INFORMATION 9122
WriteX 9122 1288 384 384
QUERY_FILE_INFORMATION 9122
WriteX 9122 1286 22 22
WriteX 9122 1280 106 106
QUERY_FILE_INFORMATION 9122
WriteX 9122 1312 508 508
ReadX 9122 1312 508 508
QUERY_FILE_INFORMATION 9122
WriteX 9122 1576 384 384
QUERY_FILE_INFORMATION 9122
WriteX 9122 1288 384 384
WriteX 9122 1568 124 124
QUERY_FILE_INFORMATION 9122
WriteX 9122 1575 4 4
QUERY_FILE_INFORMATION 9122
WriteX 9122 1344 252 252
ReadX 9122 1344 252 252
QUERY_FILE_INFORMATION 9122
QUERY_FILE_INFORMATION 9122
WriteX 9122 1576 252 252
QUERY_FILE_INFORMATION 9122
WriteX 9122 1591 4 4
WriteX 9122 1216 512 512
WriteX 9122 1312 512 512
WriteX 9122 1248 512 512
WriteX 9122 1184 512 512
WriteX 9122 0 512 512
QUERY_FILE_INFORMATION 9119
QUERY_FILE_INFORMATION 9119
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 9119
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 9123
Close 9123
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 9124
QUERY_FILE_INFORMATION 9124
ReadX 9124 0 512 512
ReadX 9124 1152 512 512
ReadX 9124 1664 512 512
QUERY_FILE_INFORMATION 9124
QUERY_FILE_INFORMATION 9124
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 9125
Close 9125
WriteX 9122 1216 512 512
Close 9122
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 9126
Close 9126
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 9127
QUERY_FILE_INFORMATION 9127
ReadX 9127 0 512 512
ReadX 9127 1184 512 512
ReadX 9127 1696 512 512
QUERY_FILE_INFORMATION 9127
QUERY_FILE_INFORMATION 9127
ReadX 9127 1536 512 512
ReadX 9127 736 512 512
ReadX 9127 2048 512 512
ReadX 9127 2560 512 512
ReadX 9127 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 9128
Close 9128
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 9127 914 3899 3899
ReadX 9127 1248 512 512
ReadX 9127 1288 384 384
ReadX 9127 1568 124 124
ReadX 9127 1312 512 512
ReadX 9127 1576 252 252
QUERY_FILE_INFORMATION 9127
QUERY_FILE_INFORMATION 9127
ReadX 9127 1568 512 512
WriteX 9127 1408 512 512
ReadX 9127 1280 512 512
WriteX 9127 1440 512 512
WriteX 9127 1408 124 124
WriteX 9127 1344 512 512
WriteX 9127 1856 512 512
WriteX 9127 0 512 512
QUERY_FILE_INFORMATION 9127
QUERY_FILE_INFORMATION 9127
ReadX 9127 544 4096 4096
ReadX 9127 4640 4096 4096
ReadX 9127 8736 1637 1637
ReadX 9127 512 4096 4096
QUERY_FILE_INFORMATION 9127
QUERY_FILE_INFORMATION 9127
WriteX 9127 1280 512 512
WriteX 9127 1472 3584 3584
WriteX 9127 5056 4096 4096
WriteX 9127 13247 1 1
QUERY_FILE_INFORMATION 9127
WriteX 9127 9152 4096 4096
WriteX 9127 13248 1736 1736
WriteX 9127 1184 512 512
WriteX 9127 1696 512 512
WriteX 9127 0 512 512
QUERY_FILE_INFORMATION 9127
ReadX 9127 1632 1024 1024
ReadX 9127 288 1024 1024
ReadX 9127 1312 2048 2048
ReadX 9127 3360 1024 1024
ReadX 9127 1696 1024 1024
ReadX 9127 2720 512 512
ReadX 9127 3232 512 512
ReadX 9127 3744 512 512
ReadX 9127 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 9127 2066 3998 3998
ReadX 9127 1448 384 384
ReadX 9127 1408 124 124
ReadX 9127 1416 252 252
QUERY_FILE_INFORMATION 9127
QUERY_FILE_INFORMATION 9127
ReadX 9127 1408 512 512
WriteX 9127 1536 512 512
ReadX 9127 1440 512 512
WriteX 9127 2048 512 512
WriteX 9127 1536 124 124
WriteX 9127 512 512 512
WriteX 9127 1024 512 512
WriteX 9127 0 512 512
QUERY_FILE_INFORMATION 9127
ReadX 9127 1696 4096 4096
ReadX 9127 5792 4096 4096
ReadX 9127 9888 1736 1736
ReadX 9127 1280 512 512
ReadX 9127 1472 3584 3584
QUERY_FILE_INFORMATION 9127
QUERY_FILE_INFORMATION 9127
WriteX 9127 3940 156 156
WriteX 9127 4096 512 512
WriteX 9127 544 3584 3584
WriteX 9127 4128 4096 4096
WriteX 9127 8224 3584 3584
WriteX 9127 1344 512 512
WriteX 9127 1856 1536 1536
WriteX 9127 2336 512 512
WriteX 9127 3584 356 356
WriteX 9127 2560 512 512
WriteX 9127 3072 512 512
WriteX 9127 0 512 512
QUERY_FILE_INFORMATION 9127
Close 9109
Close 9112
Close 9127
Close 9124
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 9129
Close 9129
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 9130
Close 9130
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9131
WriteX 9131 0 65471 65471
WriteX 9131 65471 63 63
WriteX 9131 65534 65471 65471
WriteX 9131 131005 63 63
Close 9131
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9132
WriteX 9132 0 65471 65471
WriteX 9132 65471 63 63
WriteX 9132 65534 65471 65471
WriteX 9132 131005 63 63
WriteX 9132 131068 65471 65471
WriteX 9132 196539 63 63
WriteX 9132 196602 65471 65471
WriteX 9132 262073 63 63
Close 9132
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9133
WriteX 9133 0 65471 65471
WriteX 9133 65471 63 63
WriteX 9133 65534 65471 65471
WriteX 9133 131005 63 63
WriteX 9133 131068 65471 65471
WriteX 9133 196539 63 63
WriteX 9133 196602 65471 65471
WriteX 9133 262073 63 63
WriteX 9133 262136 65471 65471
WriteX 9133 327607 63 63
WriteX 9133 327670 65471 65471
WriteX 9133 393141 63 63
WriteX 9133 393204 65471 65471
WriteX 9133 458675 63 63
WriteX 9133 458738 65471 65471
WriteX 9133 524209 63 63
Close 9133
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 9134
QUERY_FILE_INFORMATION 9134
QUERY_FILE_INFORMATION 9134
ReadX 9134 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 9135
Close 9135
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 9136
WriteX 9136 63 1 1
QUERY_FILE_INFORMATION 9136
WriteX 9136 0 64 64
ReadX 9134 992 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 344 2048 2048
ReadX 9134 1344 2048 2048
ReadX 9134 1352 2048 2048
ReadX 9134 1320 2048 2048
ReadX 9134 1360 2048 2048
ReadX 9134 1344 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2304 2048 2048
ReadX 9134 1472 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 1480 2048 2048
ReadX 9134 1488 2048 2048
ReadX 9134 1496 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 1504 2048 2048
ReadX 9134 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 1000 2048 2048
ReadX 9134 1416 2048 2048
ReadX 9134 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 9134 360 2048 2048
ReadX 9134 368 2048 2048
ReadX 9134 360 2048 2048
ReadX 9134 376 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 1232 2048 2048
ReadX 9134 2432 6144 6144
ReadX 9134 2376 2048 2048
ReadX 9134 2360 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 2376 2048 2048
ReadX 9134 2384 2048 2048
ReadX 9134 2368 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 1296 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 9134 0 2048 2048
ReadX 9134 2688 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 2688 2048 2048
WriteX 9134 2688 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 2688 2048 2048
ReadX 9134 2688 2048 2048
ReadX 9134 2688 2048 2048
WriteX 9134 2688 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 9134 2688 2048 2048
ReadX 9134 2688 2048 2048
WriteX 9134 2688 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 320 4096 4096
ReadX 9134 0 2048 2048
ReadX 9134 3584 2048 2048
ReadX 9134 3584 2048 2048
ReadX 9134 3584 2048 2048
ReadX 9134 0 2048 2048
WriteX 9134 3584 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2688 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 2688 2048 2048
ReadX 9134 2688 2048 2048
WriteX 9134 2688 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 3200 2048 2048
ReadX 9134 3200 2048 2048
ReadX 9134 3200 2048 2048
WriteX 9134 3200 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 3456 2048 2048
ReadX 9134 3456 2048 2048
ReadX 9134 3456 2048 2048
WriteX 9134 3456 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2496 2048 2048
ReadX 9134 2472 2048 2048
ReadX 9134 2456 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 2472 2048 2048
ReadX 9134 2480 2048 2048
ReadX 9134 2464 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 2488 2048 2048
ReadX 9134 2568 8192 8192
ReadX 9134 1000 2048 2048
ReadX 9134 328 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 2048 2048 2048
ReadX 9134 2560 2048 2048
ReadX 9134 920 2048 2048
WriteX 9134 2048 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 312 2048 2048
WriteX 9134 336 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 328 2048 2048
WriteX 9134 2560 2048 2048
WriteX 9134 3840 2048 2048
WriteX 9134 920 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2432 2048 2048
WriteX 9134 2432 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2456 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 328 2048 2048
ReadX 9134 2560 2048 2048
ReadX 9134 2048 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 336 2048 2048
ReadX 9134 920 2048 2048
WriteX 9134 1536 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 2048 2048 2048
WriteX 9134 2560 2048 2048
WriteX 9134 336 2048 2048
WriteX 9134 920 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2048 2048 2048
ReadX 9134 2432 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 2048 2048 2048
WriteX 9134 2432 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2456 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1536 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 336 2048 2048
ReadX 9134 920 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 1536 2048 2048
WriteX 9134 336 2048 2048
WriteX 9134 920 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2432 2048 2048
WriteX 9134 2432 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2456 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1536 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 336 2048 2048
ReadX 9134 920 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 1536 2048 2048
WriteX 9134 336 2048 2048
WriteX 9134 920 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2432 2048 2048
WriteX 9134 2432 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2456 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1536 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 336 2048 2048
ReadX 9134 920 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 1536 2048 2048
WriteX 9134 336 2048 2048
WriteX 9134 920 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2432 2048 2048
WriteX 9134 2432 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2456 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1536 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 336 2048 2048
ReadX 9134 920 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 1536 2048 2048
WriteX 9134 336 2048 2048
WriteX 9134 920 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2432 2048 2048
WriteX 9134 2432 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
Flush 9134
ReadX 9134 2456 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1536 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 336 2048 2048
ReadX 9134 920 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 1536 2048 2048
WriteX 9134 336 2048 2048
WriteX 9134 920 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2432 2048 2048
WriteX 9134 2432 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2624 6144 6144
ReadX 9134 2616 2048 2048
ReadX 9134 2688 2048 2048
ReadX 9134 2600 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 2616 2048 2048
ReadX 9134 2608 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 344 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 520 2048 2048
ReadX 9134 1392 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 400 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 536 2048 2048
ReadX 9134 824 2048 2048
ReadX 9134 832 2048 2048
ReadX 9134 384 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 408 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 552 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 824 2048 2048
ReadX 9134 840 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 768 2048 2048
ReadX 9134 2048 2048 2048
WriteX 9134 1415 1 1
WriteX 9134 352 2048 2048
WriteX 9134 1112 2048 2048
WriteX 9134 1400 2048 2048
WriteX 9134 1408 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 2048 2048 2048
WriteX 9134 768 2048 2048
WriteX 9134 344 2048 2048
WriteX 9134 1000 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 416 2048 2048
ReadX 9134 424 2048 2048
ReadX 9134 432 2048 2048
ReadX 9134 440 2048 2048
ReadX 9134 576 16384 16384
ReadX 9134 448 2048 2048
ReadX 9134 456 2048 2048
ReadX 9134 464 2048 2048
ReadX 9134 640 16384 16384
ReadX 9134 704 16384 16384
ReadX 9134 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 9134 848 2048 2048
ReadX 9134 560 2048 2048
ReadX 9134 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 2600 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 352 2048 2048
ReadX 9134 1928 8192 8192
ReadX 9134 528 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 824 2048 2048
ReadX 9134 0 2048 2048
Flush 9134
ReadX 9134 2600 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 352 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 824 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 856 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 392 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 472 2048 2048
ReadX 9134 480 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 488 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 928 2048 2048
ReadX 9134 936 2048 2048
ReadX 9134 976 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 392 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 952 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 528 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 528 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 816 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 9134 1336 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 528 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 528 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1240 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2200 4096 4096
ReadX 9134 2152 2048 2048
ReadX 9134 2160 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1312 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 1928 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 824 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1416 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 352 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 824 2048 2048
ReadX 9134 384 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 9134 352 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 768 2048 2048
ReadX 9134 2048 2048 2048
ReadX 9134 352 2048 2048
WriteX 9134 1551 1 1
WriteX 9134 1512 2048 2048
WriteX 9134 1520 2048 2048
WriteX 9134 1528 2048 2048
WriteX 9134 1544 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 2048 2048 2048
WriteX 9134 768 2048 2048
WriteX 9134 344 2048 2048
WriteX 9134 1000 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2048 2048 2048
WriteX 9134 2048 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 1000 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1240 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 344 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 384 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 768 2048 2048
WriteX 9134 1567 1 1
WriteX 9134 1552 2048 2048
WriteX 9134 1560 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 768 2048 2048
WriteX 9134 344 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 1328 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1240 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2200 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1240 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 344 2048 2048
ReadX 9134 384 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 2048 2048 2048
ReadX 9134 768 2048 2048
WriteX 9134 1583 1 1
WriteX 9134 1568 2048 2048
WriteX 9134 1576 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 2048 2048 2048
WriteX 9134 768 2048 2048
WriteX 9134 344 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 864 2048 2048
ReadX 9134 872 2048 2048
ReadX 9134 912 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 2688 2048 2048
ReadX 9134 1000 2048 2048
WriteX 9134 2688 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 2944 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 0 2048 2048
Flush 9134
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 2688 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 2688 2048 2048
WriteX 9134 2688 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 392 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 416 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 416 2048 2048
ReadX 9134 864 2048 2048
ReadX 9134 872 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 312 2048 2048
ReadX 9134 888 2048 2048
ReadX 9134 400 2048 2048
ReadX 9134 896 2048 2048
WriteX 9134 1584 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 400 2048 2048
WriteX 9134 416 2048 2048
WriteX 9134 864 2048 2048
WriteX 9134 872 2048 2048
WriteX 9134 888 2048 2048
WriteX 9134 896 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 584 2048 2048
ReadX 9134 392 2048 2048
WriteX 9134 392 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 1328 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 0 2048 2048
ReadX 9134 408 2048 2048
ReadX 9134 1328 2048 2048
ReadX 9134 864 2048 2048
ReadX 9134 912 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 3840 2048 2048
ReadX 9134 312 2048 2048
ReadX 9134 1584 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 408 2048 2048
WriteX 9134 912 2048 2048
WriteX 9134 1584 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 408 2048 2048
ReadX 9134 392 2048 2048
WriteX 9134 392 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 528 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 528 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 552 2048 2048
ReadX 9134 1336 2048 2048
WriteX 9134 552 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 0 2048 2048
ReadX 9134 552 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 2664 2048 2048
ReadX 9134 2648 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 2672 2048 2048
ReadX 9134 2656 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9134 528 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 1336 2048 2048
ReadX 9134 2680 2048 2048
ReadX 9134 2760 8192 8192
ReadX 9134 544 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 568 2048 2048
ReadX 9134 544 2048 2048
ReadX 9134 0 2048 2048
Flush 9134
ReadX 9134 2816 6144 6144
ReadX 9134 2760 2048 2048
ReadX 9134 2744 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 2752 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 528 2048 2048
ReadX 9134 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 9138
Close 9138
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 9140
WriteX 9140 4065 1 1
QUERY_FILE_INFORMATION 9140
WriteX 9140 0 62591 62591
Close 9140
ReadX 9134 0 2048 2048
ReadX 9134 2808 2048 2048
ReadX 9134 2792 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 2800 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 384 2048 2048
ReadX 9134 392 2048 2048
ReadX 9134 1384 2048 2048
ReadX 9134 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 9142
Close 9142
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 9144
WriteX 9144 4094 1 1
QUERY_FILE_INFORMATION 9144
WriteX 9144 0 10845 10845
Close 9144
ReadX 9134 1432 2048 2048
ReadX 9134 1304 2048 2048
ReadX 9134 1368 2048 2048
ReadX 9134 2304 2048 2048
ReadX 9134 1440 2048 2048
ReadX 9134 1424 2048 2048
ReadX 9134 1448 2048 2048
ReadX 9134 1456 2048 2048
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 9146
Close 9146
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 9148
ReadX 9134 0 2048 2048
WriteX 9148 4081 1 1
QUERY_FILE_INFORMATION 9148
WriteX 9148 0 30118 30118
Close 9148
ReadX 9134 1344 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1152 2048 2048
ReadX 9134 1152 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 1000 2048 2048
ReadX 9134 768 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 344 2048 2048
WriteX 9134 1000 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 1416 2048 2048
ReadX 9134 1416 2048 2048
ReadX 9134 344 2048 2048
ReadX 9134 896 2048 2048
WriteX 9134 1538 2 2
WriteX 9134 344 2048 2048
WriteX 9134 1416 2048 2048
WriteX 9134 1538 2 2
ReadX 9134 2048 2048 2048
WriteX 9134 2048 2048 2048
WriteX 9134 1538 2 2
Close 9134
Close 9136
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9149
ReadX 9149 0 65471 65471
ReadX 9149 65471 63 63
ReadX 9149 65534 65471 65471
ReadX 9149 131005 63 63
ReadX 9149 131068 65471 65471
ReadX 9149 196539 63 63
ReadX 9149 196602 65471 65471
ReadX 9149 262073 63 63
ReadX 9149 262136 65471 65471
ReadX 9149 327607 63 63
ReadX 9149 327670 10 10
Close 9149
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9150
ReadX 9150 0 65471 65471
ReadX 9150 65471 63 63
ReadX 9150 65534 65471 65471
ReadX 9150 131005 63 63
ReadX 9150 131068 65471 65471
ReadX 9150 196539 63 63
ReadX 9150 196602 65471 65471
ReadX 9150 262073 63 63
ReadX 9150 262136 65471 65471
ReadX 9150 327607 63 63
ReadX 9150 327670 65471 65471
ReadX 9150 393141 63 63
ReadX 9150 393204 65471 65471
ReadX 9150 458675 63 63
ReadX 9150 458738 65471 65471
ReadX 9150 524209 63 63
ReadX 9150 524272 65471 65471
ReadX 9150 589743 63 63
ReadX 9150 589806 65471 65471
ReadX 9150 655277 63 63
ReadX 9150 655340 32 32
Close 9150
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9151
ReadX 9151 0 65471 65471
ReadX 9151 65471 63 63
ReadX 9151 65534 65471 65471
ReadX 9151 131005 63 63
ReadX 9151 131068 65471 65471
ReadX 9151 196539 63 63
ReadX 9151 196602 65471 65471
ReadX 9151 262073 63 63
ReadX 9151 262136 65471 65471
ReadX 9151 327607 63 63
ReadX 9151 327670 65471 65471
ReadX 9151 393141 63 63
ReadX 9151 393204 65471 65471
ReadX 9151 458675 63 63
ReadX 9151 458738 65471 65471
ReadX 9151 524209 63 63
ReadX 9151 524272 65471 65471
ReadX 9151 589743 63 63
ReadX 9151 589806 65471 65471
ReadX 9151 655277 63 63
ReadX 9151 655340 65471 65471
ReadX 9151 720811 63 63
ReadX 9151 720874 65471 65471
ReadX 9151 786345 63 63
ReadX 9151 786408 65471 65471
ReadX 9151 851879 63 63
ReadX 9151 851942 65471 65471
ReadX 9151 917413 63 63
ReadX 9151 917476 65471 65471
ReadX 9151 982947 63 63
ReadX 9151 983010 65471 65471
ReadX 9151 1048481 63 63
ReadX 9151 1048544 65471 65471
ReadX 9151 1114015 63 63
ReadX 9151 1114078 65471 65471
ReadX 9151 1179549 63 63
ReadX 9151 1179612 65471 65471
ReadX 9151 1245083 63 63
ReadX 9151 1245146 65471 65471
ReadX 9151 1310617 63 63
ReadX 9151 1310680 65471 65471
ReadX 9151 1376151 63 63
ReadX 9151 1376214 65471 65471
ReadX 9151 1441685 63 63
ReadX 9151 1441748 65471 65471
ReadX 9151 1507219 63 63
ReadX 9151 1507282 65471 65471
ReadX 9151 1572753 63 63
ReadX 9151 1572816 65471 65471
ReadX 9151 1638287 63 63
ReadX 9151 1638350 65471 65471
ReadX 9151 1703821 63 63
ReadX 9151 1703884 65471 65471
ReadX 9151 1769355 63 63
ReadX 9151 1769418 65471 65471
ReadX 9151 1834889 63 63
ReadX 9151 1834952 32824 32824
Close 9151
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 9152
Close 9152
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 9153
ReadX 9153 0 24 24
Close 9153
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 9154
QUERY_FILE_INFORMATION 9154
ReadX 9154 0 512 512
ReadX 9154 464 512 512
ReadX 9154 498 512 512
ReadX 9154 472 512 512
ReadX 9154 466 512 512
ReadX 9154 978 512 512
ReadX 9154 497 57 57
Close 9154
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 9155
QUERY_FILE_INFORMATION 9155
ReadX 9155 0 512 512
ReadX 9155 464 512 512
ReadX 9155 498 512 512
ReadX 9155 472 512 512
ReadX 9155 462 512 512
ReadX 9155 468 512 512
ReadX 9155 466 512 512
QUERY_FILE_INFORMATION 9155
WriteX 9155 482 60 60
WriteX 9155 482 4 4
QUERY_FILE_INFORMATION 9155
WriteX 9155 482 11 11
ReadX 9155 497 57 57
ReadX 9155 497 57 57
ReadX 9155 368 4096 4096
ReadX 9155 460 512 512
ReadX 9155 512 4096 4096
ReadX 9155 4608 4096 4096
ReadX 9155 8704 4096 4096
ReadX 9155 12800 4096 4096
ReadX 9155 16896 4096 4096
ReadX 9155 20992 4096 4096
ReadX 9155 25088 4096 4096
ReadX 9155 29184 4096 4096
ReadX 9155 33280 4096 4096
ReadX 9155 37376 4096 4096
ReadX 9155 41472 4096 4096
ReadX 9155 45568 4096 4096
ReadX 9155 49664 4096 4096
ReadX 9155 53760 4096 4096
ReadX 9155 57856 4096 4096
ReadX 9155 61952 4096 4096
ReadX 9155 66048 4096 4096
ReadX 9155 70144 4096 4096
ReadX 9155 497 20 20
ReadX 9155 496 103 103
ReadX 9155 500 448 448
ReadX 9155 470 512 512
ReadX 9155 486 2692 2692
ReadX 9155 290 4096 4096
ReadX 9155 4386 4096 4096
ReadX 9155 8482 4096 4096
ReadX 9155 500 20 20
ReadX 9155 483 108 108
ReadX 9155 482 292 292
ReadX 9155 338 4096 4096
ReadX 9155 4434 3103 3103
ReadX 9155 384 28 28
ReadX 9155 412 20 20
ReadX 9155 432 8 8
ReadX 9155 440 136 136
ReadX 9155 576 8 8
ReadX 9155 584 4 4
ReadX 9155 588 4 4
ReadX 9155 592 39 39
ReadX 9155 384 4 4
ReadX 9155 388 4 4
ReadX 9155 392 23 23
ReadX 9155 385 4 4
ReadX 9155 389 4 4
ReadX 9155 393 12 12
ReadX 9155 405 4 4
ReadX 9155 409 4 4
ReadX 9155 413 1 1
ReadX 9155 385 4 4
ReadX 9155 389 4 4
ReadX 9155 393 1 1
ReadX 9155 385 4 4
ReadX 9155 389 4 4
ReadX 9155 393 12 12
ReadX 9155 405 4 4
ReadX 9155 409 4 4
ReadX 9155 413 2 2
ReadX 9155 385 4 4
ReadX 9155 389 4 4
ReadX 9155 393 25 25
ReadX 9155 385 4 4
ReadX 9155 389 8 8
ReadX 9155 397 4 4
ReadX 9155 401 8 8
ReadX 9155 409 4 4
ReadX 9155 413 8 8
ReadX 9155 421 4 4
ReadX 9155 425 8 8
ReadX 9155 433 4 4
ReadX 9155 437 4 4
ReadX 9155 441 4 4
ReadX 9155 445 4 4
ReadX 9155 449 4 4
ReadX 9155 453 4 4
ReadX 9155 457 4 4
ReadX 9155 461 4 4
ReadX 9155 465 10670 10670
ReadX 9155 428 4096 4096
WriteX 9155 498 512 512
WriteX 9155 472 512 512
WriteX 9155 462 512 512
WriteX 9155 468 512 512
Close 9155
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 9156
Close 9156
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 9157
QUERY_FILE_INFORMATION 9157
ReadX 9157 0 512 512
ReadX 9157 464 512 512
ReadX 9157 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 9158
Close 9158
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 9157
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 9160
WriteX 9160 4607 1 1
QUERY_FILE_INFORMATION 9160
WriteX 9160 0 65471 65471
WriteX 9160 65471 65 65
WriteX 9160 65536 19979 19979
Close 9160
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9161
QUERY_FILE_INFORMATION 9161
ReadX 9161 0 512 512
ReadX 9161 462 512 512
ReadX 9161 974 512 512
ReadX 9161 1486 512 512
ReadX 9161 460 512 512
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
WriteX 9161 470 448 448
QUERY_FILE_INFORMATION 9161
WriteX 9161 470 60 60
WriteX 9161 470 4 4
QUERY_FILE_INFORMATION 9161
WriteX 9161 470 11 11
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
WriteX 9161 464 512 512
WriteX 9161 976 512 512
WriteX 9161 1488 512 512
WriteX 9161 462 512 512
WriteX 9161 0 512 512
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
ReadX 9161 470 512 512
WriteX 9161 482 512 512
WriteX 9161 482 292 292
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
WriteX 9161 483 20 20
WriteX 9161 483 108 108
QUERY_FILE_INFORMATION 9161
WriteX 9161 484 448 448
QUERY_FILE_INFORMATION 9161
WriteX 9161 484 44 44
WriteX 9161 484 20 20
WriteX 9161 480 512 512
WriteX 9161 472 512 512
WriteX 9161 476 512 512
WriteX 9161 988 512 512
WriteX 9161 474 512 512
Flush 9161
WriteX 9161 0 512 512
Flush 9161
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
WriteX 9161 480 512 512
WriteX 9161 472 512 512
WriteX 9161 476 512 512
QUERY_FILE_INFORMATION 9161
WriteX 9161 496 320 320
QUERY_FILE_INFORMATION 9161
WriteX 9161 496 60 60
ReadX 9161 484 512 512
WriteX 9161 500 512 512
WriteX 9161 470 512 512
WriteX 9161 486 2692 2692
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
WriteX 9161 497 25 25
WriteX 9161 496 103 103
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
WriteX 9161 497 44 44
WriteX 9161 497 20 20
WriteX 9161 498 512 512
WriteX 9161 462 512 512
WriteX 9161 466 512 512
WriteX 9161 978 512 512
WriteX 9161 464 512 512
Flush 9161
WriteX 9161 0 512 512
Flush 9161
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
QUERY_FILE_INFORMATION 9161
WriteX 9161 497 7 7
WriteX 9161 497 57 57
WriteX 9161 498 512 512
WriteX 9161 472 512 512
WriteX 9161 462 512 512
WriteX 9161 466 512 512
WriteX 9161 978 512 512
Flush 9161
WriteX 9161 498 512 512
Flush 9161
Close 9161
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9162
QUERY_FILE_INFORMATION 9162
ReadX 9162 0 512 512
ReadX 9162 464 512 512
ReadX 9162 498 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 9163
ReadX 9163 0 20 20
ReadX 9163 14 40 40
ReadX 9163 54 64 64
ReadX 9163 118 1152 1152
Close 9163
Close 9162
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9164
Close 9164
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9165
ReadX 9165 0 24 24
Close 9165
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9166
QUERY_FILE_INFORMATION 9166
ReadX 9166 0 512 512
ReadX 9166 464 512 512
ReadX 9166 498 512 512
ReadX 9166 472 512 512
ReadX 9166 462 512 512
ReadX 9166 466 512 512
ReadX 9166 978 512 512
ReadX 9166 497 57 57
Close 9166
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9167
QUERY_FILE_INFORMATION 9167
ReadX 9167 0 512 512
ReadX 9167 464 512 512
ReadX 9167 498 512 512
ReadX 9167 472 512 512
ReadX 9167 468 512 512
ReadX 9167 462 512 512
ReadX 9167 466 512 512
QUERY_FILE_INFORMATION 9167
WriteX 9167 482 60 60
WriteX 9167 482 4 4
QUERY_FILE_INFORMATION 9167
WriteX 9167 482 11 11
WriteX 9167 498 512 512
WriteX 9167 472 512 512
WriteX 9167 462 512 512
WriteX 9167 466 512 512
WriteX 9167 978 512 512
Close 9167
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 9168
Close 9168
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 9169
Close 9169
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 9171
WriteX 9171 4607 1 1
QUERY_FILE_INFORMATION 9171
WriteX 9171 0 65471 65471
WriteX 9171 65471 65 65
WriteX 9171 65536 17654 17654
Close 9171
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9172
QUERY_FILE_INFORMATION 9172
ReadX 9172 0 512 512
ReadX 9172 474 512 512
ReadX 9172 986 512 512
ReadX 9172 1498 512 512
ReadX 9172 472 512 512
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
WriteX 9172 482 448 448
QUERY_FILE_INFORMATION 9172
WriteX 9172 482 60 60
WriteX 9172 482 4 4
QUERY_FILE_INFORMATION 9172
WriteX 9172 482 11 11
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
WriteX 9172 476 512 512
WriteX 9172 988 512 512
WriteX 9172 1500 512 512
WriteX 9172 474 512 512
WriteX 9172 0 512 512
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
ReadX 9172 482 512 512
WriteX 9172 494 512 512
WriteX 9172 494 292 292
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
WriteX 9172 495 20 20
WriteX 9172 495 108 108
QUERY_FILE_INFORMATION 9172
WriteX 9172 496 448 448
QUERY_FILE_INFORMATION 9172
WriteX 9172 496 44 44
WriteX 9172 496 20 20
WriteX 9172 492 512 512
WriteX 9172 484 512 512
WriteX 9172 488 512 512
WriteX 9172 1000 512 512
WriteX 9172 486 512 512
Flush 9172
WriteX 9172 0 512 512
Flush 9172
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
WriteX 9172 492 512 512
WriteX 9172 484 512 512
WriteX 9172 488 512 512
QUERY_FILE_INFORMATION 9172
WriteX 9172 508 320 320
QUERY_FILE_INFORMATION 9172
WriteX 9172 508 60 60
ReadX 9172 496 512 512
WriteX 9172 512 512 512
WriteX 9172 482 512 512
WriteX 9172 498 2692 2692
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
WriteX 9172 509 25 25
WriteX 9172 508 103 103
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
WriteX 9172 509 44 44
WriteX 9172 509 20 20
WriteX 9172 510 512 512
WriteX 9172 474 512 512
WriteX 9172 478 512 512
WriteX 9172 990 512 512
WriteX 9172 476 512 512
Flush 9172
WriteX 9172 0 512 512
Flush 9172
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
QUERY_FILE_INFORMATION 9172
WriteX 9172 509 7 7
WriteX 9172 509 57 57
WriteX 9172 510 512 512
WriteX 9172 484 512 512
WriteX 9172 474 512 512
WriteX 9172 478 512 512
WriteX 9172 990 512 512
Flush 9172
WriteX 9172 510 512 512
Flush 9172
Close 9172
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9173
Close 9173
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9174
QUERY_FILE_INFORMATION 9174
ReadX 9174 0 512 512
ReadX 9174 476 512 512
ReadX 9174 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 9175
Close 9175
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 9176
QUERY_FILE_INFORMATION 9176
ReadX 9176 0 512 512
ReadX 9176 512 512 512
ReadX 9176 770 512 512
ReadX 9176 1282 512 512
ReadX 9176 1794 512 512
ReadX 9176 2562 512 512
ReadX 9176 3586 512 512
ReadX 9176 3828 512 512
ReadX 9176 288 512 512
ReadX 9176 1024 512 512
ReadX 9176 954 512 512
ReadX 9176 295 512 512
ReadX 9176 320 512 512
ReadX 9176 322 512 512
ReadX 9176 834 512 512
ReadX 9176 1346 512 512
ReadX 9176 1858 512 512
ReadX 9176 323 512 512
ReadX 9176 835 512 512
ReadX 9176 1347 512 512
ReadX 9176 1859 512 512
ReadX 9176 2371 345 345
ReadX 9176 322 167 167
ReadX 9176 489 512 512
ReadX 9176 1001 512 512
ReadX 9176 1513 512 512
ReadX 9176 2025 512 512
ReadX 9176 2537 512 512
ReadX 9176 3049 512 512
ReadX 9176 3561 345 345
ReadX 9176 323 167 167
ReadX 9176 490 512 512
ReadX 9176 1002 512 512
ReadX 9176 1514 512 512
ReadX 9176 2026 512 512
ReadX 9176 2538 512 512
ReadX 9176 3050 512 512
ReadX 9176 3562 512 512
ReadX 9176 4074 512 512
ReadX 9176 4586 512 512
ReadX 9176 5098 512 512
ReadX 9176 5610 512 512
ReadX 9176 6122 512 512
ReadX 9176 6634 512 512
ReadX 9176 7146 512 512
ReadX 9176 7658 512 512
ReadX 9176 8170 512 512
ReadX 9176 8682 512 512
ReadX 9176 9194 512 512
ReadX 9176 9706 512 512
ReadX 9176 10218 512 512
ReadX 9176 10730 345 345
ReadX 9176 11075 512 512
ReadX 9176 11587 167 167
ReadX 9176 11754 512 512
ReadX 9176 12266 512 512
ReadX 9176 12778 512 512
ReadX 9176 13290 512 512
ReadX 9176 13802 512 512
ReadX 9176 14314 512 512
ReadX 9176 14826 512 512
ReadX 9176 15338 512 512
ReadX 9176 337 512 512
ReadX 9176 337 512 512
ReadX 9176 849 34 34
ReadX 9176 352 512 512
ReadX 9176 864 512 512
ReadX 9176 1376 512 512
ReadX 9176 1888 512 512
ReadX 9176 2400 512 512
ReadX 9176 2912 512 512
ReadX 9176 3424 512 512
ReadX 9176 3936 512 512
ReadX 9176 1632 512 512
ReadX 9176 2144 512 512
ReadX 9176 1682 512 512
ReadX 9176 258 512 512
ReadX 9176 360 144 144
ReadX 9176 2517 512 512
ReadX 9176 3029 512 512
ReadX 9176 1751 512 512
ReadX 9176 2263 512 512
ReadX 9176 2775 512 512
ReadX 9176 3287 512 512
ReadX 9176 3799 512 512
ReadX 9176 4311 512 512
ReadX 9176 4823 512 512
ReadX 9176 5335 512 512
ReadX 9176 5847 512 512
ReadX 9176 6359 512 512
ReadX 9176 6871 512 512
ReadX 9176 7383 512 512
ReadX 9176 7895 512 512
ReadX 9176 8407 512 512
ReadX 9176 8919 512 512
ReadX 9176 9431 512 512
ReadX 9176 9943 512 512
ReadX 9176 10455 512 512
ReadX 9176 10967 512 512
ReadX 9176 11479 512 512
ReadX 9176 2556 512 512
ReadX 9176 3068 512 512
ReadX 9176 3580 512 512
ReadX 9176 4092 512 512
ReadX 9176 4604 512 512
ReadX 9176 5116 512 512
ReadX 9176 5628 512 512
ReadX 9176 6140 512 512
ReadX 9176 6652 512 512
ReadX 9176 7164 512 512
ReadX 9176 7676 512 512
ReadX 9176 8188 512 512
ReadX 9176 8700 512 512
ReadX 9176 9212 512 512
ReadX 9176 9724 512 512
ReadX 9176 10236 512 512
ReadX 9176 10748 512 512
ReadX 9176 11260 512 512
ReadX 9176 11772 512 512
ReadX 9176 12284 512 512
ReadX 9176 12796 49 49
ReadX 9176 260 463 463
ReadX 9176 723 512 512
ReadX 9176 1235 512 512
ReadX 9176 1747 512 512
ReadX 9176 2259 512 512
ReadX 9176 2771 512 512
ReadX 9176 3283 512 512
ReadX 9176 3795 512 512
ReadX 9176 4307 512 512
ReadX 9176 4819 512 512
ReadX 9176 5331 512 512
ReadX 9176 5843 512 512
ReadX 9176 6355 512 512
ReadX 9176 6867 512 512
ReadX 9176 7379 512 512
ReadX 9176 7891 512 512
ReadX 9176 8403 512 512
ReadX 9176 8915 512 512
ReadX 9176 9427 512 512
ReadX 9176 9939 512 512
ReadX 9176 10451 512 512
ReadX 9176 10963 402 402
ReadX 9176 593 240 240
ReadX 9176 2048 272 272
ReadX 9176 2320 512 512
ReadX 9176 2832 512 512
ReadX 9176 3344 512 512
ReadX 9176 3856 512 512
ReadX 9176 4368 512 512
ReadX 9176 4880 512 512
ReadX 9176 5392 240 240
ReadX 9176 608 272 272
ReadX 9176 880 512 512
ReadX 9176 1392 512 512
ReadX 9176 1904 512 512
ReadX 9176 2416 512 512
ReadX 9176 2928 512 512
ReadX 9176 3440 512 512
ReadX 9176 3952 512 512
ReadX 9176 4464 512 512
ReadX 9176 4976 512 512
ReadX 9176 5488 512 512
ReadX 9176 6000 512 512
ReadX 9176 6512 512 512
ReadX 9176 7024 512 512
ReadX 9176 7536 512 512
ReadX 9176 8048 512 512
ReadX 9176 8560 512 512
ReadX 9176 9072 512 512
ReadX 9176 9584 512 512
ReadX 9176 10096 512 512
ReadX 9176 1683 512 512
ReadX 9176 514 512 512
ReadX 9176 620 512 512
ReadX 9176 770 512 512
ReadX 9176 1282 512 512
ReadX 9176 1794 512 512
ReadX 9176 2000 512 512
ReadX 9176 1434 512 512
ReadX 9176 2050 512 512
ReadX 9176 2118 512 512
ReadX 9176 1715 512 512
ReadX 9176 1024 512 512
ReadX 9176 954 512 512
ReadX 9176 1880 512 512
ReadX 9176 1286 512 512
ReadX 9176 1510 512 512
ReadX 9176 2562 512 512
ReadX 9176 2610 512 512
ReadX 9176 3586 512 512
ReadX 9176 3812 512 512
ReadX 9176 3828 512 512
ReadX 9176 4046 512 512
ReadX 9176 4066 512 512
ReadX 9176 1747 512 512
ReadX 9176 1026 512 512
ReadX 9176 1538 512 512
ReadX 9176 514 512 512
ReadX 9176 751 512 512
ReadX 9176 1263 512 512
ReadX 9176 620 512 512
ReadX 9176 1132 512 512
ReadX 9176 1644 512 512
ReadX 9176 2156 512 512
ReadX 9176 2668 512 512
ReadX 9176 3180 512 512
ReadX 9176 3692 512 512
ReadX 9176 4204 394 394
ReadX 9176 606 118 118
ReadX 9176 724 512 512
ReadX 9176 1236 512 512
ReadX 9176 1748 512 512
ReadX 9176 2260 512 512
ReadX 9176 2772 512 512
ReadX 9176 3284 512 512
ReadX 9176 3796 394 394
ReadX 9176 636 118 118
ReadX 9176 754 512 512
ReadX 9176 1266 512 512
ReadX 9176 1778 512 512
ReadX 9176 2290 512 512
ReadX 9176 2802 512 512
ReadX 9176 3314 512 512
ReadX 9176 3826 512 512
ReadX 9176 4338 512 512
ReadX 9176 4850 512 512
ReadX 9176 5362 512 512
ReadX 9176 5874 512 512
ReadX 9176 6386 512 512
ReadX 9176 6898 512 512
ReadX 9176 7410 512 512
ReadX 9176 7922 512 512
ReadX 9176 8434 512 512
ReadX 9176 8946 512 512
ReadX 9176 9458 512 512
ReadX 9176 9970 512 512
ReadX 9176 10482 512 512
ReadX 9176 723 512 512
ReadX 9176 1235 512 512
ReadX 9176 725 512 512
ReadX 9176 729 512 512
ReadX 9176 1241 512 512
ReadX 9176 1753 512 512
ReadX 9176 2265 512 512
ReadX 9176 2777 512 512
ReadX 9176 3289 512 512
ReadX 9176 3801 512 512
ReadX 9176 4313 512 512
ReadX 9176 4825 512 512
ReadX 9176 5337 512 512
ReadX 9176 5849 512 512
ReadX 9176 6361 512 512
ReadX 9176 755 512 512
ReadX 9176 1267 512 512
ReadX 9176 1779 512 512
ReadX 9176 2291 512 512
ReadX 9176 2803 512 512
ReadX 9176 3315 512 512
ReadX 9176 3827 512 512
ReadX 9176 4339 244 244
ReadX 9176 4583 512 512
ReadX 9176 5095 268 268
ReadX 9176 5363 512 512
ReadX 9176 5875 512 512
ReadX 9176 6387 512 512
ReadX 9176 6899 512 512
ReadX 9176 7411 512 512
ReadX 9176 7923 512 512
ReadX 9176 8435 512 512
ReadX 9176 8947 512 512
ReadX 9176 9459 512 512
ReadX 9176 9971 512 512
ReadX 9176 10483 512 512
ReadX 9176 10995 512 512
ReadX 9176 11507 512 512
ReadX 9176 12019 512 512
ReadX 9176 12531 512 512
ReadX 9176 13043 512 512
ReadX 9176 13555 512 512
ReadX 9176 14067 512 512
ReadX 9176 14579 512 512
ReadX 9176 15091 512 512
ReadX 9176 15603 342 342
ReadX 9176 725 512 512
ReadX 9176 2000 512 512
ReadX 9176 3918 512 512
ReadX 9176 727 512 512
ReadX 9176 258 512 512
ReadX 9176 376 512 512
ReadX 9176 1109 512 512
ReadX 9176 1028 512 512
ReadX 9176 1540 512 512
ReadX 9176 2052 512 512
ReadX 9176 2564 512 512
ReadX 9176 3076 512 512
ReadX 9176 3588 512 512
ReadX 9176 4100 512 512
ReadX 9176 4612 412 412
ReadX 9176 1012 100 100
ReadX 9176 1112 512 512
ReadX 9176 1624 512 512
ReadX 9176 2136 512 512
ReadX 9176 2648 512 512
ReadX 9176 3160 512 512
ReadX 9176 3672 512 512
ReadX 9176 4184 412 412
ReadX 9176 1044 100 100
ReadX 9176 1144 512 512
ReadX 9176 1656 512 512
ReadX 9176 2168 512 512
ReadX 9176 2680 512 512
ReadX 9176 3192 512 512
ReadX 9176 3704 512 512
ReadX 9176 4216 512 512
ReadX 9176 4728 512 512
ReadX 9176 5240 512 512
ReadX 9176 5752 512 512
ReadX 9176 6264 512 512
ReadX 9176 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 9176 7288 512 512
ReadX 9176 7800 512 512
ReadX 9176 8312 512 512
ReadX 9176 8824 512 512
ReadX 9176 9336 512 512
ReadX 9176 9848 512 512
ReadX 9176 10360 512 512
ReadX 9176 10872 512 512
ReadX 9176 11384 512 512
ReadX 9176 11896 512 512
ReadX 9176 12408 512 512
ReadX 9176 1088 512 512
ReadX 9176 1600 512 512
ReadX 9176 1090 512 512
ReadX 9176 1094 512 512
ReadX 9176 1606 512 512
ReadX 9176 2118 512 512
ReadX 9176 2630 512 512
ReadX 9176 3142 512 512
ReadX 9176 3654 512 512
ReadX 9176 4166 512 512
ReadX 9176 4678 512 512
ReadX 9176 1111 512 512
ReadX 9176 1623 512 512
ReadX 9176 2135 512 512
ReadX 9176 2647 512 512
ReadX 9176 3159 512 512
ReadX 9176 3671 512 512
ReadX 9176 4183 512 512
ReadX 9176 4695 512 512
ReadX 9176 5207 512 512
ReadX 9176 5719 512 512
ReadX 9176 6231 512 512
ReadX 9176 6743 512 512
ReadX 9176 7255 512 512
ReadX 9176 7767 512 512
ReadX 9176 8279 512 512
ReadX 9176 8791 512 512
ReadX 9176 9303 512 512
ReadX 9176 9815 512 512
ReadX 9176 10327 512 512
ReadX 9176 10839 512 512
ReadX 9176 11351 294 294
ReadX 9176 1091 512 512
ReadX 9176 970 512 512
ReadX 9176 1093 512 512
ReadX 9176 1434 512 512
ReadX 9176 2050 512 512
ReadX 9176 2158 512 512
ReadX 9176 2118 512 512
ReadX 9176 2630 512 512
ReadX 9176 3142 512 512
ReadX 9176 3654 512 512
ReadX 9176 4166 512 512
ReadX 9176 4678 512 512
ReadX 9176 5190 512 512
ReadX 9176 5702 382 382
ReadX 9176 2104 130 130
ReadX 9176 2234 512 512
ReadX 9176 2746 512 512
ReadX 9176 3258 512 512
ReadX 9176 3770 512 512
ReadX 9176 4282 512 512
ReadX 9176 4794 512 512
ReadX 9176 5306 382 382
ReadX 9176 2134 130 130
ReadX 9176 2264 512 512
ReadX 9176 2776 512 512
ReadX 9176 3288 512 512
ReadX 9176 3800 512 512
ReadX 9176 4312 512 512
ReadX 9176 4824 512 512
ReadX 9176 5336 512 512
ReadX 9176 2147 512 512
ReadX 9176 2149 512 512
ReadX 9176 2152 512 512
ReadX 9176 2664 512 512
ReadX 9176 3176 512 512
ReadX 9176 3688 512 512
ReadX 9176 2159 512 512
ReadX 9176 2671 512 512
ReadX 9176 3183 512 512
ReadX 9176 3695 512 512
ReadX 9176 4207 512 512
ReadX 9176 4719 512 512
ReadX 9176 5231 512 512
ReadX 9176 5743 512 512
ReadX 9176 6255 512 512
ReadX 9176 6767 512 512
ReadX 9176 7279 512 512
ReadX 9176 7791 512 512
ReadX 9176 8303 512 512
ReadX 9176 8815 512 512
ReadX 9176 9327 512 512
ReadX 9176 9839 512 512
ReadX 9176 10351 512 512
ReadX 9176 10863 512 512
ReadX 9176 11375 512 512
ReadX 9176 11887 512 512
ReadX 9176 12399 38 38
ReadX 9176 2149 512 512
ReadX 9176 1794 512 512
ReadX 9176 2016 512 512
ReadX 9176 2151 512 512
ReadX 9176 1918 512 512
ReadX 9176 1880 512 512
ReadX 9176 2392 512 512
ReadX 9176 2904 512 512
ReadX 9176 3416 512 512
ReadX 9176 3928 512 512
ReadX 9176 4440 512 512
ReadX 9176 4952 512 512
ReadX 9176 5464 416 416
ReadX 9176 1866 96 96
ReadX 9176 1962 512 512
ReadX 9176 2474 512 512
ReadX 9176 2986 512 512
ReadX 9176 3498 512 512
ReadX 9176 4010 512 512
ReadX 9176 4522 512 512
ReadX 9176 5034 416 416
ReadX 9176 1896 96 96
ReadX 9176 1992 512 512
ReadX 9176 2504 512 512
ReadX 9176 3016 512 512
ReadX 9176 3528 512 512
ReadX 9176 1903 512 512
ReadX 9176 1905 512 512
ReadX 9176 1908 512 512
ReadX 9176 2420 512 512
ReadX 9176 2932 512 512
ReadX 9176 3444 512 512
ReadX 9176 3956 512 512
ReadX 9176 1919 512 512
ReadX 9176 2431 512 512
ReadX 9176 2943 512 512
ReadX 9176 3455 512 512
ReadX 9176 3967 512 512
ReadX 9176 4479 512 512
ReadX 9176 4991 512 512
ReadX 9176 5503 512 512
ReadX 9176 6015 512 512
ReadX 9176 6527 512 512
ReadX 9176 7039 512 512
ReadX 9176 7551 512 512
ReadX 9176 8063 512 512
ReadX 9176 8575 512 512
ReadX 9176 9087 512 512
ReadX 9176 9599 512 512
ReadX 9176 10111 512 512
ReadX 9176 10623 512 512
ReadX 9176 11135 512 512
ReadX 9176 11647 512 512
ReadX 9176 12159 322 322
ReadX 9176 1905 512 512
ReadX 9176 1846 512 512
ReadX 9176 1907 512 512
ReadX 9176 1860 268 268
ReadX 9176 1832 244 244
ReadX 9176 1846 512 512
ReadX 9176 2358 512 512
ReadX 9176 2870 512 512
ReadX 9176 3382 512 512
ReadX 9176 3894 512 512
ReadX 9176 4406 512 512
ReadX 9176 4918 512 512
ReadX 9176 1858 512 512
ReadX 9176 1859 512 512
ReadX 9176 1860 488 488
ReadX 9176 1832 24 24
ReadX 9176 1861 228 228
ReadX 9176 1832 284 284
ReadX 9176 2116 512 512
ReadX 9176 2628 512 512
ReadX 9176 3140 512 512
ReadX 9176 3652 512 512
ReadX 9176 4164 512 512
ReadX 9176 4676 512 512
ReadX 9176 5188 228 228
ReadX 9176 1862 284 284
ReadX 9176 2146 512 512
ReadX 9176 2658 38 38
ReadX 9176 1859 512 512
ReadX 9176 2047 512 512
ReadX 9176 2016 512 512
ReadX 9176 2528 512 512
ReadX 9176 3040 512 512
ReadX 9176 3552 512 512
ReadX 9176 4064 512 512
ReadX 9176 4576 512 512
ReadX 9176 5088 512 512
ReadX 9176 5600 424 424
ReadX 9176 2002 88 88
ReadX 9176 2090 512 512
ReadX 9176 2602 512 512
ReadX 9176 3114 512 512
ReadX 9176 3626 512 512
ReadX 9176 4138 512 512
ReadX 9176 4650 512 512
ReadX 9176 5162 424 424
ReadX 9176 2032 88 88
ReadX 9176 2120 512 512
ReadX 9176 2632 512 512
ReadX 9176 3144 512 512
ReadX 9176 3656 512 512
ReadX 9176 4168 512 512
ReadX 9176 4680 512 512
ReadX 9176 5192 512 512
ReadX 9176 2044 512 512
ReadX 9176 2045 512 512
ReadX 9176 2046 512 512
ReadX 9176 2047 512 512
ReadX 9176 2559 110 110
ReadX 9176 2052 402 402
ReadX 9176 2454 512 512
ReadX 9176 2966 512 512
ReadX 9176 3478 512 512
ReadX 9176 3990 512 512
ReadX 9176 4502 512 512
ReadX 9176 5014 512 512
ReadX 9176 5526 512 512
ReadX 9176 6038 512 512
ReadX 9176 6550 512 512
ReadX 9176 7062 512 512
ReadX 9176 7574 512 512
ReadX 9176 8086 512 512
ReadX 9176 8598 512 512
ReadX 9176 9110 512 512
ReadX 9176 9622 512 512
ReadX 9176 10134 512 512
ReadX 9176 10646 512 512
ReadX 9176 11158 512 512
ReadX 9176 11670 512 512
ReadX 9176 12182 512 512
ReadX 9176 12694 118 118
ReadX 9176 2045 512 512
ReadX 9176 1282 512 512
ReadX 9176 1343 512 512
ReadX 9176 1286 512 512
ReadX 9176 1798 512 512
ReadX 9176 2310 512 512
ReadX 9176 2822 512 512
ReadX 9176 3334 512 512
ReadX 9176 3846 512 512
ReadX 9176 4358 512 512
ReadX 9176 4870 416 416
ReadX 9176 1270 96 96
ReadX 9176 1366 512 512
ReadX 9176 1878 512 512
ReadX 9176 2390 512 512
ReadX 9176 2902 512 512
ReadX 9176 3414 512 512
ReadX 9176 3926 416 416
ReadX 9176 1284 96 96
ReadX 9176 1380 416 416
ReadX 9176 1302 96 96
ReadX 9176 1398 512 512
ReadX 9176 1910 512 512
ReadX 9176 2422 512 512
ReadX 9176 2934 512 512
ReadX 9176 3446 512 512
ReadX 9176 3958 512 512
ReadX 9176 4470 512 512
ReadX 9176 4982 512 512
ReadX 9176 5494 512 512
ReadX 9176 6006 512 512
ReadX 9176 6518 512 512
ReadX 9176 7030 512 512
ReadX 9176 7542 512 512
ReadX 9176 1328 512 512
ReadX 9176 1330 512 512
ReadX 9176 1333 512 512
ReadX 9176 1845 512 512
ReadX 9176 2357 512 512
ReadX 9176 2869 512 512
ReadX 9176 3381 512 512
ReadX 9176 1344 512 512
ReadX 9176 1856 512 512
ReadX 9176 2368 512 512
ReadX 9176 2880 512 512
ReadX 9176 3392 512 512
ReadX 9176 3904 512 512
ReadX 9176 4416 512 512
ReadX 9176 4928 512 512
ReadX 9176 5440 512 512
ReadX 9176 5952 512 512
ReadX 9176 6464 512 512
ReadX 9176 6976 512 512
ReadX 9176 7488 512 512
ReadX 9176 8000 512 512
ReadX 9176 8512 512 512
ReadX 9176 9024 512 512
ReadX 9176 9536 512 512
ReadX 9176 10048 512 512
ReadX 9176 10560 512 512
ReadX 9176 11072 512 512
ReadX 9176 11584 426 426
ReadX 9176 1330 512 512
ReadX 9176 1842 512 512
ReadX 9176 1250 512 512
ReadX 9176 1264 268 268
ReadX 9176 1236 244 244
ReadX 9176 1250 512 512
ReadX 9176 1762 512 512
ReadX 9176 2274 512 512
ReadX 9176 2786 512 512
ReadX 9176 3298 512 512
ReadX 9176 3810 512 512
ReadX 9176 4322 512 512
ReadX 9176 1262 512 512
ReadX 9176 1263 512 512
ReadX 9176 1264 488 488
ReadX 9176 1236 24 24
ReadX 9176 1265 228 228
ReadX 9176 1236 284 284
ReadX 9176 1520 512 512
ReadX 9176 2032 512 512
ReadX 9176 2544 512 512
ReadX 9176 3056 512 512
ReadX 9176 3568 512 512
ReadX 9176 4080 512 512
ReadX 9176 4592 228 228
ReadX 9176 1266 284 284
ReadX 9176 1550 512 512
ReadX 9176 2062 42 42
ReadX 9176 1263 512 512
ReadX 9176 1538 512 512
ReadX 9176 1640 512 512
ReadX 9176 1510 512 512
ReadX 9176 2022 512 512
ReadX 9176 2534 512 512
ReadX 9176 3046 512 512
ReadX 9176 3558 512 512
ReadX 9176 4070 512 512
ReadX 9176 4582 512 512
ReadX 9176 5094 408 408
ReadX 9176 1496 104 104
ReadX 9176 1600 512 512
ReadX 9176 2112 512 512
ReadX 9176 2624 512 512
ReadX 9176 3136 512 512
ReadX 9176 3648 512 512
ReadX 9176 4160 512 512
ReadX 9176 4672 408 408
ReadX 9176 1526 104 104
ReadX 9176 1630 512 512
ReadX 9176 2142 512 512
ReadX 9176 2654 512 512
ReadX 9176 3166 512 512
ReadX 9176 3678 512 512
ReadX 9176 4190 408 408
ReadX 9176 1540 104 104
ReadX 9176 1644 512 512
ReadX 9176 2156 512 512
ReadX 9176 2668 512 512
ReadX 9176 3180 512 512
ReadX 9176 3692 512 512
ReadX 9176 4204 512 512
ReadX 9176 4716 512 512
ReadX 9176 5228 512 512
ReadX 9176 5740 512 512
ReadX 9176 6252 512 512
ReadX 9176 6764 512 512
ReadX 9176 7276 512 512
ReadX 9176 7788 512 512
ReadX 9176 8300 512 512
ReadX 9176 8812 512 512
ReadX 9176 9324 512 512
ReadX 9176 9836 512 512
ReadX 9176 10348 512 512
ReadX 9176 10860 512 512
ReadX 9176 11372 512 512
ReadX 9176 1615 512 512
ReadX 9176 2127 512 512
ReadX 9176 1617 512 512
ReadX 9176 1621 512 512
ReadX 9176 2133 512 512
ReadX 9176 2645 512 512
ReadX 9176 3157 512 512
ReadX 9176 3669 512 512
ReadX 9176 4181 512 512
ReadX 9176 4693 512 512
ReadX 9176 5205 512 512
ReadX 9176 5717 512 512
ReadX 9176 6229 512 512
ReadX 9176 1641 512 512
ReadX 9176 2153 512 512
ReadX 9176 2665 512 512
ReadX 9176 3177 512 512
ReadX 9176 3689 512 512
ReadX 9176 4201 512 512
ReadX 9176 4713 512 512
ReadX 9176 5225 512 512
ReadX 9176 5737 512 512
ReadX 9176 6249 512 512
ReadX 9176 6761 512 512
ReadX 9176 7273 512 512
ReadX 9176 7785 512 512
ReadX 9176 8297 512 512
ReadX 9176 8809 512 512
ReadX 9176 9321 512 512
ReadX 9176 9833 512 512
ReadX 9176 10345 512 512
ReadX 9176 10857 512 512
ReadX 9176 11369 512 512
ReadX 9176 11881 2 2
ReadX 9176 1796 510 510
ReadX 9176 2306 512 512
ReadX 9176 2818 512 512
ReadX 9176 3330 512 512
ReadX 9176 3842 512 512
ReadX 9176 4354 512 512
ReadX 9176 4866 512 512
ReadX 9176 5378 512 512
ReadX 9176 5890 512 512
ReadX 9176 6402 512 512
ReadX 9176 6914 512 512
ReadX 9176 7426 512 512
ReadX 9176 7938 512 512
ReadX 9176 8450 512 512
ReadX 9176 8962 512 512
ReadX 9176 9474 512 512
ReadX 9176 9986 512 512
ReadX 9176 10498 326 326
ReadX 9176 1617 512 512
ReadX 9176 2129 512 512
ReadX 9176 1450 512 512
ReadX 9176 1621 512 512
ReadX 9176 1446 512 512
ReadX 9176 1450 512 512
ReadX 9176 1962 512 512
ReadX 9176 2474 512 512
ReadX 9176 2986 512 512
ReadX 9176 3498 512 512
ReadX 9176 4010 512 512
ReadX 9176 4522 512 512
ReadX 9176 5034 424 424
ReadX 9176 1436 88 88
ReadX 9176 1524 512 512
ReadX 9176 2036 512 512
ReadX 9176 2548 512 512
ReadX 9176 3060 512 512
ReadX 9176 1442 512 512
ReadX 9176 1443 512 512
ReadX 9176 1444 512 512
ReadX 9176 1446 512 512
ReadX 9176 1958 386 386
ReadX 9176 1466 126 126
ReadX 9176 1592 512 512
ReadX 9176 2104 512 512
ReadX 9176 2616 512 512
ReadX 9176 3128 512 512
ReadX 9176 3640 512 512
ReadX 9176 4152 512 512
ReadX 9176 4664 512 512
ReadX 9176 5176 512 512
ReadX 9176 5688 512 512
ReadX 9176 6200 512 512
ReadX 9176 6712 512 512
ReadX 9176 7224 512 512
ReadX 9176 7736 512 512
ReadX 9176 8248 512 512
ReadX 9176 8760 294 294
ReadX 9176 1443 512 512
ReadX 9176 964 512 512
ReadX 9176 970 512 512
ReadX 9176 1482 512 512
ReadX 9176 1994 512 512
ReadX 9176 2506 512 512
ReadX 9176 3018 512 512
ReadX 9176 3530 512 512
ReadX 9176 4042 512 512
ReadX 9176 4554 424 424
ReadX 9176 956 88 88
ReadX 9176 1044 512 512
ReadX 9176 1556 512 512
ReadX 9176 2068 512 512
ReadX 9176 2580 512 512
ReadX 9176 962 512 512
ReadX 9176 963 512 512
ReadX 9176 964 512 512
ReadX 9176 965 512 512
ReadX 9176 1477 512 512
ReadX 9176 1989 228 228
ReadX 9176 986 284 284
ReadX 9176 1270 512 512
ReadX 9176 1782 512 512
ReadX 9176 2294 512 512
ReadX 9176 2806 512 512
ReadX 9176 3318 512 512
ReadX 9176 3830 512 512
ReadX 9176 4342 512 512
ReadX 9176 4854 512 512
ReadX 9176 5366 512 512
ReadX 9176 5878 512 512
ReadX 9176 6390 512 512
ReadX 9176 6902 512 512
ReadX 9176 7414 42 42
ReadX 9176 963 512 512
ReadX 9176 2610 512 512
ReadX 9176 3812 512 512
ReadX 9176 3828 512 512
ReadX 9176 3969 512 512
ReadX 9176 3918 512 512
ReadX 9176 4430 512 512
ReadX 9176 4942 512 512
ReadX 9176 5454 512 512
ReadX 9176 5966 512 512
ReadX 9176 6478 512 512
ReadX 9176 6990 512 512
ReadX 9176 7502 424 424
ReadX 9176 3904 88 88
ReadX 9176 3992 512 512
ReadX 9176 4504 512 512
ReadX 9176 5016 512 512
ReadX 9176 5528 512 512
ReadX 9176 6040 512 512
ReadX 9176 6552 512 512
ReadX 9176 7064 424 424
ReadX 9176 3934 88 88
ReadX 9176 4022 512 512
ReadX 9176 4534 512 512
ReadX 9176 5046 512 512
ReadX 9176 5558 512 512
ReadX 9176 6070 512 512
ReadX 9176 6582 512 512
ReadX 9176 7094 512 512
ReadX 9176 7606 512 512
ReadX 9176 8118 512 512
ReadX 9176 8630 512 512
ReadX 9176 3953 512 512
ReadX 9176 4465 512 512
ReadX 9176 3956 512 512
ReadX 9176 3964 512 512
ReadX 9176 4476 512 512
ReadX 9176 4988 512 512
ReadX 9176 3970 512 512
ReadX 9176 4482 512 512
ReadX 9176 4994 512 512
ReadX 9176 5506 512 512
ReadX 9176 6018 512 512
ReadX 9176 6530 512 512
ReadX 9176 7042 512 512
ReadX 9176 7554 512 512
ReadX 9176 8066 512 512
ReadX 9176 8578 512 512
ReadX 9176 9090 512 512
ReadX 9176 9602 512 512
ReadX 9176 10114 512 512
ReadX 9176 10626 512 512
ReadX 9176 11138 512 512
ReadX 9176 11650 512 512
ReadX 9176 12162 512 512
ReadX 9176 12674 512 512
ReadX 9176 13186 512 512
ReadX 9176 13698 512 512
ReadX 9176 14210 134 134
ReadX 9176 3956 512 512
ReadX 9176 4468 512 512
ReadX 9176 4980 512 512
ReadX 9176 5492 512 512
ReadX 9176 3074 512 512
ReadX 9176 3246 512 512
ReadX 9176 3964 512 512
ReadX 9176 3330 512 512
ReadX 9176 3465 512 512
ReadX 9176 3246 512 512
ReadX 9176 3758 512 512
ReadX 9176 4270 512 512
ReadX 9176 4782 512 512
ReadX 9176 5294 512 512
ReadX 9176 5806 512 512
ReadX 9176 6318 512 512
ReadX 9176 6830 368 368
ReadX 9176 3232 144 144
ReadX 9176 3376 512 512
ReadX 9176 3888 512 512
ReadX 9176 4400 512 512
ReadX 9176 4912 512 512
ReadX 9176 5424 512 512
ReadX 9176 5936 512 512
ReadX 9176 6448 368 368
ReadX 9176 3262 144 144
ReadX 9176 3406 512 512
ReadX 9176 3918 512 512
ReadX 9176 4430 512 512
ReadX 9176 4942 512 512
ReadX 9176 5454 512 512
ReadX 9176 5966 512 512
ReadX 9176 6478 512 512
ReadX 9176 6990 512 512
ReadX 9176 7502 512 512
ReadX 9176 8014 512 512
ReadX 9176 8526 512 512
ReadX 9176 9038 512 512
ReadX 9176 9550 512 512
ReadX 9176 10062 512 512
ReadX 9176 10574 512 512
ReadX 9176 11086 512 512
ReadX 9176 11598 512 512
ReadX 9176 12110 512 512
ReadX 9176 12622 512 512
ReadX 9176 13134 512 512
ReadX 9176 13646 368 368
ReadX 9176 3332 144 144
ReadX 9176 3476 512 512
ReadX 9176 3988 512 512
ReadX 9176 4500 512 512
ReadX 9176 5012 512 512
ReadX 9176 5524 512 512
ReadX 9176 6036 512 512
ReadX 9176 6548 512 512
ReadX 9176 7060 512 512
ReadX 9176 7572 512 512
ReadX 9176 8084 512 512
ReadX 9176 8596 512 512
ReadX 9176 9108 512 512
ReadX 9176 9620 512 512
ReadX 9176 10132 512 512
ReadX 9176 10644 512 512
ReadX 9176 11156 512 512
ReadX 9176 11668 512 512
ReadX 9176 12180 512 512
ReadX 9176 12692 512 512
ReadX 9176 13204 512 512
ReadX 9176 3430 512 512
ReadX 9176 3942 512 512
ReadX 9176 3434 512 512
ReadX 9176 3435 512 512
ReadX 9176 3947 512 512
ReadX 9176 4459 512 512
ReadX 9176 4971 512 512
ReadX 9176 5483 512 512
ReadX 9176 5995 512 512
ReadX 9176 6507 512 512
ReadX 9176 7019 512 512
ReadX 9176 7531 512 512
ReadX 9176 8043 512 512
ReadX 9176 8555 512 512
ReadX 9176 9067 512 512
ReadX 9176 9579 512 512
ReadX 9176 10091 512 512
ReadX 9176 10603 512 512
ReadX 9176 11115 512 512
ReadX 9176 3467 512 512
ReadX 9176 3979 512 512
ReadX 9176 4491 512 512
ReadX 9176 5003 512 512
ReadX 9176 5515 512 512
ReadX 9176 6027 512 512
ReadX 9176 6539 512 512
ReadX 9176 7051 512 512
ReadX 9176 7563 512 512
ReadX 9176 8075 512 512
ReadX 9176 8587 512 512
ReadX 9176 9099 512 512
ReadX 9176 9611 512 512
ReadX 9176 10123 512 512
ReadX 9176 10635 512 512
ReadX 9176 11147 512 512
ReadX 9176 11659 512 512
ReadX 9176 12171 512 512
ReadX 9176 12683 512 512
ReadX 9176 13195 512 512
ReadX 9176 13707 56 56
ReadX 9176 13763 512 512
ReadX 9176 14275 456 456
ReadX 9176 14731 512 512
ReadX 9176 15243 512 512
ReadX 9176 15755 512 512
ReadX 9176 16267 512 512
ReadX 9176 16779 512 512
ReadX 9176 17291 512 512
ReadX 9176 17803 512 512
ReadX 9176 18315 512 512
ReadX 9176 18827 512 512
ReadX 9176 19339 512 512
ReadX 9176 19851 512 512
ReadX 9176 20363 512 512
ReadX 9176 20875 512 512
ReadX 9176 21387 512 512
ReadX 9176 21899 512 512
ReadX 9176 22411 512 512
ReadX 9176 22923 512 512
ReadX 9176 23435 512 512
ReadX 9176 23947 512 512
ReadX 9176 24459 512 512
ReadX 9176 24971 282 282
ReadX 9176 3434 512 512
ReadX 9176 2818 512 512
ReadX 9176 2870 512 512
ReadX 9176 3026 512 512
ReadX 9176 3538 512 512
ReadX 9176 2870 512 512
ReadX 9176 3382 512 512
ReadX 9176 3894 512 512
ReadX 9176 4406 512 512
ReadX 9176 4918 512 512
ReadX 9176 5430 512 512
ReadX 9176 5942 512 512
ReadX 9176 6454 374 374
ReadX 9176 2856 138 138
ReadX 9176 2994 512 512
ReadX 9176 3506 512 512
ReadX 9176 4018 512 512
ReadX 9176 4530 512 512
ReadX 9176 5042 512 512
ReadX 9176 5554 512 512
ReadX 9176 6066 374 374
ReadX 9176 2886 138 138
ReadX 9176 3024 512 512
ReadX 9176 3536 512 512
ReadX 9176 4048 512 512
ReadX 9176 4560 512 512
ReadX 9176 5072 512 512
ReadX 9176 5584 512 512
ReadX 9176 6096 512 512
ReadX 9176 6608 512 512
ReadX 9176 7120 512 512
ReadX 9176 7632 512 512
ReadX 9176 8144 512 512
ReadX 9176 8656 512 512
ReadX 9176 9168 512 512
ReadX 9176 9680 512 512
ReadX 9176 10192 512 512
ReadX 9176 10704 512 512
ReadX 9176 11216 512 512
ReadX 9176 11728 512 512
ReadX 9176 12240 512 512
ReadX 9176 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 9176 13264 512 512
ReadX 9176 13776 512 512
ReadX 9176 14288 512 512
ReadX 9176 14800 512 512
ReadX 9176 15312 512 512
ReadX 9176 15824 512 512
ReadX 9176 16336 512 512
ReadX 9176 16848 512 512
ReadX 9176 17360 512 512
ReadX 9176 17872 512 512
ReadX 9176 18384 512 512
ReadX 9176 18896 512 512
ReadX 9176 19408 512 512
ReadX 9176 19920 512 512
ReadX 9176 20432 512 512
ReadX 9176 20944 512 512
ReadX 9176 21456 512 512
ReadX 9176 21968 512 512
ReadX 9176 22480 512 512
ReadX 9176 22992 512 512
ReadX 9176 2998 512 512
ReadX 9176 3510 512 512
ReadX 9176 3001 512 512
ReadX 9176 3003 512 512
ReadX 9176 3515 512 512
ReadX 9176 4027 512 512
ReadX 9176 4539 512 512
ReadX 9176 5051 512 512
ReadX 9176 5563 512 512
ReadX 9176 6075 512 512
ReadX 9176 6587 512 512
ReadX 9176 7099 512 512
ReadX 9176 7611 512 512
ReadX 9176 8123 512 512
ReadX 9176 8635 512 512
ReadX 9176 3029 512 512
ReadX 9176 3541 512 512
ReadX 9176 4053 512 512
ReadX 9176 4565 512 512
ReadX 9176 5077 512 512
ReadX 9176 5589 512 512
ReadX 9176 6101 512 512
ReadX 9176 6613 512 512
ReadX 9176 7125 512 512
ReadX 9176 7637 512 512
ReadX 9176 8149 512 512
ReadX 9176 8661 512 512
ReadX 9176 9173 512 512
ReadX 9176 9685 512 512
ReadX 9176 10197 512 512
ReadX 9176 10709 512 512
ReadX 9176 11221 512 512
ReadX 9176 11733 512 512
ReadX 9176 12245 512 512
ReadX 9176 12757 512 512
ReadX 9176 13269 40 40
ReadX 9176 3076 472 472
ReadX 9176 3548 512 512
ReadX 9176 4060 512 512
ReadX 9176 4572 512 512
ReadX 9176 5084 512 512
ReadX 9176 5596 512 512
ReadX 9176 6108 512 512
ReadX 9176 6620 512 512
ReadX 9176 7132 512 512
ReadX 9176 7644 512 512
ReadX 9176 8156 512 512
ReadX 9176 8668 512 512
ReadX 9176 9180 512 512
ReadX 9176 9692 512 512
ReadX 9176 10204 512 512
ReadX 9176 10716 512 512
ReadX 9176 11228 512 512
ReadX 9176 11740 512 512
ReadX 9176 12252 512 512
ReadX 9176 12764 512 512
ReadX 9176 13276 310 310
ReadX 9176 3001 512 512
ReadX 9176 2562 512 512
ReadX 9176 2626 512 512
ReadX 9176 3003 512 512
ReadX 9176 2721 512 512
ReadX 9176 2626 512 512
ReadX 9176 3138 512 512
ReadX 9176 3650 512 512
ReadX 9176 4162 512 512
ReadX 9176 4674 512 512
ReadX 9176 5186 512 512
ReadX 9176 5698 512 512
ReadX 9176 6210 424 424
ReadX 9176 2612 88 88
ReadX 9176 2700 512 512
ReadX 9176 3212 512 512
ReadX 9176 3724 512 512
ReadX 9176 4236 512 512
ReadX 9176 4748 512 512
ReadX 9176 5260 512 512
ReadX 9176 5772 424 424
ReadX 9176 2642 88 88
ReadX 9176 2730 512 512
ReadX 9176 3242 512 512
ReadX 9176 3754 512 512
ReadX 9176 4266 512 512
ReadX 9176 4778 512 512
ReadX 9176 5290 512 512
ReadX 9176 5802 512 512
ReadX 9176 6314 512 512
ReadX 9176 6826 512 512
ReadX 9176 7338 512 512
ReadX 9176 7850 512 512
ReadX 9176 8362 512 512
ReadX 9176 8874 512 512
ReadX 9176 9386 512 512
ReadX 9176 9898 512 512
ReadX 9176 10410 512 512
ReadX 9176 10922 512 512
ReadX 9176 11434 512 512
ReadX 9176 11946 512 512
ReadX 9176 12458 512 512
ReadX 9176 2716 512 512
ReadX 9176 2717 512 512
ReadX 9176 2718 512 512
ReadX 9176 3230 512 512
ReadX 9176 2721 512 512
ReadX 9176 3233 512 512
ReadX 9176 3745 512 512
ReadX 9176 4257 512 512
ReadX 9176 4769 512 512
ReadX 9176 5281 512 512
ReadX 9176 5793 512 512
ReadX 9176 6305 512 512
ReadX 9176 6817 512 512
ReadX 9176 7329 512 512
ReadX 9176 7841 512 512
ReadX 9176 8353 512 512
ReadX 9176 8865 512 512
ReadX 9176 9377 512 512
ReadX 9176 9889 512 512
ReadX 9176 10401 512 512
ReadX 9176 10913 512 512
ReadX 9176 11425 512 512
ReadX 9176 11937 512 512
ReadX 9176 12449 512 512
ReadX 9176 12961 512 512
ReadX 9176 13473 512 512
ReadX 9176 13985 106 106
ReadX 9176 2820 406 406
ReadX 9176 3226 512 512
ReadX 9176 3738 512 512
ReadX 9176 4250 512 512
ReadX 9176 4762 512 512
ReadX 9176 5274 512 512
ReadX 9176 5786 512 512
ReadX 9176 6298 512 512
ReadX 9176 6810 512 512
ReadX 9176 7322 512 512
ReadX 9176 7834 512 512
ReadX 9176 8346 512 512
ReadX 9176 8858 512 512
ReadX 9176 9370 512 512
ReadX 9176 9882 512 512
ReadX 9176 10394 512 512
ReadX 9176 10906 512 512
ReadX 9176 11418 182 182
ReadX 9176 2717 512 512
ReadX 9176 258 512 512
ReadX 9176 470 512 512
ReadX 9176 376 512 512
ReadX 9176 888 512 512
ReadX 9176 1400 512 512
ReadX 9176 1912 512 512
ReadX 9176 2424 512 512
ReadX 9176 2936 512 512
ReadX 9176 3448 512 512
ReadX 9176 3960 424 424
ReadX 9176 362 88 88
ReadX 9176 450 512 512
ReadX 9176 962 512 512
ReadX 9176 1474 512 512
ReadX 9176 1986 512 512
ReadX 9176 2498 512 512
ReadX 9176 3010 512 512
ReadX 9176 3522 424 424
ReadX 9176 392 88 88
ReadX 9176 480 512 512
ReadX 9176 992 512 512
ReadX 9176 1504 512 512
ReadX 9176 2016 512 512
ReadX 9176 2528 512 512
ReadX 9176 3040 512 512
ReadX 9176 3552 512 512
ReadX 9176 4064 512 512
ReadX 9176 4576 512 512
ReadX 9176 5088 512 512
ReadX 9176 5600 512 512
ReadX 9176 6112 512 512
ReadX 9176 6624 512 512
ReadX 9176 7136 512 512
ReadX 9176 7648 512 512
ReadX 9176 8160 512 512
ReadX 9176 8672 512 512
ReadX 9176 9184 512 512
ReadX 9176 9696 512 512
ReadX 9176 10208 512 512
ReadX 9176 464 512 512
ReadX 9176 465 512 512
ReadX 9176 466 512 512
ReadX 9176 978 512 512
ReadX 9176 470 512 512
ReadX 9176 982 512 512
ReadX 9176 1494 512 512
ReadX 9176 2006 512 512
ReadX 9176 2518 512 512
ReadX 9176 3030 512 512
ReadX 9176 3542 512 512
ReadX 9176 4054 512 512
ReadX 9176 4566 512 512
ReadX 9176 5078 512 512
ReadX 9176 5590 512 512
ReadX 9176 6102 512 512
ReadX 9176 6614 512 512
ReadX 9176 7126 512 512
ReadX 9176 7638 512 512
ReadX 9176 8150 512 512
ReadX 9176 8662 512 512
ReadX 9176 9174 512 512
ReadX 9176 9686 512 512
ReadX 9176 10198 512 512
ReadX 9176 10710 333 333
ReadX 9176 11043 512 512
ReadX 9176 11555 179 179
ReadX 9176 11734 512 512
ReadX 9176 12246 512 512
ReadX 9176 12758 512 512
ReadX 9176 13270 512 512
ReadX 9176 13782 512 512
ReadX 9176 14294 512 512
ReadX 9176 14806 512 512
ReadX 9176 15318 512 512
ReadX 9176 15830 512 512
ReadX 9176 16342 512 512
ReadX 9176 16854 512 512
ReadX 9176 17366 512 512
ReadX 9176 17878 512 512
ReadX 9176 18390 512 512
ReadX 9176 18902 512 512
ReadX 9176 19414 512 512
ReadX 9176 19926 512 512
ReadX 9176 20438 512 512
ReadX 9176 20950 512 512
ReadX 9176 21462 512 512
ReadX 9176 21974 350 350
ReadX 9176 465 512 512
ReadX 9176 3812 512 512
ReadX 9176 4046 512 512
ReadX 9176 3828 512 512
ReadX 9176 256 512 512
ReadX 9176 260 512 512
ReadX 9176 4066 512 512
ReadX 9176 4578 512 512
ReadX 9176 5090 512 512
ReadX 9176 5602 512 512
ReadX 9176 6114 512 512
ReadX 9176 6626 512 512
ReadX 9176 7138 512 512
ReadX 9176 7650 394 394
ReadX 9176 4052 118 118
ReadX 9176 4170 512 512
ReadX 9176 4682 512 512
ReadX 9176 5194 512 512
ReadX 9176 5706 512 512
ReadX 9176 6218 512 512
ReadX 9176 6730 512 512
ReadX 9176 7242 394 394
ReadX 9176 4082 118 118
ReadX 9176 4200 512 512
ReadX 9176 4712 512 512
ReadX 9176 5224 512 512
ReadX 9176 5736 512 512
ReadX 9176 6248 512 512
ReadX 9176 6760 512 512
ReadX 9176 7272 512 512
ReadX 9176 7784 394 394
ReadX 9176 256 118 118
ReadX 9176 374 512 512
ReadX 9176 886 512 512
ReadX 9176 1398 512 512
ReadX 9176 1910 512 512
ReadX 9176 2422 512 512
ReadX 9176 2934 512 512
ReadX 9176 3446 512 512
ReadX 9176 3958 512 512
ReadX 9176 4470 512 512
ReadX 9176 4982 512 512
ReadX 9176 5494 512 512
ReadX 9176 6006 512 512
ReadX 9176 6518 512 512
ReadX 9176 7030 512 512
ReadX 9176 7542 512 512
ReadX 9176 8054 512 512
ReadX 9176 8566 512 512
ReadX 9176 9078 512 512
ReadX 9176 9590 512 512
ReadX 9176 10102 512 512
ReadX 9176 259 512 512
ReadX 9176 771 512 512
ReadX 9176 259 512 512
ReadX 9176 259 512 512
ReadX 9176 771 512 512
ReadX 9176 1283 512 512
ReadX 9176 1795 512 512
ReadX 9176 2307 512 512
ReadX 9176 2819 512 512
ReadX 9176 3331 512 512
ReadX 9176 3843 512 512
ReadX 9176 4355 512 512
ReadX 9176 4867 512 512
ReadX 9176 260 512 512
ReadX 9176 772 512 512
ReadX 9176 1284 512 512
ReadX 9176 1796 512 512
ReadX 9176 2308 512 512
ReadX 9176 2820 512 512
ReadX 9176 3332 512 512
ReadX 9176 3844 512 512
ReadX 9176 4356 512 512
ReadX 9176 4868 512 512
ReadX 9176 5380 512 512
ReadX 9176 5892 512 512
ReadX 9176 6404 512 512
ReadX 9176 6916 512 512
ReadX 9176 7428 512 512
ReadX 9176 7940 512 512
ReadX 9176 8452 512 512
ReadX 9176 8964 512 512
ReadX 9176 9476 512 512
ReadX 9176 9988 512 512
ReadX 9176 10500 378 378
ReadX 9176 10878 512 512
ReadX 9176 11390 134 134
ReadX 9176 11524 512 512
ReadX 9176 12036 512 512
ReadX 9176 12548 512 512
ReadX 9176 13060 512 512
ReadX 9176 13572 138 138
ReadX 9176 259 512 512
ReadX 9176 273 512 512
ReadX 9176 276 512 512
ReadX 9176 295 512 512
ReadX 9176 288 512 512
ReadX 9176 296 512 512
ReadX 9176 259 512 512
ReadX 9176 273 512 512
ReadX 9176 273 512 512
ReadX 9176 785 512 512
ReadX 9176 1297 512 512
ReadX 9176 1809 512 512
ReadX 9176 2321 512 512
ReadX 9176 274 512 512
ReadX 9176 274 512 512
ReadX 9176 274 497 497
ReadX 9176 272 15 15
ReadX 9176 287 512 512
ReadX 9176 799 512 512
ReadX 9176 273 512 512
ReadX 9176 785 512 512
ReadX 9176 1297 512 512
ReadX 9176 1809 512 512
ReadX 9176 2321 512 512
ReadX 9176 2833 317 317
ReadX 9176 274 195 195
ReadX 9176 469 512 512
ReadX 9176 981 512 512
ReadX 9176 1493 512 512
ReadX 9176 2005 512 512
ReadX 9176 2517 512 512
ReadX 9176 3029 512 512
ReadX 9176 3541 512 512
ReadX 9176 4053 512 512
ReadX 9176 4565 250 250
ReadX 9176 274 512 512
ReadX 9176 283 512 512
ReadX 9176 795 512 512
ReadX 9176 276 512 512
ReadX 9176 788 512 512
ReadX 9176 1300 512 512
ReadX 9176 1812 512 512
ReadX 9176 2324 512 512
ReadX 9176 2836 512 512
ReadX 9176 3348 512 512
ReadX 9176 3860 420 420
ReadX 9176 275 92 92
ReadX 9176 367 512 512
ReadX 9176 879 512 512
ReadX 9176 1391 512 512
ReadX 9176 1903 512 512
ReadX 9176 2415 512 512
ReadX 9176 2927 512 512
ReadX 9176 3439 420 420
ReadX 9176 277 92 92
ReadX 9176 369 512 512
ReadX 9176 881 512 512
ReadX 9176 1393 512 512
ReadX 9176 1905 512 512
ReadX 9176 2417 512 512
ReadX 9176 2929 512 512
ReadX 9176 3441 512 512
ReadX 9176 3953 512 512
ReadX 9176 4465 512 512
ReadX 9176 4977 512 512
ReadX 9176 5489 512 512
ReadX 9176 6001 512 512
ReadX 9176 6513 512 512
ReadX 9176 7025 512 512
ReadX 9176 7537 512 512
ReadX 9176 8049 512 512
ReadX 9176 8561 512 512
ReadX 9176 9073 512 512
ReadX 9176 9585 512 512
ReadX 9176 10097 512 512
ReadX 9176 282 512 512
ReadX 9176 794 512 512
ReadX 9176 1306 512 512
ReadX 9176 1818 512 512
ReadX 9176 2330 512 512
ReadX 9176 2842 512 512
ReadX 9176 3354 512 512
ReadX 9176 3866 512 512
ReadX 9176 4378 512 512
ReadX 9176 284 512 512
ReadX 9176 796 512 512
ReadX 9176 1308 512 512
ReadX 9176 1820 512 512
ReadX 9176 2332 512 512
ReadX 9176 2844 512 512
ReadX 9176 3356 512 512
ReadX 9176 3868 512 512
ReadX 9176 4380 512 512
ReadX 9176 4892 512 512
ReadX 9176 5404 512 512
ReadX 9176 5916 512 512
ReadX 9176 6428 512 512
ReadX 9176 6940 512 512
ReadX 9176 7452 512 512
ReadX 9176 7964 512 512
ReadX 9176 8476 512 512
ReadX 9176 8988 512 512
ReadX 9176 9500 512 512
ReadX 9176 10012 512 512
ReadX 9176 10524 472 472
ReadX 9176 288 40 40
ReadX 9176 328 512 512
ReadX 9176 840 512 512
ReadX 9176 1352 512 512
ReadX 9176 1864 512 512
ReadX 9176 2376 512 512
ReadX 9176 2888 512 512
ReadX 9176 3400 512 512
ReadX 9176 3912 512 512
ReadX 9176 4424 512 512
ReadX 9176 4936 512 512
ReadX 9176 5448 512 512
ReadX 9176 5960 512 512
ReadX 9176 6472 512 512
ReadX 9176 6984 512 512
ReadX 9176 7496 512 512
ReadX 9176 8008 512 512
ReadX 9176 8520 512 512
ReadX 9176 9032 512 512
ReadX 9176 9544 512 512
ReadX 9176 10056 512 512
ReadX 9176 10568 506 506
ReadX 9176 282 512 512
ReadX 9176 794 512 512
ReadX 9176 301 512 512
ReadX 9176 296 512 512
ReadX 9176 808 512 512
ReadX 9176 1320 512 512
ReadX 9176 1832 512 512
ReadX 9176 2344 512 512
ReadX 9176 2856 512 512
ReadX 9176 3368 512 512
ReadX 9176 3880 424 424
ReadX 9176 295 88 88
ReadX 9176 383 512 512
ReadX 9176 895 512 512
ReadX 9176 1407 512 512
ReadX 9176 1919 512 512
ReadX 9176 2431 512 512
ReadX 9176 2943 512 512
ReadX 9176 3455 424 424
ReadX 9176 297 88 88
ReadX 9176 385 512 512
ReadX 9176 897 512 512
ReadX 9176 1409 512 512
ReadX 9176 1921 512 512
ReadX 9176 2433 512 512
ReadX 9176 2945 512 512
ReadX 9176 3457 512 512
ReadX 9176 3969 512 512
ReadX 9176 4481 512 512
ReadX 9176 4993 512 512
ReadX 9176 5505 512 512
ReadX 9176 6017 512 512
ReadX 9176 6529 512 512
ReadX 9176 7041 512 512
ReadX 9176 7553 512 512
ReadX 9176 8065 512 512
ReadX 9176 8577 512 512
ReadX 9176 9089 512 512
ReadX 9176 9601 512 512
ReadX 9176 10113 512 512
ReadX 9176 301 512 512
ReadX 9176 301 512 512
ReadX 9176 301 512 512
ReadX 9176 813 512 512
ReadX 9176 301 512 512
ReadX 9176 813 512 512
ReadX 9176 1325 512 512
ReadX 9176 1837 512 512
ReadX 9176 2349 512 512
ReadX 9176 2861 512 512
ReadX 9176 3373 512 512
ReadX 9176 3885 512 512
ReadX 9176 4397 512 512
ReadX 9176 4909 512 512
ReadX 9176 5421 512 512
ReadX 9176 5933 512 512
ReadX 9176 6445 512 512
ReadX 9176 6957 512 512
ReadX 9176 7469 512 512
ReadX 9176 7981 512 512
ReadX 9176 8493 512 512
ReadX 9176 9005 512 512
ReadX 9176 9517 463 463
ReadX 9176 9980 512 512
ReadX 9176 10492 49 49
ReadX 9176 10541 512 512
ReadX 9176 11053 512 512
ReadX 9176 11565 512 512
ReadX 9176 12077 512 512
ReadX 9176 12589 512 512
ReadX 9176 13101 512 512
ReadX 9176 13613 512 512
ReadX 9176 14125 512 512
ReadX 9176 14637 512 512
ReadX 9176 15149 512 512
ReadX 9176 15661 512 512
ReadX 9176 16173 512 512
ReadX 9176 16685 512 512
ReadX 9176 17197 512 512
ReadX 9176 17709 512 512
ReadX 9176 18221 512 512
ReadX 9176 18733 512 512
ReadX 9176 19245 512 512
ReadX 9176 19757 512 512
ReadX 9176 20269 512 512
ReadX 9176 20781 326 326
ReadX 9176 301 512 512
QUERY_FS_INFORMATION 259
Close 9174
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9177
Close 9177
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9178
ReadX 9178 0 24 24
Close 9178
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9179
QUERY_FILE_INFORMATION 9179
ReadX 9179 0 512 512
ReadX 9179 476 512 512
ReadX 9179 510 512 512
ReadX 9179 484 512 512
ReadX 9179 474 512 512
ReadX 9179 478 512 512
ReadX 9179 990 512 512
ReadX 9179 509 57 57
Close 9179
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9180
QUERY_FILE_INFORMATION 9180
ReadX 9180 0 512 512
ReadX 9180 476 512 512
ReadX 9180 510 512 512
ReadX 9180 484 512 512
ReadX 9180 480 512 512
ReadX 9180 474 512 512
ReadX 9180 478 512 512
QUERY_FILE_INFORMATION 9180
WriteX 9180 494 60 60
WriteX 9180 494 4 4
QUERY_FILE_INFORMATION 9180
WriteX 9180 494 11 11
WriteX 9180 510 512 512
WriteX 9180 484 512 512
WriteX 9180 474 512 512
WriteX 9180 478 512 512
WriteX 9180 990 512 512
Close 9180
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 9181
Close 9181
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 9182
Close 9182
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 9184
WriteX 9184 4607 1 1
QUERY_FILE_INFORMATION 9184
WriteX 9184 0 65471 65471
WriteX 9184 65471 65 65
WriteX 9184 65536 19490 19490
Close 9184
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9185
QUERY_FILE_INFORMATION 9185
ReadX 9185 0 512 512
ReadX 9185 482 512 512
ReadX 9185 994 512 512
ReadX 9185 1506 512 512
ReadX 9185 480 512 512
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 490 448 448
QUERY_FILE_INFORMATION 9185
WriteX 9185 490 60 60
WriteX 9185 490 4 4
QUERY_FILE_INFORMATION 9185
WriteX 9185 490 11 11
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 484 512 512
WriteX 9185 996 512 512
WriteX 9185 1508 512 512
WriteX 9185 482 512 512
WriteX 9185 0 512 512
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
ReadX 9185 490 512 512
WriteX 9185 502 512 512
WriteX 9185 502 292 292
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 503 20 20
WriteX 9185 503 108 108
QUERY_FILE_INFORMATION 9185
WriteX 9185 504 448 448
QUERY_FILE_INFORMATION 9185
WriteX 9185 504 44 44
WriteX 9185 504 20 20
WriteX 9185 500 512 512
WriteX 9185 492 512 512
WriteX 9185 496 512 512
WriteX 9185 1008 512 512
WriteX 9185 494 512 512
Flush 9185
WriteX 9185 0 512 512
Flush 9185
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 500 512 512
WriteX 9185 492 512 512
WriteX 9185 496 512 512
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 518 320 320
QUERY_FILE_INFORMATION 9185
WriteX 9185 518 60 60
ReadX 9185 504 512 512
WriteX 9185 522 512 512
WriteX 9185 506 3204 3204
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 519 25 25
WriteX 9185 518 103 103
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 519 44 44
WriteX 9185 519 20 20
WriteX 9185 520 512 512
WriteX 9185 482 512 512
WriteX 9185 486 512 512
WriteX 9185 998 512 512
WriteX 9185 484 512 512
WriteX 9185 490 512 512
Flush 9185
WriteX 9185 0 512 512
Flush 9185
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
QUERY_FILE_INFORMATION 9185
WriteX 9185 519 7 7
WriteX 9185 519 57 57
WriteX 9185 520 512 512
WriteX 9185 492 512 512
WriteX 9185 482 512 512
WriteX 9185 486 512 512
WriteX 9185 998 512 512
Flush 9185
WriteX 9185 520 512 512
Flush 9185
Close 9185
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9186
Close 9186
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 9187
QUERY_FILE_INFORMATION 9187
ReadX 9187 0 512 512
ReadX 9187 490 512 512
ReadX 9187 484 512 512
ReadX 9187 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 9188
Close 9188
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 9187
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 9189
Close 9189
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 9190
ReadX 9190 0 24 24
Close 9190
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 9191
QUERY_FILE_INFORMATION 9191
ReadX 9191 0 512 512
ReadX 9191 366 512 512
ReadX 9191 878 512 512
ReadX 9191 1390 512 512
ReadX 9191 1902 512 512
ReadX 9191 374 57 57
Close 9191
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 9192
QUERY_FILE_INFORMATION 9192
ReadX 9192 0 512 512
ReadX 9192 366 512 512
ReadX 9192 878 512 512
ReadX 9192 1390 512 512
ReadX 9192 1902 512 512
QUERY_FILE_INFORMATION 9192
WriteX 9192 374 60 60
WriteX 9192 374 4 4
QUERY_FILE_INFORMATION 9192
WriteX 9192 374 11 11
ReadX 9192 374 57 57
ReadX 9192 374 57 57
ReadX 9192 292 4096 4096
ReadX 9192 364 512 512
ReadX 9192 512 4096 4096
ReadX 9192 4608 4096 4096
ReadX 9192 8704 4096 4096
ReadX 9192 12800 4096 4096
ReadX 9192 16896 4096 4096
ReadX 9192 20992 4096 4096
ReadX 9192 25088 4096 4096
ReadX 9192 29184 4096 4096
ReadX 9192 33280 4096 4096
ReadX 9192 37376 4096 4096
ReadX 9192 41472 4096 4096
ReadX 9192 45568 4096 4096
ReadX 9192 49664 4096 4096
ReadX 9192 53760 4096 4096
ReadX 9192 57856 4096 4096
ReadX 9192 61952 4096 4096
ReadX 9192 66048 4096 4096
ReadX 9192 70144 4096 4096
ReadX 9192 74240 162 162
ReadX 9192 308 4096 4096
ReadX 9192 4404 4096 4096
WriteX 9192 368 512 512
WriteX 9192 880 512 512
WriteX 9192 1392 512 512
Close 9192
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 9193
Close 9193
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 9194
QUERY_FILE_INFORMATION 9194
ReadX 9194 0 512 512
ReadX 9194 366 512 512
ReadX 9194 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 9195
Close 9195
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 9194
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 9197
WriteX 9197 4607 1 1
QUERY_FILE_INFORMATION 9197
WriteX 9197 0 65471 65471
WriteX 9197 65471 65 65
WriteX 9197 65536 8866 8866
Close 9197
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9198
QUERY_FILE_INFORMATION 9198
ReadX 9198 0 512 512
ReadX 9198 366 512 512
ReadX 9198 878 512 512
ReadX 9198 1390 512 512
ReadX 9198 364 512 512
QUERY_FILE_INFORMATION 9198
QUERY_FILE_INFORMATION 9198
QUERY_FILE_INFORMATION 9198
WriteX 9198 374 448 448
QUERY_FILE_INFORMATION 9198
WriteX 9198 374 60 60
WriteX 9198 374 4 4
QUERY_FILE_INFORMATION 9198
WriteX 9198 374 11 11
QUERY_FILE_INFORMATION 9198
QUERY_FILE_INFORMATION 9198
WriteX 9198 374 7 7
WriteX 9198 374 57 57
WriteX 9198 368 512 512
WriteX 9198 880 512 512
WriteX 9198 1392 512 512
WriteX 9198 366 512 512
WriteX 9198 0 512 512
Flush 9198
WriteX 9198 368 512 512
Flush 9198
Close 9198
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9199
QUERY_FILE_INFORMATION 9199
ReadX 9199 0 512 512
ReadX 9199 366 512 512
ReadX 9199 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 9199
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9200
Close 9200
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9201
ReadX 9201 0 24 24
Close 9201
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9202
QUERY_FILE_INFORMATION 9202
ReadX 9202 0 512 512
ReadX 9202 366 512 512
ReadX 9202 878 512 512
ReadX 9202 1390 512 512
ReadX 9202 1902 512 512
ReadX 9202 374 57 57
Close 9202
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9203
QUERY_FILE_INFORMATION 9203
ReadX 9203 0 512 512
ReadX 9203 366 512 512
ReadX 9203 878 512 512
ReadX 9203 1390 512 512
ReadX 9203 1902 512 512
QUERY_FILE_INFORMATION 9203
WriteX 9203 374 60 60
WriteX 9203 374 4 4
QUERY_FILE_INFORMATION 9203
WriteX 9203 374 11 11
WriteX 9203 368 512 512
WriteX 9203 880 512 512
WriteX 9203 1392 512 512
Close 9203
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 9204
Close 9204
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 9205
Close 9205
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 9207
WriteX 9207 4607 1 1
QUERY_FILE_INFORMATION 9207
WriteX 9207 0 65471 65471
WriteX 9207 65471 65 65
WriteX 9207 65536 9298 9298
Close 9207
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9208
QUERY_FILE_INFORMATION 9208
ReadX 9208 0 512 512
ReadX 9208 368 512 512
ReadX 9208 880 512 512
ReadX 9208 1392 512 512
ReadX 9208 366 512 512
QUERY_FILE_INFORMATION 9208
QUERY_FILE_INFORMATION 9208
QUERY_FILE_INFORMATION 9208
WriteX 9208 376 448 448
QUERY_FILE_INFORMATION 9208
WriteX 9208 376 60 60
WriteX 9208 376 4 4
QUERY_FILE_INFORMATION 9208
WriteX 9208 376 11 11
QUERY_FILE_INFORMATION 9208
QUERY_FILE_INFORMATION 9208
WriteX 9208 376 7 7
WriteX 9208 376 57 57
WriteX 9208 370 512 512
WriteX 9208 882 512 512
WriteX 9208 1394 512 512
WriteX 9208 368 512 512
WriteX 9208 0 512 512
Flush 9208
WriteX 9208 370 512 512
Flush 9208
Close 9208
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9209
Close 9209
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9210
QUERY_FILE_INFORMATION 9210
ReadX 9210 0 512 512
ReadX 9210 368 512 512
ReadX 9210 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 9211
Close 9211
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 9213
Close 9213
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 9214
ReadX 9214 0 24 24
Close 9214
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 9215
QUERY_FILE_INFORMATION 9215
ReadX 9215 0 512 512
ReadX 9215 512 512 512
ReadX 9215 1024 512 512
ReadX 9215 2016 512 512
ReadX 9215 1056 512 512
ReadX 9215 1096 57 57
Close 9215
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 9216
QUERY_FILE_INFORMATION 9216
ReadX 9216 0 512 512
ReadX 9216 512 512 512
ReadX 9216 1024 512 512
ReadX 9216 2016 512 512
ReadX 9216 1056 512 512
ReadX 9216 1096 57 57
ReadX 9216 1096 57 57
ReadX 9216 1088 62 62
ReadX 9216 1536 4096 4096
ReadX 9216 5632 4096 4096
ReadX 9216 9728 4096 4096
ReadX 9216 13824 2859 2859
ReadX 9216 1120 28 28
ReadX 9216 1148 20 20
ReadX 9216 1168 8 8
ReadX 9216 1176 88 88
ReadX 9216 1264 8 8
ReadX 9216 1272 4 4
ReadX 9216 1276 4 4
ReadX 9216 1280 1 1
ReadX 9216 1130 4 4
ReadX 9216 1134 4 4
ReadX 9216 1138 1 1
ReadX 9216 1131 4 4
ReadX 9216 1135 4 4
ReadX 9216 1139 1 1
ReadX 9216 1131 4 4
ReadX 9216 1135 4 4
ReadX 9216 1139 2 2
ReadX 9216 1132 4 4
ReadX 9216 1136 4 4
ReadX 9216 1140 25 25
ReadX 9216 1134 4 4
ReadX 9216 1138 8 8
ReadX 9216 1146 4 4
ReadX 9216 1150 8 8
ReadX 9216 1158 4 4
ReadX 9216 1162 8 8
ReadX 9216 1170 4 4
ReadX 9216 1174 4 4
ReadX 9216 1178 4 4
ReadX 9216 1182 4 4
ReadX 9216 1186 4 4
ReadX 9216 1190 4 4
ReadX 9216 1194 13900 13900
ReadX 9216 2048 4096 4096
Close 9216
QUERY_FS_INFORMATION 259
Close 9210
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9217
Close 9217
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9218
ReadX 9218 0 24 24
Close 9218
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9219
QUERY_FILE_INFORMATION 9219
ReadX 9219 0 512 512
ReadX 9219 368 512 512
ReadX 9219 880 512 512
ReadX 9219 1392 512 512
ReadX 9219 1904 512 512
ReadX 9219 376 57 57
Close 9219
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9220
QUERY_FILE_INFORMATION 9220
ReadX 9220 0 512 512
ReadX 9220 368 512 512
ReadX 9220 880 512 512
ReadX 9220 1392 512 512
ReadX 9220 1904 512 512
QUERY_FILE_INFORMATION 9220
WriteX 9220 376 60 60
WriteX 9220 376 4 4
QUERY_FILE_INFORMATION 9220
WriteX 9220 376 11 11
WriteX 9220 370 512 512
WriteX 9220 882 512 512
WriteX 9220 1394 512 512
Close 9220
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 9221
Close 9221
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 9222
Close 9222
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 9224
WriteX 9224 4607 1 1
QUERY_FILE_INFORMATION 9224
WriteX 9224 0 65471 65471
WriteX 9224 65471 65 65
WriteX 9224 65536 11540 11540
Close 9224
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9225
QUERY_FILE_INFORMATION 9225
ReadX 9225 0 512 512
ReadX 9225 398 512 512
ReadX 9225 910 512 512
ReadX 9225 1422 512 512
ReadX 9225 396 512 512
QUERY_FILE_INFORMATION 9225
QUERY_FILE_INFORMATION 9225
QUERY_FILE_INFORMATION 9225
WriteX 9225 406 448 448
QUERY_FILE_INFORMATION 9225
WriteX 9225 406 60 60
WriteX 9225 406 4 4
QUERY_FILE_INFORMATION 9225
WriteX 9225 406 11 11
QUERY_FILE_INFORMATION 9225
QUERY_FILE_INFORMATION 9225
WriteX 9225 406 7 7
WriteX 9225 406 57 57
WriteX 9225 400 512 512
WriteX 9225 912 512 512
WriteX 9225 1424 512 512
WriteX 9225 398 512 512
WriteX 9225 0 512 512
Flush 9225
WriteX 9225 400 512 512
Flush 9225
Close 9225
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9226
Close 9226
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 9227
QUERY_FILE_INFORMATION 9227
ReadX 9227 0 512 512
ReadX 9227 398 512 512
ReadX 9227 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 9228
Close 9228
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 9227
ReadX 9176 1434 512 512
Close 9176
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9229
WriteX 9229 0 65471 65471
WriteX 9229 65471 63 63
WriteX 9229 65534 65471 65471
WriteX 9229 131005 63 63
Close 9229
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9230
WriteX 9230 0 65471 65471
WriteX 9230 65471 63 63
WriteX 9230 65534 65471 65471
WriteX 9230 131005 63 63
WriteX 9230 131068 65471 65471
WriteX 9230 196539 63 63
WriteX 9230 196602 65471 65471
WriteX 9230 262073 63 63
Close 9230
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9231
WriteX 9231 0 65471 65471
WriteX 9231 65471 63 63
WriteX 9231 65534 65471 65471
WriteX 9231 131005 63 63
WriteX 9231 131068 65471 65471
WriteX 9231 196539 63 63
WriteX 9231 196602 65471 65471
WriteX 9231 262073 63 63
WriteX 9231 262136 65471 65471
WriteX 9231 327607 63 63
WriteX 9231 327670 65471 65471
WriteX 9231 393141 63 63
WriteX 9231 393204 65471 65471
WriteX 9231 458675 63 63
WriteX 9231 458738 65471 65471
WriteX 9231 524209 63 63
Close 9231
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9232
Close 9232
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 9233
ReadX 9233 0 512 512
ReadX 9233 512 511 511
ReadX 9233 1023 512 512
ReadX 9233 1535 512 512
Close 9233
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 9234
ReadX 9234 0 512 512
ReadX 9234 512 510 510
ReadX 9234 1022 512 512
ReadX 9234 1534 510 510
ReadX 9234 2044 510 510
Close 9234
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 9235
ReadX 9235 0 512 512
ReadX 9235 512 512 512
ReadX 9235 1024 512 512
ReadX 9235 1536 512 512
ReadX 9235 2048 512 512
ReadX 9235 2560 512 512
ReadX 9235 3072 512 512
ReadX 9235 3584 512 512
ReadX 9235 4096 512 512
ReadX 9235 4608 512 512
ReadX 9235 5120 512 512
ReadX 9235 5632 512 512
ReadX 9235 6144 512 512
ReadX 9235 6656 512 512
ReadX 9235 7168 512 512
ReadX 9235 7680 512 512
ReadX 9235 8192 512 512
ReadX 9235 8704 512 512
Close 9235
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9236
Close 9236
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 9237
QUERY_FILE_INFORMATION 9237
Close 9237
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 9238
ReadX 9238 0 8192 8192
Close 9238
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 9239
Close 9239
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 9240
QUERY_FILE_INFORMATION 9240
Close 9240
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 9241
ReadX 9241 0 8192 8192
Close 9241
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9242
Close 9242
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 9243
QUERY_FILE_INFORMATION 9243
Close 9243
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 9244
ReadX 9244 0 8192 8192
Close 9244
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 9245
ReadX 9245 0 8192 8192
ReadX 9245 8192 8192 8192
ReadX 9245 16384 8192 8192
ReadX 9245 24576 8192 8192
Close 9245
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 9247
Close 9247
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 9249
WriteX 9249 8191 1 1
QUERY_FILE_INFORMATION 9249
WriteX 9249 0 10438 10438
Close 9249
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 9250
Close 9250
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 9251
QUERY_FILE_INFORMATION 9251
QUERY_FILE_INFORMATION 9251
Close 9251
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 9252
QUERY_FILE_INFORMATION 9252
QUERY_FILE_INFORMATION 9252
Close 9252
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 9253
Close 9253
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 9254
QUERY_FILE_INFORMATION 9254
QUERY_FILE_INFORMATION 9254
Close 9254
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 9255
QUERY_FILE_INFORMATION 9255
QUERY_FILE_INFORMATION 9255
Close 9255
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 9256
Close 9256
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 9257
QUERY_FILE_INFORMATION 9257
QUERY_FILE_INFORMATION 9257
Close 9257
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 9258
QUERY_FILE_INFORMATION 9258
QUERY_FILE_INFORMATION 9258
Close 9258
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 9259
Close 9259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 9260
QUERY_FILE_INFORMATION 9260
QUERY_FILE_INFORMATION 9260
Close 9260
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 9261
ReadX 9261 0 8 8
ReadX 9261 8 4 4
ReadX 9261 12 8 8
ReadX 9261 22 8 8
ReadX 9261 520 8 8
ReadX 9261 525 8 8
ReadX 9261 533 4 4
ReadX 9261 543 8 8
ReadX 9261 551 4 4
ReadX 9261 1058 8 8
ReadX 9261 1066 4 4
ReadX 9261 1081 8 8
ReadX 9261 1089 4 4
ReadX 9261 660 8 8
Close 9261
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 9262
ReadX 9262 0 8192 8192
Close 9262
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 9263
ReadX 9263 0 8192 8192
ReadX 9263 520 8192 8192
ReadX 9263 8712 8192 8192
ReadX 9263 16904 8192 8192
ReadX 9263 25096 8192 8192
ReadX 9263 33288 8192 8192
ReadX 9263 41480 8192 8192
ReadX 9263 49672 8192 8192
ReadX 9263 57864 8192 8192
ReadX 9263 66056 8192 8192
ReadX 9263 74248 8192 8192
ReadX 9263 82440 8192 8192
ReadX 9263 90632 8192 8192
ReadX 9263 98824 8192 8192
ReadX 9263 107016 8192 8192
ReadX 9263 115208 8192 8192
ReadX 9263 123400 8192 8192
ReadX 9263 131592 8192 8192
ReadX 9263 139784 8192 8192
ReadX 9263 147976 8192 8192
ReadX 9263 156168 8192 8192
Close 9263
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 9264
QUERY_FILE_INFORMATION 9264
Close 9264
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 9265
Close 9265
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 9267
WriteX 9267 8191 1 1
QUERY_FILE_INFORMATION 9267
WriteX 9267 0 28489 28489
Close 9267
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 9268
Close 9268
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 9269
Close 9269
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 9270
QUERY_FILE_INFORMATION 9270
Close 9270
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 9271
ReadX 9271 0 8192 8192
Close 9271
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9272
Close 9272
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 9273
QUERY_FILE_INFORMATION 9273
Close 9273
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 9274
ReadX 9274 0 8192 8192
Close 9274
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 9275
ReadX 9275 0 8192 8192
ReadX 9275 8192 8192 8192
ReadX 9275 16384 8192 8192
ReadX 9275 24576 8192 8192
ReadX 9275 32768 16384 16384
ReadX 9275 49152 8192 8192
ReadX 9275 57344 8192 8192
ReadX 9275 65536 8192 8192
Close 9275
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 9277
Close 9277
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 9279
WriteX 9279 8191 1 1
QUERY_FILE_INFORMATION 9279
WriteX 9279 0 29253 29253
Close 9279
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 9280
Close 9280
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 9281
QUERY_FILE_INFORMATION 9281
QUERY_FILE_INFORMATION 9281
Close 9281
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 9282
QUERY_FILE_INFORMATION 9282
QUERY_FILE_INFORMATION 9282
Close 9282
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 9283
QUERY_FILE_INFORMATION 9283
Close 9283
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 9284
Close 9284
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 9286
WriteX 9286 8191 1 1
QUERY_FILE_INFORMATION 9286
WriteX 9286 0 30183 30183
Close 9286
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 9287
Close 9287
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 9288
WriteX 9288 0 510 510
WriteX 9288 510 512 512
WriteX 9288 1022 510 510
WriteX 9288 1532 510 510
WriteX 9288 2042 168 168
Close 9288
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9289
Close 9289
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 9290
WriteX 9290 0 511 511
WriteX 9290 511 512 512
WriteX 9290 1023 512 512
WriteX 9290 1535 488 488
Close 9290
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9291
ReadX 9291 0 65471 65471
ReadX 9291 65471 63 63
ReadX 9291 65534 65471 65471
ReadX 9291 131005 63 63
ReadX 9291 131068 65471 65471
ReadX 9291 196539 63 63
ReadX 9291 196602 65471 65471
ReadX 9291 262073 63 63
ReadX 9291 262136 65471 65471
ReadX 9291 327607 63 63
ReadX 9291 327670 10 10
Close 9291
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9292
ReadX 9292 0 65471 65471
ReadX 9292 65471 63 63
ReadX 9292 65534 65471 65471
ReadX 9292 131005 63 63
ReadX 9292 131068 65471 65471
ReadX 9292 196539 63 63
ReadX 9292 196602 65471 65471
ReadX 9292 262073 63 63
ReadX 9292 262136 65471 65471
ReadX 9292 327607 63 63
ReadX 9292 327670 65471 65471
ReadX 9292 393141 63 63
ReadX 9292 393204 65471 65471
ReadX 9292 458675 63 63
ReadX 9292 458738 65471 65471
ReadX 9292 524209 63 63
ReadX 9292 524272 65471 65471
ReadX 9292 589743 63 63
ReadX 9292 589806 65471 65471
ReadX 9292 655277 63 63
ReadX 9292 655340 32 32
Close 9292
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9293
ReadX 9293 0 65471 65471
ReadX 9293 65471 63 63
ReadX 9293 65534 65471 65471
ReadX 9293 131005 63 63
ReadX 9293 131068 65471 65471
ReadX 9293 196539 63 63
ReadX 9293 196602 65471 65471
ReadX 9293 262073 63 63
ReadX 9293 262136 65471 65471
ReadX 9293 327607 63 63
ReadX 9293 327670 65471 65471
ReadX 9293 393141 63 63
ReadX 9293 393204 65471 65471
ReadX 9293 458675 63 63
ReadX 9293 458738 65471 65471
ReadX 9293 524209 63 63
ReadX 9293 524272 65471 65471
ReadX 9293 589743 63 63
ReadX 9293 589806 65471 65471
ReadX 9293 655277 63 63
ReadX 9293 655340 65471 65471
ReadX 9293 720811 63 63
ReadX 9293 720874 65471 65471
ReadX 9293 786345 63 63
ReadX 9293 786408 65471 65471
ReadX 9293 851879 63 63
ReadX 9293 851942 65471 65471
ReadX 9293 917413 63 63
ReadX 9293 917476 65471 65471
ReadX 9293 982947 63 63
ReadX 9293 983010 65471 65471
ReadX 9293 1048481 63 63
ReadX 9293 1048544 65471 65471
ReadX 9293 1114015 63 63
ReadX 9293 1114078 65471 65471
ReadX 9293 1179549 63 63
ReadX 9293 1179612 65471 65471
ReadX 9293 1245083 63 63
ReadX 9293 1245146 65471 65471
ReadX 9293 1310617 63 63
ReadX 9293 1310680 65471 65471
ReadX 9293 1376151 63 63
ReadX 9293 1376214 65471 65471
ReadX 9293 1441685 63 63
ReadX 9293 1441748 65471 65471
ReadX 9293 1507219 63 63
ReadX 9293 1507282 65471 65471
ReadX 9293 1572753 63 63
ReadX 9293 1572816 65471 65471
ReadX 9293 1638287 63 63
ReadX 9293 1638350 65471 65471
ReadX 9293 1703821 63 63
ReadX 9293 1703884 65471 65471
ReadX 9293 1769355 63 63
ReadX 9293 1769418 65471 65471
ReadX 9293 1834889 63 63
ReadX 9293 1834952 32824 32824
Close 9293
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 9294
QUERY_FILE_INFORMATION 9294
ReadX 9294 0 512 512
ReadX 9294 512 512 512
ReadX 9294 1024 512 512
QUERY_FILE_INFORMATION 9294
QUERY_FILE_INFORMATION 9294
ReadX 9294 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 9294
QUERY_FILE_INFORMATION 9294
ReadX 9294 512 4096 4096
QUERY_FILE_INFORMATION 9294
QUERY_FILE_INFORMATION 9294
QUERY_FILE_INFORMATION 9294
WriteX 9294 512 4096 4096
WriteX 9294 1024 512 512
ReadX 9294 502 512 512
QUERY_FILE_INFORMATION 9294
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9294 2560 512 512
ReadX 9294 1536 512 512
ReadX 9294 2176 384 384
ReadX 9294 3072 128 128
ReadX 9294 3107 512 512
ReadX 9294 3619 512 512
ReadX 9294 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9294 286 123 123
ReadX 9294 292 24 24
ReadX 9294 512 2048 2048
ReadX 9294 512 2048 2048
ReadX 9294 2560 2048 2048
ReadX 9294 416 1536 1536
ReadX 9294 768 512 512
ReadX 9294 1280 2048 2048
ReadX 9294 3328 2048 2048
ReadX 9294 5376 2048 2048
ReadX 9294 7424 2048 2048
ReadX 9294 9472 2048 2048
ReadX 9294 11520 2048 2048
ReadX 9294 13568 2048 2048
ReadX 9294 15616 2048 2048
ReadX 9294 17664 2048 2048
ReadX 9294 19712 2048 2048
ReadX 9294 21760 2048 2048
ReadX 9294 23808 2048 2048
ReadX 9294 25856 2048 2048
ReadX 9294 27904 2048 2048
ReadX 9294 29952 2048 2048
ReadX 9294 32000 2048 2048
ReadX 9294 34048 2048 2048
ReadX 9294 36096 2048 2048
ReadX 9294 38144 2048 2048
ReadX 9294 40192 2048 2048
ReadX 9294 42240 512 512
ReadX 9294 42752 2048 2048
ReadX 9294 44800 2048 2048
ReadX 9294 46848 2048 2048
ReadX 9294 48896 2048 2048
ReadX 9294 50944 2048 2048
ReadX 9294 52992 2048 2048
ReadX 9294 55040 2048 2048
ReadX 9294 57088 2048 2048
ReadX 9294 316 2048 2048
ReadX 9294 2364 2048 2048
ReadX 9294 4412 2048 2048
ReadX 9294 6460 2048 2048
ReadX 9294 8508 2048 2048
ReadX 9294 10556 2048 2048
ReadX 9294 12604 2048 2048
ReadX 9294 14652 2048 2048
ReadX 9294 16700 2048 2048
ReadX 9294 18748 2048 2048
ReadX 9294 20796 2048 2048
ReadX 9294 22844 2048 2048
ReadX 9294 24892 2048 2048
ReadX 9294 26940 2048 2048
ReadX 9294 28988 2048 2048
ReadX 9294 31036 2048 2048
ReadX 9294 436 2048 2048
ReadX 9294 2484 2048 2048
ReadX 9294 4532 2048 2048
ReadX 9294 6580 2048 2048
ReadX 9294 8628 2048 2048
ReadX 9294 10676 2048 2048
ReadX 9294 476 2048 2048
ReadX 9294 476 2048 2048
ReadX 9294 476 2048 2048
ReadX 9294 2524 2048 2048
ReadX 9294 484 2048 2048
ReadX 9294 484 2048 2048
ReadX 9294 484 2048 2048
ReadX 9294 2532 665 665
ReadX 9294 492 665 665
ReadX 9294 492 665 665
ReadX 9294 492 665 665
ReadX 9294 296 512 512
ReadX 9294 318 512 512
ReadX 9294 300 512 512
ReadX 9294 312 512 512
ReadX 9294 320 512 512
ReadX 9294 832 354 354
ReadX 9294 504 4096 4096
ReadX 9294 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 9295
Close 9295
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 9296
WriteX 9296 1535 1 1
QUERY_FILE_INFORMATION 9296
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9294 296 1251 1251
ReadX 9294 2176 384 384
ReadX 9294 3072 1634 1634
QUERY_FILE_INFORMATION 9296
WriteX 9296 0 57088 57088
WriteX 9296 0 4096 4096
Flush 9296
Close 9294
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 9297
Close 9297
WriteX 9296 0 4096 4096
Close 9296
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 9298
Close 9298
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 9299
QUERY_FILE_INFORMATION 9299
ReadX 9299 0 512 512
ReadX 9299 512 512 512
ReadX 9299 1024 512 512
QUERY_FILE_INFORMATION 9299
QUERY_FILE_INFORMATION 9299
ReadX 9299 512 2048 2048
QUERY_FILE_INFORMATION 9299
QUERY_FILE_INFORMATION 9299
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9299 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 9300
WriteX 9300 1535 1 1
QUERY_FILE_INFORMATION 9300
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9299 1536 512 512
ReadX 9299 288 1251 1251
ReadX 9299 2048 2018 2018
QUERY_FILE_INFORMATION 9300
WriteX 9300 0 51456 51456
WriteX 9300 0 4096 4096
Flush 9300
QUERY_FILE_INFORMATION 9299
QUERY_FILE_INFORMATION 9299
Close 9299
WriteX 9300 0 4096 4096
Close 9300
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 9301
Close 9301
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 9302
QUERY_FILE_INFORMATION 9302
ReadX 9302 0 512 512
ReadX 9302 512 512 512
ReadX 9302 1024 512 512
QUERY_FILE_INFORMATION 9302
QUERY_FILE_INFORMATION 9302
ReadX 9302 512 2048 2048
QUERY_FILE_INFORMATION 9302
QUERY_FILE_INFORMATION 9302
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9302 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 9304
Close 9304
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 9306
WriteX 9306 4045 1 1
QUERY_FILE_INFORMATION 9306
WriteX 9306 0 53077 53077
Close 9306
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 9307
WriteX 9307 1535 1 1
QUERY_FILE_INFORMATION 9307
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9302 1536 512 512
ReadX 9302 288 1251 1251
ReadX 9302 2048 2018 2018
QUERY_FILE_INFORMATION 9307
WriteX 9307 0 65471 65471
WriteX 9307 65471 65 65
WriteX 9307 65536 1856 1856
WriteX 9307 0 4096 4096
Flush 9307
QUERY_FILE_INFORMATION 9302
QUERY_FILE_INFORMATION 9302
Close 9302
WriteX 9307 0 4096 4096
Close 9307
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 9308
Close 9308
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 9309
QUERY_FILE_INFORMATION 9309
ReadX 9309 0 512 512
ReadX 9309 512 512 512
ReadX 9309 1024 512 512
QUERY_FILE_INFORMATION 9309
QUERY_FILE_INFORMATION 9309
ReadX 9309 576 2048 2048
QUERY_FILE_INFORMATION 9309
QUERY_FILE_INFORMATION 9309
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 9311
Close 9311
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 9313
WriteX 9313 4076 1 1
QUERY_FILE_INFORMATION 9313
WriteX 9313 0 7983 7983
Close 9313
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 9315
Close 9315
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 9317
WriteX 9317 4095 1 1
QUERY_FILE_INFORMATION 9317
WriteX 9317 0 65471 65471
WriteX 9317 65471 65 65
WriteX 9317 65536 65471 65471
WriteX 9317 131007 65 65
WriteX 9317 131072 65471 65471
WriteX 9317 196543 65 65
WriteX 9317 196608 65471 65471
WriteX 9317 262079 65 65
WriteX 9317 262144 65471 65471
WriteX 9317 327615 65 65
WriteX 9317 327680 65471 65471
WriteX 9317 393151 65 65
WriteX 9317 393216 65471 65471
WriteX 9317 458687 65 65
WriteX 9317 458752 46731 46731
Close 9317
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 9318
WriteX 9318 1535 1 1
QUERY_FILE_INFORMATION 9318
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9309 1536 512 512
ReadX 9309 2048 2018 2018
ReadX 9309 4096 512 512
ReadX 9309 4608 2197 2197
QUERY_FILE_INFORMATION 9318
WriteX 9318 0 65471 65471
WriteX 9318 65471 65 65
WriteX 9318 65536 22848 22848
WriteX 9318 0 4096 4096
Flush 9318
QUERY_FILE_INFORMATION 9309
QUERY_FILE_INFORMATION 9309
Close 9309
WriteX 9318 0 4096 4096
Close 9318
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 9319
Close 9319
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 9320
QUERY_FILE_INFORMATION 9320
ReadX 9320 0 512 512
ReadX 9320 512 512 512
ReadX 9320 1024 512 512
QUERY_FILE_INFORMATION 9320
QUERY_FILE_INFORMATION 9320
ReadX 9320 576 2048 2048
QUERY_FILE_INFORMATION 9320
QUERY_FILE_INFORMATION 9320
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9320 4096 512 512
Close 9320
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 9321
QUERY_FILE_INFORMATION 9321
ReadX 9321 0 512 512
ReadX 9321 512 512 512
ReadX 9321 1024 512 512
QUERY_FILE_INFORMATION 9321
QUERY_FILE_INFORMATION 9321
ReadX 9321 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 9321
QUERY_FILE_INFORMATION 9321
ReadX 9321 288 4096 4096
QUERY_FILE_INFORMATION 9321
QUERY_FILE_INFORMATION 9321
QUERY_FILE_INFORMATION 9321
WriteX 9321 288 4096 4096
WriteX 9321 1024 512 512
ReadX 9321 1536 512 512
QUERY_FILE_INFORMATION 9321
ReadX 9321 288 2048 2048
ReadX 9321 2336 2048 2048
ReadX 9321 3072 1536 1536
ReadX 9321 544 512 512
ReadX 9321 1056 2048 2048
ReadX 9321 3104 2048 2048
ReadX 9321 5152 2048 2048
ReadX 9321 7200 2048 2048
ReadX 9321 9248 2048 2048
ReadX 9321 11296 2048 2048
ReadX 9321 13344 2048 2048
ReadX 9321 15392 2048 2048
ReadX 9321 17440 2048 2048
ReadX 9321 19488 2048 2048
ReadX 9321 21536 2048 2048
ReadX 9321 23584 2048 2048
ReadX 9321 25632 2048 2048
ReadX 9321 27680 2048 2048
ReadX 9321 29728 2048 2048
ReadX 9321 31776 2048 2048
ReadX 9321 33824 2048 2048
ReadX 9321 35872 2048 2048
ReadX 9321 37920 2048 2048
ReadX 9321 39968 2048 2048
ReadX 9321 42016 512 512
ReadX 9321 42528 512 512
ReadX 9321 43040 1536 1536
ReadX 9321 44576 2048 2048
ReadX 9321 46624 2048 2048
ReadX 9321 48672 2048 2048
ReadX 9321 50720 2048 2048
ReadX 9321 52768 2048 2048
ReadX 9321 54816 2048 2048
ReadX 9321 56864 2048 2048
ReadX 9321 58912 2048 2048
ReadX 9321 60960 2048 2048
ReadX 9321 63008 2048 2048
ReadX 9321 65056 2048 2048
ReadX 9321 67104 2048 2048
ReadX 9321 69152 2048 2048
ReadX 9321 71200 2048 2048
ReadX 9321 73248 2048 2048
ReadX 9321 75296 2048 2048
ReadX 9321 77344 2048 2048
ReadX 9321 79392 2048 2048
ReadX 9321 81440 2048 2048
ReadX 9321 83488 2048 2048
ReadX 9321 85536 512 512
ReadX 9321 86048 512 512
ReadX 9321 86560 1536 1536
ReadX 9321 88096 2048 2048
ReadX 9321 90144 2048 2048
ReadX 9321 92192 2048 2048
ReadX 9321 94240 2048 2048
ReadX 9321 96288 2048 2048
ReadX 9321 552 2048 2048
ReadX 9321 2600 2048 2048
ReadX 9321 4648 2048 2048
ReadX 9321 6696 2048 2048
ReadX 9321 8744 2048 2048
ReadX 9321 10792 2048 2048
ReadX 9321 12840 2048 2048
ReadX 9321 14888 2048 2048
ReadX 9321 16936 2048 2048
ReadX 9321 18984 2048 2048
ReadX 9321 21032 2048 2048
ReadX 9321 23080 2048 2048
ReadX 9321 25128 2048 2048
ReadX 9321 27176 2048 2048
ReadX 9321 29224 2048 2048
ReadX 9321 31272 2048 2048
ReadX 9321 33320 2048 2048
ReadX 9321 35368 2048 2048
ReadX 9321 37416 2048 2048
ReadX 9321 39464 2048 2048
ReadX 9321 41512 512 512
ReadX 9321 42024 512 512
ReadX 9321 42536 1536 1536
ReadX 9321 44072 2048 2048
ReadX 9321 46120 2048 2048
ReadX 9321 48168 2048 2048
ReadX 9321 50216 2048 2048
ReadX 9321 52264 2048 2048
ReadX 9321 54312 2048 2048
ReadX 9321 56360 2048 2048
ReadX 9321 58408 2048 2048
ReadX 9321 60456 2048 2048
ReadX 9321 62504 2048 2048
ReadX 9321 64552 2048 2048
ReadX 9321 66600 2048 2048
ReadX 9321 68648 2048 2048
ReadX 9321 70696 2048 2048
ReadX 9321 72744 2048 2048
ReadX 9321 74792 2048 2048
ReadX 9321 76840 2048 2048
ReadX 9321 78888 2048 2048
ReadX 9321 80936 2048 2048
ReadX 9321 82984 2048 2048
ReadX 9321 85032 512 512
ReadX 9321 85544 2048 2048
ReadX 9321 87592 2048 2048
ReadX 9321 89640 2048 2048
ReadX 9321 91688 2048 2048
ReadX 9321 93736 2048 2048
ReadX 9321 95784 2048 2048
ReadX 9321 97832 2048 2048
ReadX 9321 99880 2048 2048
ReadX 9321 101928 2048 2048
ReadX 9321 103976 2048 2048
ReadX 9321 106024 2048 2048
ReadX 9321 108072 2048 2048
ReadX 9321 110120 2048 2048
ReadX 9321 112168 2048 2048
ReadX 9321 114216 2048 2048
ReadX 9321 116264 2048 2048
ReadX 9321 118312 2048 2048
ReadX 9321 120360 2048 2048
ReadX 9321 122408 2048 2048
ReadX 9321 124456 512 512
ReadX 9321 124968 512 512
ReadX 9321 125480 1536 1536
ReadX 9321 127016 2048 2048
ReadX 9321 129064 2048 2048
ReadX 9321 131112 2048 2048
ReadX 9321 133160 2048 2048
ReadX 9321 135208 2048 2048
ReadX 9321 137256 2048 2048
ReadX 9321 139304 2048 2048
ReadX 9321 141352 2048 2048
ReadX 9321 143400 2048 2048
ReadX 9321 145448 2048 2048
ReadX 9321 147496 2048 2048
ReadX 9321 149544 2048 2048
ReadX 9321 151592 2048 2048
ReadX 9321 153640 2048 2048
ReadX 9321 155688 2048 2048
ReadX 9321 157736 2048 2048
ReadX 9321 159784 2048 2048
ReadX 9321 161832 2048 2048
ReadX 9321 163880 2048 2048
ReadX 9321 165928 2048 2048
ReadX 9321 167976 2048 2048
ReadX 9321 170024 512 512
ReadX 9321 1538 1536 1536
ReadX 9321 3074 2048 2048
ReadX 9321 5122 2048 2048
ReadX 9321 7170 2048 2048
ReadX 9321 9218 2048 2048
ReadX 9321 11266 2048 2048
ReadX 9321 13314 2048 2048
ReadX 9321 15362 2048 2048
ReadX 9321 17410 2048 2048
ReadX 9321 19458 2048 2048
ReadX 9321 21506 2048 2048
ReadX 9321 23554 2048 2048
ReadX 9321 25602 2048 2048
ReadX 9321 27650 2048 2048
ReadX 9321 29698 2048 2048
ReadX 9321 31746 2048 2048
ReadX 9321 33794 2048 2048
ReadX 9321 35842 2048 2048
ReadX 9321 37890 2048 2048
ReadX 9321 39938 2048 2048
ReadX 9321 41986 2048 2048
ReadX 9321 44034 875 875
ReadX 9321 1730 4096 4096
ReadX 9321 1724 1536 1536
ReadX 9321 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 9322
Close 9322
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 9323
WriteX 9323 2047 1 1
QUERY_FILE_INFORMATION 9323
Close 9321
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 9324
Close 9324
WriteX 9323 0 42388 42388
Close 9323
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 9325
Close 9325
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 9326
QUERY_FILE_INFORMATION 9326
ReadX 9326 0 512 512
ReadX 9326 1756 512 512
ReadX 9326 2268 512 512
QUERY_FILE_INFORMATION 9326
QUERY_FILE_INFORMATION 9326
ReadX 9326 1744 512 512
ReadX 9326 2256 512 512
ReadX 9326 2768 512 512
ReadX 9326 3280 512 512
ReadX 9326 3792 512 512
ReadX 9326 4304 512 512
ReadX 9326 512 2048 2048
QUERY_FILE_INFORMATION 9326
QUERY_FILE_INFORMATION 9326
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 9327
WriteX 9327 2047 1 1
QUERY_FILE_INFORMATION 9327
QUERY_FILE_INFORMATION 9326
QUERY_FILE_INFORMATION 9326
Close 9326
WriteX 9327 0 42652 42652
Close 9327
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 9328
Close 9328
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 9329
QUERY_FILE_INFORMATION 9329
ReadX 9329 0 512 512
ReadX 9329 1762 512 512
ReadX 9329 2274 512 512
QUERY_FILE_INFORMATION 9329
QUERY_FILE_INFORMATION 9329
ReadX 9329 1750 512 512
ReadX 9329 2262 512 512
ReadX 9329 2774 512 512
ReadX 9329 3286 512 512
ReadX 9329 3798 512 512
ReadX 9329 4310 512 512
ReadX 9329 512 2048 2048
QUERY_FILE_INFORMATION 9329
QUERY_FILE_INFORMATION 9329
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 9331
Close 9331
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 9333
WriteX 9333 4080 1 1
QUERY_FILE_INFORMATION 9333
WriteX 9333 0 65471 65471
WriteX 9333 65471 65 65
WriteX 9333 65536 49 49
Close 9333
Close 9329
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9334
WriteX 9334 0 65471 65471
WriteX 9334 65471 63 63
WriteX 9334 65534 65471 65471
WriteX 9334 131005 63 63
Close 9334
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9335
WriteX 9335 0 65471 65471
WriteX 9335 65471 63 63
WriteX 9335 65534 65471 65471
WriteX 9335 131005 63 63
WriteX 9335 131068 65471 65471
WriteX 9335 196539 63 63
WriteX 9335 196602 65471 65471
WriteX 9335 262073 63 63
Close 9335
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9336
WriteX 9336 0 65471 65471
WriteX 9336 65471 63 63
WriteX 9336 65534 65471 65471
WriteX 9336 131005 63 63
WriteX 9336 131068 65471 65471
WriteX 9336 196539 63 63
WriteX 9336 196602 65471 65471
WriteX 9336 262073 63 63
WriteX 9336 262136 65471 65471
WriteX 9336 327607 63 63
WriteX 9336 327670 65471 65471
WriteX 9336 393141 63 63
WriteX 9336 393204 65471 65471
WriteX 9336 458675 63 63
WriteX 9336 458738 65471 65471
WriteX 9336 524209 63 63
Close 9336
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 9337
Close 9337
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 9338
Close 9338
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 9341
Close 9341
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 9343
Close 9343
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 9344
Close 9344
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 9347
Close 9347
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 9349
Close 9349
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 9350
Close 9350
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9353
Close 9353
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9357
Close 9357
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9361
Close 9361
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9365
Close 9365
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 9369
Close 9369
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 9373
Close 9373
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 9377
Close 9377
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 9381
Close 9381
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 9383
Close 9383
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 9385
Close 9385
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 9387
WriteX 9387 4095 1 1
QUERY_FILE_INFORMATION 9387
QUERY_FS_INFORMATION 259
WriteX 9387 0 65471 65471
WriteX 9387 65471 65 65
WriteX 9387 65536 65471 65471
WriteX 9387 131007 65 65
WriteX 9387 131072 65471 65471
WriteX 9387 196543 65 65
WriteX 9387 196608 65471 65471
WriteX 9387 262079 65 65
WriteX 9387 262144 26634 26634
Close 9387
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 9392
QUERY_FILE_INFORMATION 9392
QUERY_FILE_INFORMATION 9392
Close 9392
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 9393
Close 9393
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 9394
Close 9394
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 9395
QUERY_FILE_INFORMATION 9395
ReadX 9395 0 512 512
ReadX 9395 288 512 512
ReadX 9395 800 512 512
Close 9395
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 9396
ReadX 9396 0 24 24
Close 9396
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 9397
ReadX 9397 0 24 24
Close 9397
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 9398
QUERY_FILE_INFORMATION 9398
ReadX 9398 0 512 512
ReadX 9398 288 512 512
ReadX 9398 800 512 512
ReadX 9398 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 9398 1759 2849 2849
Close 9398
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 9399
Close 9399
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 9402
Close 9402
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 9404
Close 9404
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 9405
Close 9405
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 9408
Close 9408
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 9410
Close 9410
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9411
Close 9411
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9414
Close 9414
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9418
Close 9418
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9422
Close 9422
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9426
Close 9426
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 9430
Close 9430
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 9434
Close 9434
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 9437
Close 9437
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 9441
Close 9441
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 9445
Close 9445
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 9447
Close 9447
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 9448
Close 9448
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 9457
QUERY_FILE_INFORMATION 9457
QUERY_FILE_INFORMATION 9457
Close 9457
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 9458
Close 9458
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 9459
Close 9459
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 9460
QUERY_FILE_INFORMATION 9460
ReadX 9460 0 512 512
ReadX 9460 288 512 512
ReadX 9460 800 512 512
Close 9460
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 9461
ReadX 9461 0 24 24
Close 9461
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 9462
QUERY_FILE_INFORMATION 9462
ReadX 9462 0 512 512
ReadX 9462 288 512 512
ReadX 9462 800 512 512
ReadX 9462 512 36 36
Close 9462
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 9463
QUERY_FILE_INFORMATION 9463
ReadX 9463 0 512 512
ReadX 9463 288 512 512
ReadX 9463 800 512 512
ReadX 9463 512 682 682
ReadX 9463 3584 106 106
ReadX 9463 3712 10 10
ReadX 9463 3722 10 10
ReadX 9463 512 2048 2048
ReadX 9463 3072 512 512
ReadX 9463 276 84 84
ReadX 9463 273 49 49
ReadX 9463 2560 512 512
Close 9463
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 9473
QUERY_FILE_INFORMATION 9473
QUERY_FILE_INFORMATION 9473
Close 9473
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 9474
Close 9474
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 9475
Close 9475
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 9476
QUERY_FILE_INFORMATION 9476
ReadX 9476 0 512 512
ReadX 9476 288 512 512
ReadX 9476 800 512 512
Close 9476
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 9477
ReadX 9477 0 24 24
Close 9477
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 9478
QUERY_FILE_INFORMATION 9478
ReadX 9478 0 512 512
ReadX 9478 288 512 512
ReadX 9478 800 512 512
ReadX 9478 512 36 36
Close 9478
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 9479
QUERY_FILE_INFORMATION 9479
ReadX 9479 0 512 512
ReadX 9479 288 512 512
ReadX 9479 800 512 512
ReadX 9479 512 682 682
ReadX 9479 3072 106 106
ReadX 9479 3200 10 10
ReadX 9479 3210 10 10
ReadX 9479 512 2048 2048
ReadX 9479 2560 512 512
ReadX 9479 3887 84 84
ReadX 9479 3838 49 49
ReadX 9479 2048 512 512
Close 9479
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 9480
Close 9480
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 9481
QUERY_FILE_INFORMATION 9481
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 9481
QUERY_FILE_INFORMATION 9481
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 9482
QUERY_FILE_INFORMATION 9482
QUERY_FILE_INFORMATION 9482
QUERY_FILE_INFORMATION 9482
ReadX 9482 2156 24 24
ReadX 9482 2139 276 276
ReadX 9482 2136 14 14
ReadX 9482 2136 7 7
ReadX 9482 2138 12 12
ReadX 9482 2137 8 8
ReadX 9482 2135 15 15
ReadX 9482 0 16 16
ReadX 9482 16 2048 2048
ReadX 9482 2064 2048 2048
ReadX 9482 257 2048 2048
ReadX 9482 385 2048 2048
ReadX 9482 513 2048 2048
ReadX 9482 641 2048 2048
ReadX 9482 769 2048 2048
ReadX 9482 897 2048 2048
ReadX 9482 1025 2048 2048
ReadX 9482 1153 2048 2048
ReadX 9482 1281 2048 2048
ReadX 9482 1409 2048 2048
ReadX 9482 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 9484
Close 9484
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 9486
WriteX 9486 15 1 1
QUERY_FILE_INFORMATION 9486
WriteX 9486 0 10575 10575
Flush 9486
Close 9486
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 9487
Close 9487
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 9488
QUERY_FILE_INFORMATION 9488
QUERY_FILE_INFORMATION 9488
QUERY_FILE_INFORMATION 9488
ReadX 9488 2157 24 24
ReadX 9488 2139 276 276
ReadX 9488 2137 14 14
ReadX 9488 2137 7 7
ReadX 9488 2139 12 12
ReadX 9488 2138 8 8
ReadX 9488 2136 15 15
Close 9482
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 9489
Close 9489
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 9490
QUERY_FILE_INFORMATION 9490
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 9491
QUERY_FILE_INFORMATION 9491
ReadX 9491 0 512 512
ReadX 9491 512 512 512
ReadX 9491 1024 512 512
QUERY_FILE_INFORMATION 9491
QUERY_FILE_INFORMATION 9491
Close 9491
QUERY_FILE_INFORMATION 9490
ReadX 9490 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 9492
QUERY_FILE_INFORMATION 9492
ReadX 9492 0 512 512
ReadX 9492 512 512 512
ReadX 9492 1024 512 512
ReadX 9492 288 20 20
ReadX 9492 308 2084 2084
ReadX 9492 388 2084 2084
ReadX 9492 388 2084 2084
ReadX 9481 2157 1386 1386
ReadX 9492 2472 399 399
ReadX 9492 3072 1536 1536
ReadX 9492 544 149 149
ReadX 9492 693 485 485
Close 9492
ReadX 9481 2157 4096 4096
ReadX 9481 6253 4096 4096
ReadX 9481 10349 4096 4096
ReadX 9481 14445 4096 4096
ReadX 9481 18541 4096 4096
ReadX 9481 22637 256 256
ReadX 9481 22893 4096 4096
ReadX 9481 26989 4096 4096
ReadX 9481 31085 4096 4096
ReadX 9481 35181 4096 4096
ReadX 9481 39277 4096 4096
ReadX 9481 43373 4096 4096
ReadX 9481 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 9481 2157 1024 1024
ReadX 9481 1667 4688 4688
ReadX 9481 6355 3516 3516
ReadX 9481 9871 16384 16384
ReadX 9481 26255 3771 3771
ReadX 9481 30026 2048 2048
ReadX 9481 32074 1024 1024
ReadX 9481 33098 6652 6652
ReadX 9481 39750 16384 16384
ReadX 9481 56134 10496 10496
ReadX 9481 66630 1784 1784
ReadX 9481 68414 90 90
ReadX 9481 68504 273 273
ReadX 9481 68777 1600 1600
ReadX 9481 70377 640 640
ReadX 9481 71017 1280 1280
ReadX 9481 72297 8464 8464
ReadX 9481 80761 158 158
ReadX 9481 80919 912 912
ReadX 9481 81831 1980 1980
ReadX 9481 83811 2256 2256
ReadX 9481 86067 400 400
ReadX 9481 86467 252 252
ReadX 9481 86719 42 42
ReadX 9481 86761 725 725
ReadX 9481 2009 512 512
ReadX 9481 3895 9 9
ReadX 9481 3781 46 46
ReadX 9481 4059 92 92
ReadX 9481 3781 92 92
ReadX 9481 3986 184 184
ReadX 9481 3987 16384 16384
ReadX 9481 3902 16384 16384
ReadX 9481 3781 10240 10240
ReadX 9481 3821 16384 16384
ReadX 9481 3891 935 935
ReadX 9481 4060 10240 10240
ReadX 9481 4059 184 184
ReadX 9481 256 184 184
ReadX 9481 256 1026 1026
ReadX 9481 3901 326 326
ReadX 9481 3899 652 652
ReadX 9481 256 2 2
ReadX 9481 258 4948 4948
Close 9481
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 9494
Close 9494
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 9496
WriteX 9496 4055 1 1
QUERY_FILE_INFORMATION 9496
WriteX 9496 0 65471 65471
WriteX 9496 65471 65 65
WriteX 9496 65536 65471 65471
WriteX 9496 131007 65 65
WriteX 9496 131072 65471 65471
WriteX 9496 196543 65 65
WriteX 9496 196608 65471 65471
WriteX 9496 262079 65 65
WriteX 9496 262144 65471 65471
WriteX 9496 327615 65 65
WriteX 9496 327680 65471 65471
WriteX 9496 393151 65 65
WriteX 9496 393216 65471 65471
WriteX 9496 458687 65 65
WriteX 9496 458752 65471 65471
WriteX 9496 524223 65 65
WriteX 9496 524288 65471 65471
WriteX 9496 589759 65 65
WriteX 9496 589824 35257 35257
Close 9496
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 9498
Close 9498
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 9500
WriteX 9500 4055 1 1
QUERY_FILE_INFORMATION 9500
WriteX 9500 0 65471 65471
WriteX 9500 65471 65 65
WriteX 9500 65536 65471 65471
WriteX 9500 131007 65 65
WriteX 9500 131072 65471 65471
WriteX 9500 196543 65 65
WriteX 9500 196608 65471 65471
WriteX 9500 262079 65 65
WriteX 9500 262144 65471 65471
WriteX 9500 327615 65 65
WriteX 9500 327680 65471 65471
WriteX 9500 393151 65 65
WriteX 9500 393216 65471 65471
WriteX 9500 458687 65 65
WriteX 9500 458752 65471 65471
WriteX 9500 524223 65 65
WriteX 9500 524288 65471 65471
WriteX 9500 589759 65 65
WriteX 9500 589824 57598 57598
Close 9500
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 9502
WriteX 9502 15 1 1
QUERY_FILE_INFORMATION 9502
WriteX 9502 0 12543 12543
Flush 9502
Close 9502
Close 9488
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 9503
Close 9503
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 9504
QUERY_FILE_INFORMATION 9504
QUERY_FILE_INFORMATION 9504
QUERY_FILE_INFORMATION 9504
ReadX 9504 288 24 24
ReadX 9504 287 276 276
ReadX 9504 286 14 14
ReadX 9504 286 7 7
ReadX 9504 287 12 12
ReadX 9504 287 8 8
ReadX 9504 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 9505
Close 9505
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 9506
QUERY_FILE_INFORMATION 9506
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 9506
QUERY_FILE_INFORMATION 9506
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 9507
QUERY_FILE_INFORMATION 9507
QUERY_FILE_INFORMATION 9507
QUERY_FILE_INFORMATION 9507
ReadX 9507 1938 24 24
ReadX 9507 1920 276 276
ReadX 9507 1918 14 14
ReadX 9507 1918 7 7
ReadX 9507 1919 12 12
ReadX 9507 1919 8 8
ReadX 9507 1917 15 15
ReadX 9507 0 16 16
ReadX 9507 16 2048 2048
ReadX 9507 2064 2048 2048
ReadX 9507 257 2048 2048
ReadX 9507 385 2048 2048
ReadX 9507 513 2048 2048
ReadX 9507 641 2048 2048
ReadX 9507 769 2048 2048
ReadX 9507 897 2048 2048
ReadX 9507 1025 2048 2048
ReadX 9507 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 9509
Close 9509
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 9511
WriteX 9511 15 1 1
QUERY_FILE_INFORMATION 9511
WriteX 9511 0 11588 11588
Flush 9511
Close 9511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 9512
Close 9512
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 9513
QUERY_FILE_INFORMATION 9513
QUERY_FILE_INFORMATION 9513
QUERY_FILE_INFORMATION 9513
ReadX 9513 1909 24 24
ReadX 9513 1892 276 276
ReadX 9513 1889 14 14
ReadX 9513 1889 7 7
ReadX 9513 1891 12 12
ReadX 9513 1890 8 8
ReadX 9513 1888 15 15
Close 9507
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 9515
WriteX 9515 15 1 1
QUERY_FILE_INFORMATION 9515
WriteX 9515 0 11615 11615
Flush 9515
Close 9515
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 9513
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 9516
Close 9516
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 9517
QUERY_FILE_INFORMATION 9517
QUERY_FILE_INFORMATION 9517
QUERY_FILE_INFORMATION 9517
ReadX 9517 1947 24 24
ReadX 9517 1929 276 276
ReadX 9517 1927 14 14
ReadX 9517 1927 7 7
ReadX 9517 1929 12 12
ReadX 9517 1928 8 8
ReadX 9517 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 9519
Close 9519
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 9521
WriteX 9521 4088 1 1
QUERY_FILE_INFORMATION 9521
WriteX 9521 0 65471 65471
WriteX 9521 65471 65 65
WriteX 9521 65536 16050 16050
Close 9521
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9506 1939 64 64
ReadX 9506 128 248 248
ReadX 9506 128 568 568
ReadX 9506 3872 1536 1536
ReadX 9506 3456 2560 2560
ReadX 9506 3136 512 512
ReadX 9506 2880 4096 4096
ReadX 9506 3264 3072 3072
ReadX 9506 320 4096 4096
ReadX 9506 1024 4096 4096
ReadX 9506 3616 4096 4096
ReadX 9506 1939 64 64
ReadX 9506 128 248 248
ReadX 9506 128 608 608
ReadX 9506 2858 1024 1024
ReadX 9506 2810 4096 4096
ReadX 9506 2826 4096 4096
ReadX 9506 2580 2048 2048
ReadX 9506 2800 2560 2560
ReadX 9506 2100 4096 4096
ReadX 9506 2084 4096 4096
ReadX 9506 868 4096 4096
ReadX 9506 2324 4096 4096
ReadX 9506 884 4096 4096
ReadX 9506 2604 1024 1024
ReadX 9506 580 4096 4096
ReadX 9506 596 4096 4096
ReadX 9506 2752 4096 4096
ReadX 9506 2842 1024 1024
ReadX 9506 660 4096 4096
ReadX 9506 2720 4096 4096
ReadX 9506 2736 4096 4096
ReadX 9506 628 4096 4096
ReadX 9506 2704 4096 4096
ReadX 9506 1556 4096 4096
ReadX 9506 576 4096 4096
ReadX 9506 3168 1536 1536
ReadX 9506 832 4096 4096
ReadX 9506 1088 4096 4096
ReadX 9506 1344 4096 4096
ReadX 9506 1600 4096 4096
ReadX 9506 1856 4096 4096
ReadX 9506 2112 4096 4096
ReadX 9506 1892 4096 4096
ReadX 9506 820 4096 4096
ReadX 9506 788 4096 4096
ReadX 9506 1604 4096 4096
ReadX 9506 3648 4096 4096
ReadX 9506 2608 4096 4096
ReadX 9506 548 4096 4096
ReadX 9506 740 4096 4096
ReadX 9506 1344 4096 4096
ReadX 9506 3392 4096 4096
ReadX 9506 3904 4096 4096
ReadX 9506 644 4096 4096
ReadX 9506 676 4096 4096
ReadX 9506 2688 4096 4096
ReadX 9506 320 4096 4096
ReadX 9506 900 4096 4096
ReadX 9506 1908 4096 4096
ReadX 9506 852 4096 4096
ReadX 9506 724 4096 4096
ReadX 9506 2292 4096 4096
ReadX 9506 612 4096 4096
ReadX 9506 388 4096 4096
ReadX 9506 2368 4096 4096
ReadX 9506 2624 4096 4096
ReadX 9506 500 4096 4096
ReadX 9506 356 4096 4096
ReadX 9506 1024 4096 4096
ReadX 9506 576 4096 4096
ReadX 9506 340 4096 4096
ReadX 9506 420 4096 4096
ReadX 9506 1600 4096 4096
ReadX 9506 404 4096 4096
ReadX 9506 1428 4096 4096
ReadX 9506 2656 4096 4096
ReadX 9506 2624 4096 4096
ReadX 9506 452 4096 4096
ReadX 9506 692 4096 4096
ReadX 9506 564 4096 4096
ReadX 9506 372 4096 4096
ReadX 9506 468 4096 4096
ReadX 9506 484 4096 4096
ReadX 9506 1088 4096 4096
ReadX 9506 1924 4096 4096
ReadX 9506 2768 4096 4096
ReadX 9506 832 4096 4096
ReadX 9506 836 4096 4096
ReadX 9506 1856 4096 4096
ReadX 9506 2640 4096 4096
ReadX 9506 436 4096 4096
ReadX 9506 1828 4096 4096
ReadX 9506 804 4096 4096
ReadX 9506 1860 4096 4096
ReadX 9506 1812 4096 4096
ReadX 9506 756 4096 4096
ReadX 9506 1636 4096 4096
ReadX 9506 772 4096 4096
ReadX 9506 2036 4096 4096
ReadX 9506 1220 4096 4096
ReadX 9506 1652 4096 4096
ReadX 9506 2588 4096 4096
ReadX 9506 916 4096 4096
ReadX 9506 260 4096 4096
ReadX 9506 932 4096 4096
ReadX 9506 2624 4096 4096
ReadX 9506 308 4096 4096
ReadX 9506 292 4096 4096
ReadX 9506 1140 4096 4096
ReadX 9506 276 4096 4096
ReadX 9506 2020 4096 4096
ReadX 9506 2880 4096 4096
ReadX 9506 516 4096 4096
ReadX 9506 1844 4096 4096
ReadX 9506 1124 4096 4096
ReadX 9506 3136 4096 4096
ReadX 9506 324 4096 4096
ReadX 9506 1156 4096 4096
ReadX 9506 1172 4096 4096
ReadX 9506 2112 4096 4096
ReadX 9506 2368 4096 4096
ReadX 9506 964 4096 4096
ReadX 9506 980 4096 4096
ReadX 9506 1012 4096 4096
ReadX 9506 532 4096 4096
ReadX 9506 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 9506 1620 4096 4096
ReadX 9506 1604 4096 4096
ReadX 9506 2116 4096 4096
ReadX 9506 2132 4096 4096
ReadX 9506 2148 4096 4096
ReadX 9506 2276 4096 4096
ReadX 9506 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 9523
Close 9523
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 9525
QUERY_FILE_INFORMATION 9490
WriteX 9525 4088 1 1
QUERY_FILE_INFORMATION 9525
QUERY_FILE_INFORMATION 9490
Close 9490
WriteX 9525 0 65471 65471
WriteX 9525 65471 65 65
WriteX 9525 65536 64850 64850
Close 9525
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 9527
WriteX 9527 15 1 1
QUERY_FILE_INFORMATION 9527
ReadX 9506 2068 4096 4096
ReadX 9506 1588 4096 4096
ReadX 9506 1572 4096 4096
WriteX 9527 0 18630 18630
Flush 9527
Close 9527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 9517
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 9528
Close 9528
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 9529
QUERY_FILE_INFORMATION 9529
QUERY_FILE_INFORMATION 9529
QUERY_FILE_INFORMATION 9529
ReadX 9529 661 24 24
ReadX 9529 659 356 356
ReadX 9529 659 14 14
ReadX 9529 659 7 7
ReadX 9529 659 12 12
ReadX 9529 659 8 8
ReadX 9529 659 15 15
ReadX 9529 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 9506 612 4096 4096
ReadX 9506 564 4096 4096
ReadX 9506 1876 4096 4096
ReadX 9506 628 4096 4096
ReadX 9506 740 4096 4096
ReadX 9506 724 4096 4096
ReadX 9506 644 4096 4096
ReadX 9506 2324 4096 4096
ReadX 9506 660 4096 4096
ReadX 9506 852 4096 4096
ReadX 9506 868 4096 4096
Close 9529
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 9504
ReadX 9506 2368 4096 4096
ReadX 9506 1024 4096 4096
ReadX 9506 320 4096 4096
ReadX 9506 580 4096 4096
ReadX 9506 3136 512 512
ReadX 9506 2880 4096 4096
Close 9506
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9530
WriteX 9530 0 65471 65471
WriteX 9530 65471 63 63
WriteX 9530 65534 65471 65471
WriteX 9530 131005 63 63
Close 9530
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9531
WriteX 9531 0 65471 65471
WriteX 9531 65471 63 63
WriteX 9531 65534 65471 65471
WriteX 9531 131005 63 63
WriteX 9531 131068 65471 65471
WriteX 9531 196539 63 63
WriteX 9531 196602 65471 65471
WriteX 9531 262073 63 63
Close 9531
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9532
WriteX 9532 0 65471 65471
WriteX 9532 65471 63 63
WriteX 9532 65534 65471 65471
WriteX 9532 131005 63 63
WriteX 9532 131068 65471 65471
WriteX 9532 196539 63 63
WriteX 9532 196602 65471 65471
WriteX 9532 262073 63 63
WriteX 9532 262136 65471 65471
WriteX 9532 327607 63 63
WriteX 9532 327670 65471 65471
WriteX 9532 393141 63 63
WriteX 9532 393204 65471 65471
WriteX 9532 458675 63 63
WriteX 9532 458738 65471 65471
WriteX 9532 524209 63 63
Close 9532
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9533
Close 9533
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9534
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9534 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9535
ReadX 9535 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9536
ReadX 9536 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9537
ReadX 9537 0 511 511
ReadX 9534 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9534
Close 9535
Close 9536
Close 9537
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9538
ReadX 9538 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9539
ReadX 9539 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9540
ReadX 9540 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9541
ReadX 9541 0 511 511
ReadX 9538 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 9542
FIND_FIRST \clients\client1\~dmtmp\*
Close 9542
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 9543
QUERY_FILE_INFORMATION 9543
WriteX 9543 2047 1 1
QUERY_FILE_INFORMATION 9543
WriteX 9543 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 9544
Close 9544
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 9545
WriteX 9545 52 1 1
QUERY_FILE_INFORMATION 9545
WriteX 9545 0 53 53
WriteX 9545 53 28 28
WriteX 9545 81 4 4
WriteX 9545 85 28 28
WriteX 9545 113 38 38
WriteX 9545 151 28 28
WriteX 9545 179 2 2
WriteX 9545 181 28 28
WriteX 9545 209 3 3
WriteX 9545 212 279 279
WriteX 9545 9 4 4
Close 9545
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 9546
ReadX 9546 0 53 53
ReadX 9546 53 28 28
ReadX 9546 81 4 4
ReadX 9546 85 28 28
ReadX 9546 113 38 38
ReadX 9546 151 28 28
ReadX 9546 179 2 2
ReadX 9546 181 28 28
ReadX 9546 209 3 3
Close 9546
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 9538
Close 9539
Close 9540
Close 9541
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9547
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9547 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9548
ReadX 9548 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9549
ReadX 9549 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9550
ReadX 9550 0 511 511
ReadX 9547 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 9552
Close 9552
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9553
WriteX 9553 52 1 1
QUERY_FILE_INFORMATION 9553
WriteX 9553 0 53 53
WriteX 9553 53 28 28
WriteX 9553 81 28 28
WriteX 9553 109 28 28
WriteX 9553 137 28 28
WriteX 9553 165 28 28
WriteX 9553 193 28 28
WriteX 9553 221 28 28
WriteX 9553 249 4 4
WriteX 9553 253 4 4
WriteX 9553 257 4 4
WriteX 9553 261 28 28
WriteX 9553 289 2 2
WriteX 9553 291 2 2
WriteX 9553 293 2 2
WriteX 9553 295 248 248
WriteX 9553 9 4 4
Close 9553
Close 9547
Close 9548
Close 9549
Close 9550
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9554
ReadX 9554 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9555
ReadX 9555 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9556
ReadX 9556 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9557
ReadX 9557 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9558
ReadX 9558 0 53 53
ReadX 9558 53 28 28
ReadX 9558 81 28 28
ReadX 9558 109 28 28
ReadX 9558 137 28 28
ReadX 9558 165 28 28
ReadX 9558 193 28 28
ReadX 9558 221 28 28
ReadX 9558 249 4 4
ReadX 9558 253 4 4
ReadX 9558 257 4 4
ReadX 9558 261 28 28
ReadX 9558 289 2 2
ReadX 9558 291 2 2
ReadX 9558 293 2 2
Close 9558
ReadX 9554 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9554
Close 9555
Close 9556
Close 9557
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 9543
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9559
Close 9559
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9560
ReadX 9560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9561
ReadX 9561 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9562
ReadX 9562 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9563
ReadX 9563 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9564
ReadX 9564 0 53 53
ReadX 9564 53 28 28
ReadX 9564 81 28 28
ReadX 9564 109 28 28
ReadX 9564 137 28 28
ReadX 9564 165 28 28
ReadX 9564 193 28 28
ReadX 9564 221 28 28
ReadX 9564 249 4 4
ReadX 9564 253 4 4
ReadX 9564 257 4 4
ReadX 9564 261 28 28
ReadX 9564 289 2 2
ReadX 9564 291 2 2
ReadX 9564 293 2 2
Close 9564
ReadX 9560 2048 2048 2048
Close 9560
Close 9561
Close 9562
Close 9563
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9565
ReadX 9565 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9566
ReadX 9566 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9567
ReadX 9567 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9568
ReadX 9568 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9569
ReadX 9569 0 53 53
ReadX 9569 53 28 28
ReadX 9569 81 28 28
ReadX 9569 109 28 28
ReadX 9569 137 28 28
ReadX 9569 165 28 28
ReadX 9569 193 28 28
ReadX 9569 221 28 28
ReadX 9569 249 4 4
ReadX 9569 253 4 4
ReadX 9569 257 4 4
ReadX 9569 261 28 28
ReadX 9569 289 2 2
ReadX 9569 291 2 2
ReadX 9569 293 2 2
Close 9569
ReadX 9565 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 9573
FIND_FIRST \clients\client1\~dmtmp\*
Close 9573
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 9574
QUERY_FILE_INFORMATION 9574
WriteX 9574 2047 1 1
QUERY_FILE_INFORMATION 9574
WriteX 9574 0 2048 2048
Close 9574
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 9575
ReadX 9575 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 9575
Close 9565
Close 9566
Close 9567
Close 9568
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 9576
ReadX 9576 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 9576 4095 1 1
QUERY_FILE_INFORMATION 9576
WriteX 9576 2048 2048 2048
QUERY_FILE_INFORMATION 9576
Flush 9576
WriteX 9576 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9577
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9577 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9578
ReadX 9578 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9579
ReadX 9579 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9580
ReadX 9580 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9581
ReadX 9581 0 53 53
ReadX 9581 53 28 28
ReadX 9581 81 28 28
ReadX 9581 109 28 28
ReadX 9581 137 28 28
ReadX 9581 165 28 28
ReadX 9581 193 28 28
ReadX 9581 221 28 28
ReadX 9581 249 4 4
ReadX 9581 253 4 4
ReadX 9581 257 4 4
ReadX 9581 261 28 28
ReadX 9581 289 2 2
ReadX 9581 291 2 2
ReadX 9581 293 2 2
Close 9581
ReadX 9577 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 9585
FIND_FIRST \clients\client1\~dmtmp\*
Close 9585
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 9586
QUERY_FILE_INFORMATION 9586
WriteX 9586 2047 1 1
QUERY_FILE_INFORMATION 9586
WriteX 9586 0 2048 2048
Close 9586
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 9587
ReadX 9587 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 9591
Close 9591
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 9592
QUERY_FILE_INFORMATION 9592
WriteX 9592 2047 1 1
QUERY_FILE_INFORMATION 9592
WriteX 9592 0 2048 2048
Close 9592
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 9593
ReadX 9593 0 511 511
ReadX 9577 384 2048 2048
ReadX 9577 768 16384 16384
ReadX 9577 1792 14336 14336
Close 9593
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 9594
ReadX 9594 0 511 511
Close 9594
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 9596
Close 9596
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 9587 4095 1 1
QUERY_FILE_INFORMATION 9587
WriteX 9587 2048 2048 2048
WriteX 9587 0 88 88
Close 9587
WriteX 9577 1152 2048 2048
WriteX 9577 1408 6144 6144
WriteX 9577 1920 2048 2048
WriteX 9577 0 88 88
Close 9577
WriteX 9578 0 88 88
Close 9578
WriteX 9579 0 88 88
Close 9579
Close 9580
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 9597
ReadX 9597 0 511 511
ReadX 9597 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9597
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9598
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9598 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9599
ReadX 9599 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9600
ReadX 9600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9601
ReadX 9601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9602
ReadX 9602 0 53 53
ReadX 9602 53 28 28
ReadX 9602 81 28 28
ReadX 9602 109 28 28
ReadX 9602 137 28 28
ReadX 9602 165 28 28
ReadX 9602 193 28 28
ReadX 9602 221 28 28
ReadX 9602 249 4 4
ReadX 9602 253 4 4
ReadX 9602 257 4 4
ReadX 9602 261 28 28
ReadX 9602 289 2 2
ReadX 9602 291 2 2
ReadX 9602 293 2 2
Close 9602
ReadX 9598 2048 2048 2048
Close 9598
Close 9599
Close 9600
Close 9601
Close 9576
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 9603
QUERY_FILE_INFORMATION 9603
Close 9603
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9604
Close 9604
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9605
ReadX 9605 0 511 511
ReadX 9605 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9606
ReadX 9606 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9607
ReadX 9607 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9608
ReadX 9608 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9609
ReadX 9609 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9610
ReadX 9610 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9611
ReadX 9611 0 53 53
ReadX 9611 53 2 2
ReadX 9611 55 2 2
ReadX 9611 57 184 184
ReadX 9611 241 298 298
Close 9611
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9612
ReadX 9612 0 41 41
ReadX 9605 2048 2048 2048
Close 9612
Close 9605
Close 9606
Close 9609
Close 9610
Close 9607
Close 9608
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9613
ReadX 9613 0 511 511
ReadX 9613 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9614
ReadX 9614 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9615
ReadX 9615 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9616
ReadX 9616 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9617
ReadX 9617 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9618
ReadX 9618 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9619
ReadX 9619 0 53 53
ReadX 9619 53 2 2
ReadX 9619 55 2 2
ReadX 9619 57 184 184
ReadX 9619 241 298 298
Close 9619
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9620
ReadX 9620 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9621
ReadX 9621 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9622
ReadX 9622 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9623
ReadX 9623 0 511 511
ReadX 9622 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9624
ReadX 9624 0 53 53
ReadX 9624 53 2 2
ReadX 9624 55 480 480
ReadX 9624 535 2 2
Close 9624
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9625
ReadX 9625 0 41 41
ReadX 9613 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 9629
FIND_FIRST \clients\client1\~dmtmp\*
Close 9629
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 9630
QUERY_FILE_INFORMATION 9630
WriteX 9630 2047 1 1
QUERY_FILE_INFORMATION 9630
WriteX 9630 0 2048 2048
Close 9630
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 9631
ReadX 9631 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 9631
Close 9620
Close 9621
Close 9622
Close 9623
Close 9625
Close 9613
Close 9614
Close 9617
Close 9618
Close 9615
Close 9616
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 9632
ReadX 9632 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9633
Close 9633
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9634
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9634 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9635
ReadX 9635 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9636
ReadX 9636 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9637
ReadX 9637 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9638
ReadX 9638 0 53 53
ReadX 9638 53 2 2
ReadX 9638 55 480 480
ReadX 9638 535 2 2
Close 9638
ReadX 9634 2048 2048 2048
Close 9634
Close 9635
Close 9636
Close 9637
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9639
ReadX 9639 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9640
ReadX 9640 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9641
ReadX 9641 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9642
ReadX 9642 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9643
ReadX 9643 0 53 53
ReadX 9643 53 2 2
ReadX 9643 55 480 480
ReadX 9643 535 2 2
Close 9643
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9644
ReadX 9644 0 511 511
ReadX 9644 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9645
ReadX 9645 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9646
ReadX 9646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9647
ReadX 9647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9648
ReadX 9648 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9649
ReadX 9649 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9650
ReadX 9650 0 41 41
ReadX 9644 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9651
ReadX 9651 0 53 53
ReadX 9651 53 2 2
ReadX 9651 55 2 2
ReadX 9651 57 184 184
ReadX 9651 241 298 298
Close 9651
ReadX 9639 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 9655
FIND_FIRST \clients\client1\~dmtmp\*
Close 9655
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 9656
QUERY_FILE_INFORMATION 9656
WriteX 9656 2047 1 1
QUERY_FILE_INFORMATION 9656
WriteX 9656 0 2048 2048
Close 9656
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 9657
ReadX 9657 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 9657
Close 9650
Close 9644
Close 9645
Close 9648
Close 9649
Close 9646
Close 9647
Close 9639
Close 9640
Close 9641
Close 9642
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 9658
ReadX 9658 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 9632 4095 1 1
QUERY_FILE_INFORMATION 9632
WriteX 9632 2048 2048 2048
QUERY_FILE_INFORMATION 9632
Flush 9632
WriteX 9632 0 88 88
WriteX 9658 4095 1 1
QUERY_FILE_INFORMATION 9658
WriteX 9658 2048 2048 2048
QUERY_FILE_INFORMATION 9658
Flush 9658
WriteX 9658 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9659
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9659 0 511 511
ReadX 9659 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9660
ReadX 9660 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9661
ReadX 9661 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9662
ReadX 9662 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9663
ReadX 9663 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9664
ReadX 9664 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9665
ReadX 9665 0 53 53
ReadX 9665 53 2 2
ReadX 9665 55 2 2
ReadX 9665 57 184 184
ReadX 9665 241 298 298
Close 9665
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9666
ReadX 9666 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9667
ReadX 9667 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9668
ReadX 9668 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9669
ReadX 9669 0 511 511
ReadX 9668 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9670
ReadX 9670 0 53 53
ReadX 9670 53 2 2
ReadX 9670 55 480 480
ReadX 9670 535 2 2
Close 9670
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9671
ReadX 9671 0 41 41
ReadX 9659 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9672
ReadX 9672 0 53 53
ReadX 9672 53 2 2
ReadX 9672 55 480 480
ReadX 9672 535 2 2
Close 9672
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9673
ReadX 9673 0 53 53
ReadX 9673 53 2 2
ReadX 9673 55 2 2
ReadX 9673 57 184 184
ReadX 9673 241 298 298
Close 9673
ReadX 9666 2048 2048 2048
ReadX 9667 2048 2048 2048
ReadX 9666 320 16384 16384
ReadX 9666 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 9674
FIND_FIRST \clients\client1\~dmtmp\*
Close 9674
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 9675
QUERY_FILE_INFORMATION 9675
WriteX 9675 4095 1 1
QUERY_FILE_INFORMATION 9675
WriteX 9675 0 4096 4096
Close 9675
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 9676
ReadX 9676 0 41 41
Close 9666
Close 9667
Close 9668
Close 9669
Close 9671
Close 9659
Close 9660
Close 9663
Close 9664
Close 9661
Close 9662
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 9677
Close 9677
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 9678
QUERY_FILE_INFORMATION 9678
WriteX 9678 4095 1 1
QUERY_FILE_INFORMATION 9678
WriteX 9678 0 4096 4096
Close 9678
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 9679
ReadX 9679 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 9676
ReadX 9676 0 4096 4096
WriteX 9679 0 4096 4096
Close 9679
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 9681
ReadX 9681 0 41 41
Close 9676
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 9681
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 9682
Close 9682
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 9683
ReadX 9683 0 41 41
Close 9683
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 9684
Close 9684
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9685
QUERY_FILE_INFORMATION 9685
WriteX 9685 2047 1 1
QUERY_FILE_INFORMATION 9685
WriteX 9685 0 2048 2048
Close 9685
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9686
ReadX 9686 0 511 511
ReadX 9686 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 9687
ReadX 9687 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9687
Close 9686
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9688
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9688 0 511 511
ReadX 9688 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9689
ReadX 9689 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9690
ReadX 9690 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9691
ReadX 9691 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9692
ReadX 9692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9693
ReadX 9693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9694
ReadX 9694 0 53 53
ReadX 9694 53 2 2
ReadX 9694 55 2 2
ReadX 9694 57 184 184
ReadX 9694 241 298 298
Close 9694
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9695
ReadX 9695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9696
ReadX 9696 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9697
ReadX 9697 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9698
ReadX 9698 0 511 511
ReadX 9697 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9699
ReadX 9699 0 53 53
ReadX 9699 53 2 2
ReadX 9699 55 480 480
ReadX 9699 535 2 2
Close 9699
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9700
ReadX 9700 0 41 41
ReadX 9688 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9701
ReadX 9701 0 53 53
ReadX 9701 53 2 2
ReadX 9701 55 480 480
ReadX 9701 535 2 2
Close 9701
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9702
ReadX 9702 0 53 53
ReadX 9702 53 2 2
ReadX 9702 55 2 2
ReadX 9702 57 184 184
ReadX 9702 241 298 298
Close 9702
ReadX 9695 2048 2048 2048
Close 9695
Close 9696
Close 9697
Close 9698
Close 9700
Close 9688
Close 9689
Close 9692
Close 9693
Close 9690
Close 9691
Close 9632
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 9703
QUERY_FILE_INFORMATION 9703
Close 9703
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 9658
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 9704
QUERY_FILE_INFORMATION 9704
Close 9704
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9705
Close 9705
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9706
ReadX 9706 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9707
ReadX 9707 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9708
ReadX 9708 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9709
ReadX 9709 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9710
ReadX 9710 0 53 53
ReadX 9710 53 2 2
ReadX 9710 55 480 480
ReadX 9710 535 2 2
Close 9710
ReadX 9706 2048 2048 2048
Close 9706
Close 9707
Close 9708
Close 9709
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9711
ReadX 9711 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9712
ReadX 9712 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9713
ReadX 9713 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9714
ReadX 9714 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9715
ReadX 9715 0 53 53
ReadX 9715 53 2 2
ReadX 9715 55 480 480
ReadX 9715 535 2 2
Close 9715
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9716
ReadX 9716 0 511 511
ReadX 9716 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9717
ReadX 9717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9718
ReadX 9718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9719
ReadX 9719 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9720
ReadX 9720 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9721
ReadX 9721 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9722
ReadX 9722 0 41 41
ReadX 9716 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9723
ReadX 9723 0 53 53
ReadX 9723 53 2 2
ReadX 9723 55 2 2
ReadX 9723 57 184 184
ReadX 9723 241 298 298
Close 9723
ReadX 9711 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 9727
FIND_FIRST \clients\client1\~dmtmp\*
Close 9727
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 9728
QUERY_FILE_INFORMATION 9728
WriteX 9728 2047 1 1
QUERY_FILE_INFORMATION 9728
WriteX 9728 0 2048 2048
Close 9728
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 9729
ReadX 9729 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 9729
Close 9722
Close 9716
Close 9717
Close 9720
Close 9721
Close 9718
Close 9719
Close 9711
Close 9712
Close 9713
Close 9714
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 9730
ReadX 9730 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9731
Close 9731
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9732
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9732 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9733
ReadX 9733 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9734
ReadX 9734 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9735
ReadX 9735 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9736
ReadX 9736 0 53 53
ReadX 9736 53 28 28
ReadX 9736 81 28 28
ReadX 9736 109 28 28
ReadX 9736 137 28 28
ReadX 9736 165 28 28
ReadX 9736 193 28 28
ReadX 9736 221 28 28
ReadX 9736 249 4 4
ReadX 9736 253 4 4
ReadX 9736 257 4 4
ReadX 9736 261 28 28
ReadX 9736 289 2 2
ReadX 9736 291 2 2
ReadX 9736 293 2 2
Close 9736
ReadX 9732 2048 2048 2048
Close 9732
Close 9733
Close 9734
Close 9735
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9737
ReadX 9737 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9738
ReadX 9738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9739
ReadX 9739 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9740
ReadX 9740 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9741
ReadX 9741 0 53 53
ReadX 9741 53 28 28
ReadX 9741 81 28 28
ReadX 9741 109 28 28
ReadX 9741 137 28 28
ReadX 9741 165 28 28
ReadX 9741 193 28 28
ReadX 9741 221 28 28
ReadX 9741 249 4 4
ReadX 9741 253 4 4
ReadX 9741 257 4 4
ReadX 9741 261 28 28
ReadX 9741 289 2 2
ReadX 9741 291 2 2
ReadX 9741 293 2 2
Close 9741
ReadX 9737 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 9745
FIND_FIRST \clients\client1\~dmtmp\*
Close 9745
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 9746
QUERY_FILE_INFORMATION 9746
WriteX 9746 2047 1 1
QUERY_FILE_INFORMATION 9746
WriteX 9746 0 2048 2048
Close 9746
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 9747
ReadX 9747 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 9747
Close 9737
Close 9738
Close 9739
Close 9740
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 9748
ReadX 9748 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9749
Close 9749
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9750
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9750 0 511 511
ReadX 9750 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9751
ReadX 9751 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9752
ReadX 9752 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9753
ReadX 9753 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9754
ReadX 9754 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9755
ReadX 9755 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9756
ReadX 9756 0 53 53
ReadX 9756 53 2 2
ReadX 9756 55 2 2
ReadX 9756 57 184 184
ReadX 9756 241 298 298
Close 9756
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9757
ReadX 9757 0 41 41
ReadX 9750 2048 2048 2048
Close 9757
Close 9750
Close 9751
Close 9754
Close 9755
Close 9752
Close 9753
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9758
ReadX 9758 0 511 511
ReadX 9758 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9759
ReadX 9759 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9760
ReadX 9760 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9761
ReadX 9761 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9762
ReadX 9762 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9763
ReadX 9763 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9764
ReadX 9764 0 53 53
ReadX 9764 53 2 2
ReadX 9764 55 2 2
ReadX 9764 57 184 184
ReadX 9764 241 298 298
Close 9764
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9765
ReadX 9765 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9766
ReadX 9766 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9767
ReadX 9767 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9768
ReadX 9768 0 511 511
ReadX 9767 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9769
ReadX 9769 0 53 53
ReadX 9769 53 2 2
ReadX 9769 55 480 480
ReadX 9769 535 2 2
Close 9769
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9770
ReadX 9770 0 41 41
ReadX 9758 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 9774
FIND_FIRST \clients\client1\~dmtmp\*
Close 9774
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 9775
QUERY_FILE_INFORMATION 9775
WriteX 9775 2047 1 1
QUERY_FILE_INFORMATION 9775
WriteX 9775 0 2048 2048
Close 9775
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 9776
ReadX 9776 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 9776
Close 9765
Close 9766
Close 9767
Close 9768
Close 9770
Close 9758
Close 9759
Close 9762
Close 9763
Close 9760
Close 9761
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 9777
ReadX 9777 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 9730 4095 1 1
QUERY_FILE_INFORMATION 9730
WriteX 9730 2048 2048 2048
QUERY_FILE_INFORMATION 9730
Flush 9730
WriteX 9730 0 88 88
WriteX 9748 4095 1 1
QUERY_FILE_INFORMATION 9748
WriteX 9748 2048 2048 2048
QUERY_FILE_INFORMATION 9748
Flush 9748
WriteX 9748 0 88 88
WriteX 9777 4095 1 1
QUERY_FILE_INFORMATION 9777
WriteX 9777 2048 2048 2048
QUERY_FILE_INFORMATION 9777
Flush 9777
WriteX 9777 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9778
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9778 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9779
ReadX 9779 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9780
ReadX 9780 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9781
ReadX 9781 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9782
ReadX 9782 0 53 53
ReadX 9782 53 2 2
ReadX 9782 55 480 480
ReadX 9782 535 2 2
Close 9782
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9783
ReadX 9783 0 511 511
ReadX 9783 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9784
ReadX 9784 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9785
ReadX 9785 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9786
ReadX 9786 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9787
ReadX 9787 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9788
ReadX 9788 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9789
ReadX 9789 0 41 41
ReadX 9783 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9790
ReadX 9790 0 53 53
ReadX 9790 53 2 2
ReadX 9790 55 2 2
ReadX 9790 57 184 184
ReadX 9790 241 298 298
Close 9790
ReadX 9778 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9791
ReadX 9791 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9792
ReadX 9792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9793
ReadX 9793 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9794
ReadX 9794 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9795
ReadX 9795 0 53 53
ReadX 9795 53 28 28
ReadX 9795 81 28 28
ReadX 9795 109 28 28
ReadX 9795 137 28 28
ReadX 9795 165 28 28
ReadX 9795 193 28 28
ReadX 9795 221 28 28
ReadX 9795 249 4 4
ReadX 9795 253 4 4
ReadX 9795 257 4 4
ReadX 9795 261 28 28
ReadX 9795 289 2 2
ReadX 9795 291 2 2
ReadX 9795 293 2 2
Close 9795
ReadX 9791 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9796
ReadX 9796 0 53 53
ReadX 9796 53 2 2
ReadX 9796 55 2 2
ReadX 9796 57 184 184
ReadX 9796 241 298 298
Close 9796
ReadX 9780 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9797
ReadX 9797 0 53 53
ReadX 9797 53 2 2
ReadX 9797 55 480 480
ReadX 9797 535 2 2
Close 9797
ReadX 9791 4096 16384 16384
ReadX 9791 1280 16384 16384
ReadX 9791 2304 6144 6144
ReadX 9791 2688 2048 2048
ReadX 9778 4096 16384 16384
ReadX 9778 1280 16384 16384
ReadX 9778 2304 16384 16384
ReadX 9778 3328 16384 16384
ReadX 9778 272 16384 16384
ReadX 9778 336 16384 16384
ReadX 9778 400 16384 16384
ReadX 9778 464 16384 16384
ReadX 9778 528 16384 16384
ReadX 9778 592 16384 16384
ReadX 9778 656 16384 16384
ReadX 9778 720 16384 16384
ReadX 9778 784 16384 16384
ReadX 9778 848 16384 16384
ReadX 9778 912 16384 16384
ReadX 9784 2048 2048 2048
ReadX 9783 760 2048 2048
ReadX 9783 1144 2048 2048
ReadX 9783 408 2048 2048
ReadX 9783 912 2048 2048
ReadX 9783 1096 2048 2048
ReadX 9783 776 2048 2048
ReadX 9783 560 2048 2048
ReadX 9783 376 2048 2048
ReadX 9783 320 2048 2048
ReadX 9783 3072 2048 2048
ReadX 9783 784 2048 2048
ReadX 9783 2176 2048 2048
ReadX 9783 792 2048 2048
ReadX 9783 576 2048 2048
ReadX 9783 600 2048 2048
ReadX 9783 728 2048 2048
ReadX 9783 1112 2048 2048
ReadX 9783 664 2048 2048
ReadX 9783 976 2048 2048
ReadX 9783 3840 2048 2048
ReadX 9783 296 2048 2048
ReadX 9783 480 2048 2048
ReadX 9783 680 2048 2048
ReadX 9783 696 2048 2048
ReadX 9783 832 2048 2048
ReadX 9783 1016 2048 2048
ReadX 9783 1104 2048 2048
ReadX 9783 3200 2048 2048
ReadX 9783 264 2048 2048
ReadX 9783 448 2048 2048
ReadX 9783 648 2048 2048
ReadX 9783 1136 2048 2048
ReadX 9783 288 2048 2048
ReadX 9783 352 2048 2048
ReadX 9783 536 2048 2048
ReadX 9783 800 2048 2048
ReadX 9783 736 2048 2048
ReadX 9783 392 2048 2048
ReadX 9783 752 2048 2048
ReadX 9783 880 2048 2048
ReadX 9783 1064 2048 2048
ReadX 9783 1128 2048 2048
ReadX 9783 1536 2048 2048
ReadX 9783 2432 2048 2048
ReadX 9783 688 2048 2048
ReadX 9783 872 2048 2048
ReadX 9783 1072 2048 2048
ReadX 9783 984 2048 2048
ReadX 9783 704 2048 2048
ReadX 9783 3328 2048 2048
ReadX 9783 888 2048 2048
ReadX 9783 496 2048 2048
ReadX 9783 624 2048 2048
ReadX 9783 808 2048 2048
ReadX 9783 1008 2048 2048
ReadX 9783 1152 2048 2048
ReadX 9783 416 2048 2048
ReadX 9783 584 2048 2048
ReadX 9783 384 2048 2048
ReadX 9783 568 2048 2048
ReadX 9783 512 2048 2048
ReadX 9783 1408 2048 2048
ReadX 9783 472 2048 2048
ReadX 9783 672 2048 2048
ReadX 9783 2560 2048 2048
ReadX 9783 544 2048 2048
ReadX 9783 920 2048 2048
ReadX 9783 1120 2048 2048
ReadX 9783 2304 2048 2048
ReadX 9783 1080 2048 2048
ReadX 9783 1664 2048 2048
ReadX 9783 608 2048 2048
ReadX 9783 2688 2048 2048
ReadX 9783 3712 2048 2048
ReadX 9783 616 2048 2048
ReadX 9783 632 2048 2048
ReadX 9783 944 2048 2048
ReadX 9783 856 2048 2048
ReadX 9783 768 2048 2048
ReadX 9783 720 2048 2048
ReadX 9783 640 2048 2048
ReadX 9783 1048 2048 2048
ReadX 9783 1040 2048 2048
ReadX 9783 1032 2048 2048
ReadX 9783 1000 2048 2048
ReadX 9783 992 2048 2048
ReadX 9783 968 2048 2048
ReadX 9783 952 2048 2048
ReadX 9783 1056 2048 2048
ReadX 9783 816 2048 2048
ReadX 9783 864 2048 2048
ReadX 9783 2816 2048 2048
ReadX 9783 640 2048 2048
ReadX 9783 1024 2048 2048
ReadX 9783 504 2048 2048
ReadX 9783 424 2048 2048
ReadX 9783 840 2048 2048
ReadX 9783 896 2048 2048
ReadX 9783 520 2048 2048
ReadX 9783 960 2048 2048
ReadX 9783 552 2048 2048
ReadX 9783 488 2048 2048
ReadX 9783 824 2048 2048
ReadX 9783 304 2048 2048
ReadX 9783 768 2048 2048
ReadX 9783 712 2048 2048
ReadX 9783 512 2048 2048
ReadX 9783 432 2048 2048
ReadX 9783 384 2048 2048
ReadX 9783 2944 2048 2048
ReadX 9783 1088 2048 2048
ReadX 9783 928 2048 2048
ReadX 9783 280 2048 2048
ReadX 9783 744 2048 2048
ReadX 9783 3968 2048 2048
ReadX 9783 336 2048 2048
ReadX 9783 592 2048 2048
ReadX 9783 312 2048 2048
ReadX 9783 400 2048 2048
ReadX 9783 904 2048 2048
ReadX 9783 464 2048 2048
ReadX 9783 3456 2048 2048
ReadX 9783 848 2048 2048
ReadX 9783 936 2048 2048
ReadX 9783 656 2048 2048
ReadX 9783 344 2048 2048
ReadX 9783 440 2048 2048
ReadX 9783 4096 2048 2048
ReadX 9783 528 2048 2048
ReadX 9783 2048 2048 2048
ReadX 9783 1024 2048 2048
ReadX 9783 456 2048 2048
ReadX 9783 1792 2048 2048
ReadX 9783 1152 2048 2048
ReadX 9783 3584 2048 2048
ReadX 9783 1920 2048 2048
ReadX 9783 1280 2048 2048
ReadX 9783 896 2048 2048
ReadX 9783 328 2048 2048
Close 9791
Close 9792
Close 9793
Close 9794
Close 9789
Close 9783
Close 9784
Close 9787
Close 9788
Close 9785
Close 9786
Close 9778
Close 9779
Close 9780
Close 9781
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9798
FIND_FIRST \clients\client1\~dmtmp\*
Close 9798
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9799
QUERY_FILE_INFORMATION 9799
WriteX 9799 0 2048 2048
WriteX 9799 18431 1 1
QUERY_FILE_INFORMATION 9799
WriteX 9799 2048 16384 16384
WriteX 9799 1152 16384 16384
WriteX 9799 2176 16384 16384
WriteX 9799 3200 16384 16384
WriteX 9799 264 16384 16384
WriteX 9799 328 16384 16384
WriteX 9799 392 16384 16384
WriteX 9799 456 16384 16384
WriteX 9799 520 16384 16384
WriteX 9799 584 16384 16384
WriteX 9799 648 16384 16384
WriteX 9799 712 16384 16384
WriteX 9799 776 16384 16384
WriteX 9799 840 16384 16384
WriteX 9799 904 16384 16384
WriteX 9799 968 16384 16384
WriteX 9799 1032 16384 16384
WriteX 9799 1096 16384 16384
WriteX 9799 1160 16384 16384
WriteX 9799 1224 16384 16384
WriteX 9799 1288 16384 16384
WriteX 9799 1352 16384 16384
WriteX 9799 1416 16384 16384
WriteX 9799 1480 16384 16384
WriteX 9799 1544 16384 16384
WriteX 9799 1608 16384 16384
WriteX 9799 1672 16384 16384
WriteX 9799 1736 16384 16384
WriteX 9799 1800 16384 16384
WriteX 9799 1864 16384 16384
WriteX 9799 1928 16384 16384
WriteX 9799 1992 16384 16384
WriteX 9799 2056 16384 16384
WriteX 9799 2120 16384 16384
WriteX 9799 2184 16384 16384
WriteX 9799 2248 16384 16384
WriteX 9799 2312 16384 16384
WriteX 9799 2376 16384 16384
WriteX 9799 2440 16384 16384
WriteX 9799 0 88 88
Close 9799
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9800
ReadX 9800 0 511 511
ReadX 9800 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9800
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9801
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9801 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9802
ReadX 9802 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9803
ReadX 9803 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9804
ReadX 9804 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9805
ReadX 9805 0 53 53
ReadX 9805 53 2 2
ReadX 9805 55 480 480
ReadX 9805 535 2 2
Close 9805
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9806
ReadX 9806 0 511 511
ReadX 9806 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9807
ReadX 9807 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9808
ReadX 9808 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9809
ReadX 9809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9810
ReadX 9810 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9811
ReadX 9811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9812
ReadX 9812 0 41 41
ReadX 9806 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9813
ReadX 9813 0 53 53
ReadX 9813 53 2 2
ReadX 9813 55 2 2
ReadX 9813 57 184 184
ReadX 9813 241 298 298
Close 9813
ReadX 9801 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9814
ReadX 9814 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9815
ReadX 9815 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9816
ReadX 9816 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9817
ReadX 9817 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9818
ReadX 9818 0 53 53
ReadX 9818 53 28 28
ReadX 9818 81 28 28
ReadX 9818 109 28 28
ReadX 9818 137 28 28
ReadX 9818 165 28 28
ReadX 9818 193 28 28
ReadX 9818 221 28 28
ReadX 9818 249 4 4
ReadX 9818 253 4 4
ReadX 9818 257 4 4
ReadX 9818 261 28 28
ReadX 9818 289 2 2
ReadX 9818 291 2 2
ReadX 9818 293 2 2
Close 9818
ReadX 9814 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9819
ReadX 9819 0 53 53
ReadX 9819 53 2 2
ReadX 9819 55 2 2
ReadX 9819 57 184 184
ReadX 9819 241 298 298
Close 9819
ReadX 9803 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9820
ReadX 9820 0 53 53
ReadX 9820 53 2 2
ReadX 9820 55 480 480
ReadX 9820 535 2 2
Close 9820
Close 9814
Close 9815
Close 9816
Close 9817
Close 9812
Close 9806
Close 9807
Close 9810
Close 9811
Close 9808
Close 9809
Close 9801
Close 9802
Close 9803
Close 9804
Close 9730
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 9821
QUERY_FILE_INFORMATION 9821
Close 9821
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 9748
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 9822
QUERY_FILE_INFORMATION 9822
Close 9822
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 9777
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 9823
QUERY_FILE_INFORMATION 9823
Close 9823
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9824
Close 9824
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9825
ReadX 9825 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9826
ReadX 9826 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9827
ReadX 9827 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9828
ReadX 9828 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9829
ReadX 9829 0 53 53
ReadX 9829 53 28 28
ReadX 9829 81 28 28
ReadX 9829 109 28 28
ReadX 9829 137 28 28
ReadX 9829 165 28 28
ReadX 9829 193 28 28
ReadX 9829 221 28 28
ReadX 9829 249 4 4
ReadX 9829 253 4 4
ReadX 9829 257 4 4
ReadX 9829 261 28 28
ReadX 9829 289 2 2
ReadX 9829 291 2 2
ReadX 9829 293 2 2
Close 9829
ReadX 9825 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 9825 384 2048 2048
ReadX 9825 768 16384 16384
ReadX 9825 1792 14336 14336
ReadX 9828 2048 2048 2048
ReadX 9827 2048 2048 2048
WriteX 9825 1152 2048 2048
WriteX 9828 2048 2048 2048
WriteX 9827 2048 2048 2048
WriteX 9825 0 88 88
WriteX 9826 0 88 88
WriteX 9827 0 88 88
WriteX 9828 0 88 88
Close 9825
Close 9826
Close 9827
Close 9828
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9830
Close 9830
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9831
ReadX 9831 0 511 511
ReadX 9831 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9832
ReadX 9832 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9833
ReadX 9833 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9834
ReadX 9834 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9835
ReadX 9835 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9836
ReadX 9836 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9837
ReadX 9837 0 53 53
ReadX 9837 53 2 2
ReadX 9837 55 2 2
ReadX 9837 57 184 184
ReadX 9837 241 298 298
Close 9837
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9838
ReadX 9838 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9839
ReadX 9839 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9840
ReadX 9840 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9841
ReadX 9841 0 511 511
ReadX 9840 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9842
ReadX 9842 0 53 53
ReadX 9842 53 2 2
ReadX 9842 55 480 480
ReadX 9842 535 2 2
Close 9842
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9843
ReadX 9843 0 41 41
ReadX 9831 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 9844
QUERY_FILE_INFORMATION 9844
QUERY_FILE_INFORMATION 9844
ReadX 9844 0 8192 8192
Close 9844
ReadX 9831 1152 2048 2048
ReadX 9831 4096 16384 16384
Close 9838
Close 9839
Close 9840
Close 9841
Close 9843
Close 9831
Close 9832
Close 9835
Close 9836
Close 9833
Close 9834
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9845
Close 9845
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9846
QUERY_FILE_INFORMATION 9846
ReadX 9846 0 64 64
ReadX 9846 144 64 64
ReadX 9846 224 156 156
ReadX 9846 1193 128 128
ReadX 9846 1201 128 128
ReadX 9846 1072 4 4
ReadX 9846 1076 1925 1925
ReadX 9846 758 4 4
ReadX 9846 762 4557 4557
ReadX 9846 1052 4 4
ReadX 9846 1056 314 314
ReadX 9846 1056 11056 11056
Close 9846
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9847
ReadX 9847 0 511 511
ReadX 9847 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9848
ReadX 9848 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9849
ReadX 9849 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9850
ReadX 9850 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9851
ReadX 9851 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9852
ReadX 9852 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9853
ReadX 9853 0 53 53
ReadX 9853 53 2 2
ReadX 9853 55 2 2
ReadX 9853 57 184 184
ReadX 9853 241 298 298
Close 9853
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9854
ReadX 9854 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9855
ReadX 9855 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9856
ReadX 9856 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9857
ReadX 9857 0 511 511
ReadX 9856 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9858
ReadX 9858 0 53 53
ReadX 9858 53 2 2
ReadX 9858 55 480 480
ReadX 9858 535 2 2
Close 9858
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9859
ReadX 9859 0 41 41
ReadX 9847 2048 2048 2048
ReadX 9848 2048 2048 2048
ReadX 9847 1144 2048 2048
ReadX 9847 1152 2048 2048
ReadX 9847 4096 16384 16384
WriteX 9847 2048 2048 2048
WriteX 9848 2048 2048 2048
WriteX 9847 0 88 88
WriteX 9848 0 88 88
Close 9854
Close 9855
Close 9856
Close 9857
Close 9859
Close 9847
Close 9848
Close 9851
Close 9852
Close 9849
Close 9850
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 9860
Close 9860
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 9861
QUERY_FILE_INFORMATION 9861
ReadX 9861 0 64 64
ReadX 9861 144 64 64
ReadX 9861 224 84 84
ReadX 9861 478 16 16
ReadX 9861 1056 6176 6176
Close 9861
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9862
ReadX 9862 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9863
ReadX 9863 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 9864
ReadX 9864 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9865
ReadX 9865 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 9866
ReadX 9866 0 53 53
ReadX 9866 53 28 28
ReadX 9866 81 28 28
ReadX 9866 109 28 28
ReadX 9866 137 28 28
ReadX 9866 165 28 28
ReadX 9866 193 28 28
ReadX 9866 221 28 28
ReadX 9866 249 4 4
ReadX 9866 253 4 4
ReadX 9866 257 4 4
ReadX 9866 261 28 28
ReadX 9866 289 2 2
ReadX 9866 291 2 2
ReadX 9866 293 2 2
Close 9866
ReadX 9862 2048 2048 2048
ReadX 9863 2048 2048 2048
ReadX 9862 1280 2048 2048
ReadX 9865 2048 2048 2048
ReadX 9864 2048 2048 2048
WriteX 9862 1280 2048 2048
WriteX 9865 2048 2048 2048
WriteX 9864 2048 2048 2048
WriteX 9863 2048 2048 2048
WriteX 9862 0 88 88
WriteX 9863 0 88 88
WriteX 9864 0 88 88
WriteX 9865 0 88 88
WriteX 9862 1280 2048 2048
WriteX 9865 2048 2048 2048
WriteX 9864 2048 2048 2048
WriteX 9863 2048 2048 2048
WriteX 9862 0 88 88
WriteX 9863 0 88 88
WriteX 9864 0 88 88
WriteX 9865 0 88 88
WriteX 9862 1280 2048 2048
WriteX 9865 2048 2048 2048
WriteX 9864 2048 2048 2048
WriteX 9863 2048 2048 2048
WriteX 9862 0 88 88
WriteX 9863 0 88 88
WriteX 9864 0 88 88
WriteX 9865 0 88 88
Close 9862
Close 9863
Close 9864
Close 9865
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9867
ReadX 9867 0 511 511
ReadX 9867 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9868
ReadX 9868 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9869
ReadX 9869 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9870
ReadX 9870 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9871
ReadX 9871 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9872
ReadX 9872 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9873
ReadX 9873 0 53 53
ReadX 9873 53 2 2
ReadX 9873 55 2 2
ReadX 9873 57 184 184
ReadX 9873 241 298 298
Close 9873
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9874
ReadX 9874 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9875
ReadX 9875 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9876
ReadX 9876 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9877
ReadX 9877 0 511 511
ReadX 9876 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9878
ReadX 9878 0 53 53
ReadX 9878 53 2 2
ReadX 9878 55 480 480
ReadX 9878 535 2 2
Close 9878
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9879
ReadX 9879 0 41 41
ReadX 9867 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 9883
FIND_FIRST \clients\client1\~dmtmp\*
Close 9883
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9884
QUERY_FILE_INFORMATION 9884
WriteX 9884 2047 1 1
QUERY_FILE_INFORMATION 9884
WriteX 9884 0 2048 2048
Close 9884
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9885
ReadX 9885 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 9885 4095 1 1
QUERY_FILE_INFORMATION 9885
WriteX 9885 2048 2048 2048
WriteX 9885 0 88 88
Close 9885
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9886
ReadX 9886 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 9886 2048 2048 2048
Close 9874
Close 9875
Close 9876
Close 9877
Close 9879
Close 9867
Close 9868
Close 9871
Close 9872
Close 9869
Close 9870
WriteX 9886 2048 2048 2048
WriteX 9886 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9887
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9887 0 511 511
ReadX 9887 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9888
ReadX 9888 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9889
ReadX 9889 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9890
ReadX 9890 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9891
ReadX 9891 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9892
ReadX 9892 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9893
ReadX 9893 0 53 53
ReadX 9893 53 2 2
ReadX 9893 55 2 2
ReadX 9893 57 184 184
ReadX 9893 241 298 298
Close 9893
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9894
ReadX 9894 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9895
ReadX 9895 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9896
ReadX 9896 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9897
ReadX 9897 0 511 511
ReadX 9896 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9898
ReadX 9898 0 53 53
ReadX 9898 53 2 2
ReadX 9898 55 480 480
ReadX 9898 535 2 2
Close 9898
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9899
ReadX 9899 0 41 41
ReadX 9887 2048 2048 2048
ReadX 9887 1152 2048 2048
ReadX 9887 4096 16384 16384
ReadX 9887 1280 16384 16384
ReadX 9887 2304 16384 16384
ReadX 9887 3328 16384 16384
ReadX 9887 272 16384 16384
ReadX 9887 336 16384 16384
ReadX 9887 400 16384 16384
ReadX 9887 464 16384 16384
ReadX 9887 528 16384 16384
ReadX 9887 592 16384 16384
ReadX 9887 656 16384 16384
ReadX 9887 720 16384 16384
ReadX 9887 784 16384 16384
ReadX 9887 848 16384 16384
ReadX 9887 912 16384 16384
ReadX 9887 976 16384 16384
ReadX 9887 1040 16384 16384
ReadX 9887 1104 12288 12288
Close 9894
Close 9895
Close 9896
Close 9897
Close 9899
Close 9887
Close 9888
Close 9891
Close 9892
Close 9889
Close 9890
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9900
FIND_FIRST \clients\client1\~dmtmp\*
Close 9900
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9901
QUERY_FILE_INFORMATION 9901
WriteX 9901 0 2048 2048
WriteX 9901 2048 4096 4096
WriteX 9901 0 88 88
Close 9901
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9902
ReadX 9902 0 511 511
ReadX 9902 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9902
WriteX 9886 2048 2048 2048
WriteX 9886 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9903
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9903 0 511 511
ReadX 9903 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9904
ReadX 9904 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9905
ReadX 9905 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9906
ReadX 9906 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9907
ReadX 9907 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9908
ReadX 9908 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9909
ReadX 9909 0 53 53
ReadX 9909 53 2 2
ReadX 9909 55 2 2
ReadX 9909 57 184 184
ReadX 9909 241 298 298
Close 9909
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9910
ReadX 9910 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9911
ReadX 9911 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9912
ReadX 9912 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9913
ReadX 9913 0 511 511
ReadX 9912 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9914
ReadX 9914 0 53 53
ReadX 9914 53 2 2
ReadX 9914 55 480 480
ReadX 9914 535 2 2
Close 9914
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9915
ReadX 9915 0 41 41
ReadX 9903 2048 2048 2048
ReadX 9903 1152 2048 2048
ReadX 9903 4096 16384 16384
ReadX 9903 1280 16384 16384
ReadX 9903 2304 16384 16384
ReadX 9903 3328 16384 16384
ReadX 9903 272 16384 16384
ReadX 9903 336 16384 16384
ReadX 9903 400 16384 16384
ReadX 9903 464 16384 16384
ReadX 9903 528 16384 16384
ReadX 9903 592 16384 16384
ReadX 9903 656 16384 16384
ReadX 9903 720 16384 16384
ReadX 9903 784 16384 16384
ReadX 9903 848 16384 16384
ReadX 9903 912 16384 16384
ReadX 9903 976 16384 16384
ReadX 9903 1040 16384 16384
ReadX 9903 1104 12288 12288
Close 9910
Close 9911
Close 9912
Close 9913
Close 9915
Close 9903
Close 9904
Close 9907
Close 9908
Close 9905
Close 9906
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9916
FIND_FIRST \clients\client1\~dmtmp\*
Close 9916
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9917
QUERY_FILE_INFORMATION 9917
WriteX 9917 0 2048 2048
WriteX 9917 2048 4096 4096
WriteX 9917 0 88 88
Close 9917
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9918
ReadX 9918 0 511 511
ReadX 9918 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 9918
Close 9886
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 9919
QUERY_FILE_INFORMATION 9919
Close 9919
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9920
Close 9920
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9921
QUERY_FILE_INFORMATION 9921
ReadX 9921 0 64 64
ReadX 9921 144 64 64
ReadX 9921 224 156 156
ReadX 9921 1193 128 128
ReadX 9921 1201 128 128
ReadX 9921 1072 4 4
ReadX 9921 1076 1925 1925
ReadX 9921 758 4 4
ReadX 9921 762 4557 4557
ReadX 9921 1052 4 4
ReadX 9921 1056 314 314
ReadX 9921 1056 11056 11056
Close 9921
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9922
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9922 0 511 511
ReadX 9922 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9923
ReadX 9923 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9924
ReadX 9924 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9925
ReadX 9925 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9926
ReadX 9926 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9927
ReadX 9927 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9928
ReadX 9928 0 53 53
ReadX 9928 53 2 2
ReadX 9928 55 2 2
ReadX 9928 57 184 184
ReadX 9928 241 298 298
Close 9928
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9929
ReadX 9929 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9930
ReadX 9930 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9931
ReadX 9931 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9932
ReadX 9932 0 511 511
ReadX 9931 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9933
ReadX 9933 0 53 53
ReadX 9933 53 2 2
ReadX 9933 55 480 480
ReadX 9933 535 2 2
Close 9933
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9934
ReadX 9934 0 41 41
ReadX 9922 2048 2048 2048
ReadX 9922 1152 2048 2048
ReadX 9922 4096 16384 16384
Close 9929
Close 9930
Close 9931
Close 9932
Close 9934
Close 9922
Close 9923
Close 9926
Close 9927
Close 9924
Close 9925
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9935
ReadX 9935 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9936
ReadX 9936 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9937
ReadX 9937 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9938
ReadX 9938 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9939
ReadX 9939 0 53 53
ReadX 9939 53 2 2
ReadX 9939 55 480 480
ReadX 9939 535 2 2
Close 9939
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9940
ReadX 9940 0 511 511
ReadX 9940 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9941
ReadX 9941 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9942
ReadX 9942 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9943
ReadX 9943 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9944
ReadX 9944 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9945
ReadX 9945 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9946
ReadX 9946 0 41 41
ReadX 9940 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9947
ReadX 9947 0 53 53
ReadX 9947 53 2 2
ReadX 9947 55 2 2
ReadX 9947 57 184 184
ReadX 9947 241 298 298
Close 9947
ReadX 9935 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 9951
FIND_FIRST \clients\client1\~dmtmp\*
Close 9951
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9952
QUERY_FILE_INFORMATION 9952
WriteX 9952 2047 1 1
QUERY_FILE_INFORMATION 9952
WriteX 9952 0 2048 2048
Close 9952
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9953
ReadX 9953 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 9953 4095 1 1
QUERY_FILE_INFORMATION 9953
WriteX 9953 2048 2048 2048
WriteX 9953 0 88 88
Close 9953
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9954
ReadX 9954 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 9954 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 9958
Close 9958
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9959
QUERY_FILE_INFORMATION 9959
WriteX 9959 2047 1 1
QUERY_FILE_INFORMATION 9959
WriteX 9959 0 2048 2048
Close 9959
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9960
ReadX 9960 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 9960 4095 1 1
QUERY_FILE_INFORMATION 9960
WriteX 9960 2048 2048 2048
WriteX 9960 0 88 88
Close 9960
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9961
ReadX 9961 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 9961 2048 2048 2048
Close 9946
Close 9940
Close 9941
Close 9944
Close 9945
Close 9942
Close 9943
Close 9935
Close 9936
Close 9937
Close 9938
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9962
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9962 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9963
ReadX 9963 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 9964
ReadX 9964 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 9965
ReadX 9965 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 9966
ReadX 9966 0 53 53
ReadX 9966 53 2 2
ReadX 9966 55 480 480
ReadX 9966 535 2 2
Close 9966
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9967
ReadX 9967 0 511 511
ReadX 9967 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 9968
ReadX 9968 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 9969
ReadX 9969 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 9970
ReadX 9970 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 9971
ReadX 9971 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 9972
ReadX 9972 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9973
ReadX 9973 0 41 41
ReadX 9967 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 9974
ReadX 9974 0 53 53
ReadX 9974 53 2 2
ReadX 9974 55 2 2
ReadX 9974 57 184 184
ReadX 9974 241 298 298
Close 9974
ReadX 9962 2048 2048 2048
ReadX 9962 384 16384 16384
ReadX 9962 1408 16384 16384
ReadX 9962 2560 16384 16384
ReadX 9962 3584 16384 16384
ReadX 9962 288 16384 16384
ReadX 9962 352 16384 16384
ReadX 9962 416 16384 16384
ReadX 9962 480 16384 16384
ReadX 9962 552 16384 16384
ReadX 9962 616 16384 16384
ReadX 9962 680 16384 16384
ReadX 9962 744 16384 16384
ReadX 9962 808 16384 16384
ReadX 9962 872 16384 16384
ReadX 9962 936 10240 10240
Close 9973
Close 9967
Close 9968
Close 9971
Close 9972
Close 9969
Close 9970
Close 9962
Close 9963
Close 9964
Close 9965
Close 9954
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 9975
QUERY_FILE_INFORMATION 9975
Close 9975
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 9961
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 9976
QUERY_FILE_INFORMATION 9976
Close 9976
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 9977
ReadX 9977 0 65471 65471
ReadX 9977 65471 63 63
ReadX 9977 65534 65471 65471
ReadX 9977 131005 63 63
ReadX 9977 131068 65471 65471
ReadX 9977 196539 63 63
ReadX 9977 196602 65471 65471
ReadX 9977 262073 63 63
ReadX 9977 262136 65471 65471
ReadX 9977 327607 63 63
ReadX 9977 327670 10 10
Close 9977
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 9978
ReadX 9978 0 65471 65471
ReadX 9978 65471 63 63
ReadX 9978 65534 65471 65471
ReadX 9978 131005 63 63
ReadX 9978 131068 65471 65471
ReadX 9978 196539 63 63
ReadX 9978 196602 65471 65471
ReadX 9978 262073 63 63
ReadX 9978 262136 65471 65471
ReadX 9978 327607 63 63
ReadX 9978 327670 65471 65471
ReadX 9978 393141 63 63
ReadX 9978 393204 65471 65471
ReadX 9978 458675 63 63
ReadX 9978 458738 65471 65471
ReadX 9978 524209 63 63
ReadX 9978 524272 65471 65471
ReadX 9978 589743 63 63
ReadX 9978 589806 65471 65471
ReadX 9978 655277 63 63
ReadX 9978 655340 32 32
Close 9978
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 9979
ReadX 9979 0 65471 65471
ReadX 9979 65471 63 63
ReadX 9979 65534 65471 65471
ReadX 9979 131005 63 63
ReadX 9979 131068 65471 65471
ReadX 9979 196539 63 63
ReadX 9979 196602 65471 65471
ReadX 9979 262073 63 63
ReadX 9979 262136 65471 65471
ReadX 9979 327607 63 63
ReadX 9979 327670 65471 65471
ReadX 9979 393141 63 63
ReadX 9979 393204 65471 65471
ReadX 9979 458675 63 63
ReadX 9979 458738 65471 65471
ReadX 9979 524209 63 63
ReadX 9979 524272 65471 65471
ReadX 9979 589743 63 63
ReadX 9979 589806 65471 65471
ReadX 9979 655277 63 63
ReadX 9979 655340 65471 65471
ReadX 9979 720811 63 63
ReadX 9979 720874 65471 65471
ReadX 9979 786345 63 63
ReadX 9979 786408 65471 65471
ReadX 9979 851879 63 63
ReadX 9979 851942 65471 65471
ReadX 9979 917413 63 63
ReadX 9979 917476 65471 65471
ReadX 9979 982947 63 63
ReadX 9979 983010 65471 65471
ReadX 9979 1048481 63 63
ReadX 9979 1048544 65471 65471
ReadX 9979 1114015 63 63
ReadX 9979 1114078 65471 65471
ReadX 9979 1179549 63 63
ReadX 9979 1179612 65471 65471
ReadX 9979 1245083 63 63
ReadX 9979 1245146 65471 65471
ReadX 9979 1310617 63 63
ReadX 9979 1310680 65471 65471
ReadX 9979 1376151 63 63
ReadX 9979 1376214 65471 65471
ReadX 9979 1441685 63 63
ReadX 9979 1441748 65471 65471
ReadX 9979 1507219 63 63
ReadX 9979 1507282 65471 65471
ReadX 9979 1572753 63 63
ReadX 9979 1572816 65471 65471
ReadX 9979 1638287 63 63
ReadX 9979 1638350 65471 65471
ReadX 9979 1703821 63 63
ReadX 9979 1703884 65471 65471
ReadX 9979 1769355 63 63
ReadX 9979 1769418 65471 65471
ReadX 9979 1834889 63 63
ReadX 9979 1834952 32824 32824
Close 9979
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 9980
QUERY_FILE_INFORMATION 9980
ReadX 9980 0 512 512
ReadX 9980 512 512 512
ReadX 9980 1024 512 512
QUERY_FILE_INFORMATION 9980
QUERY_FILE_INFORMATION 9980
ReadX 9980 2560 2048 2048
ReadX 9980 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 9981
WriteX 9981 52 1 1
QUERY_FILE_INFORMATION 9981
WriteX 9981 0 53 53
Close 9981
ReadX 9980 2208 650 650
ReadX 9980 1920 2048 2048
ReadX 9980 2112 2048 2048
ReadX 9980 1856 2048 2048
ReadX 9980 1824 2048 2048
ReadX 9980 1536 512 512
ReadX 9980 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 9982
Close 9982
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 9980 1568 512 512
ReadX 9980 1536 512 512
ReadX 9980 2176 384 384
ReadX 9980 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 9983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 9980 288 2048 2048
ReadX 9980 2336 2048 2048
ReadX 9980 4384 2048 2048
ReadX 9980 6432 2048 2048
ReadX 9980 8480 2048 2048
ReadX 9980 10528 2048 2048
ReadX 9980 12576 2048 2048
WriteX 9983 15359 1 1
QUERY_FILE_INFORMATION 9983
ReadX 9980 14624 2048 2048
ReadX 9980 16672 2048 2048
ReadX 9980 18720 2048 2048
ReadX 9980 1728 2048 2048
WriteX 9983 0 15360 15360
Close 9983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 9984
QUERY_FILE_INFORMATION 9984
ReadX 9984 0 512 512
ReadX 9984 2048 512 512
ReadX 9984 2560 512 512
QUERY_FILE_INFORMATION 9984
QUERY_FILE_INFORMATION 9984
QUERY_FILE_INFORMATION 9984
QUERY_FILE_INFORMATION 9984
QUERY_FILE_INFORMATION 9984
WriteX 9984 2152 384 384
QUERY_FILE_INFORMATION 9984
WriteX 9984 2150 22 22
WriteX 9984 2144 106 106
QUERY_FILE_INFORMATION 9984
WriteX 9984 2176 496 496
ReadX 9984 2176 496 496
QUERY_FILE_INFORMATION 9984
WriteX 9984 2440 384 384
QUERY_FILE_INFORMATION 9984
WriteX 9984 2152 384 384
WriteX 9984 2432 112 112
QUERY_FILE_INFORMATION 9984
WriteX 9984 2439 16 16
QUERY_FILE_INFORMATION 9984
WriteX 9984 2208 220 220
ReadX 9984 2208 220 220
QUERY_FILE_INFORMATION 9984
QUERY_FILE_INFORMATION 9984
WriteX 9984 2440 220 220
QUERY_FILE_INFORMATION 9984
WriteX 9984 2453 36 36
WriteX 9984 2080 512 512
WriteX 9984 2176 512 512
WriteX 9984 2112 512 512
WriteX 9984 2048 512 512
WriteX 9984 0 512 512
QUERY_FILE_INFORMATION 9980
QUERY_FILE_INFORMATION 9980
WriteX 9984 2080 512 512
Close 9984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 9985
Close 9985
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 9986
QUERY_FILE_INFORMATION 9986
ReadX 9986 0 512 512
ReadX 9986 2048 512 512
ReadX 9986 2560 512 512
QUERY_FILE_INFORMATION 9986
QUERY_FILE_INFORMATION 9986
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 9987
Close 9987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 9980
ReadX 9986 1408 512 512
ReadX 9986 2048 512 512
ReadX 9986 1536 512 512
ReadX 9986 2560 512 512
ReadX 9986 3072 512 512
ReadX 9986 3584 512 512
ReadX 9986 4096 512 512
ReadX 9986 4608 512 512
ReadX 9986 5120 512 512
ReadX 9986 5632 512 512
ReadX 9986 6144 512 512
ReadX 9986 6656 512 512
ReadX 9986 7168 512 512
ReadX 9986 7680 512 512
ReadX 9986 8192 512 512
ReadX 9986 8704 512 512
ReadX 9986 9216 512 512
ReadX 9986 9728 512 512
ReadX 9986 10240 512 512
ReadX 9986 10752 512 512
ReadX 9986 11264 512 512
ReadX 9986 11776 512 512
ReadX 9986 12288 512 512
ReadX 9986 12800 512 512
ReadX 9986 13312 512 512
ReadX 9986 13824 512 512
ReadX 9986 14336 512 512
ReadX 9986 14848 512 512
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 15360 512 0
ReadX 9986 2560 2048 2048
ReadX 9986 4608 2048 2048
ReadX 9986 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 9988
QUERY_FILE_INFORMATION 9988
ReadX 9988 0 512 512
ReadX 9988 512 512 512
ReadX 9988 1024 512 512
QUERY_FILE_INFORMATION 9988
QUERY_FILE_INFORMATION 9988
ReadX 9988 352 2048 2048
ReadX 9988 608 1097 1097
ReadX 9988 576 1609 1609
ReadX 9988 4096 512 512
ReadX 9988 1536 512 512
ReadX 9988 3840 256 256
ReadX 9988 288 576 576
ReadX 9988 512 512 512
ReadX 9988 480 512 512
ReadX 9988 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 9989
ReadX 9989 0 4096 4096
ReadX 9989 4096 4096 4096
ReadX 9989 8192 4096 4096
Close 9988
Close 9989
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 9990
WriteX 9990 15359 1 1
QUERY_FILE_INFORMATION 9990
WriteX 9990 0 15360 15360
Close 9990
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 9991
QUERY_FILE_INFORMATION 9991
ReadX 9991 0 512 512
ReadX 9991 2048 512 512
ReadX 9991 2560 512 512
QUERY_FILE_INFORMATION 9991
QUERY_FILE_INFORMATION 9991
QUERY_FILE_INFORMATION 9991
QUERY_FILE_INFORMATION 9991
QUERY_FILE_INFORMATION 9991
WriteX 9991 2152 384 384
QUERY_FILE_INFORMATION 9991
WriteX 9991 2150 22 22
WriteX 9991 2144 106 106
QUERY_FILE_INFORMATION 9991
WriteX 9991 2176 476 476
ReadX 9991 2176 476 476
QUERY_FILE_INFORMATION 9991
WriteX 9991 2440 384 384
QUERY_FILE_INFORMATION 9991
WriteX 9991 2152 384 384
WriteX 9991 2432 92 92
QUERY_FILE_INFORMATION 9991
WriteX 9991 2437 36 36
QUERY_FILE_INFORMATION 9991
WriteX 9991 2208 220 220
ReadX 9991 2208 220 220
QUERY_FILE_INFORMATION 9991
QUERY_FILE_INFORMATION 9991
WriteX 9991 2440 220 220
QUERY_FILE_INFORMATION 9991
WriteX 9991 2453 36 36
WriteX 9991 2080 512 512
WriteX 9991 2176 512 512
WriteX 9991 2112 512 512
WriteX 9991 2048 512 512
WriteX 9991 0 512 512
QUERY_FILE_INFORMATION 9986
QUERY_FILE_INFORMATION 9986
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 9986
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 9992
Close 9992
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 9993
QUERY_FILE_INFORMATION 9993
ReadX 9993 0 512 512
ReadX 9993 2048 512 512
ReadX 9993 2560 512 512
QUERY_FILE_INFORMATION 9993
QUERY_FILE_INFORMATION 9993
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 9994
Close 9994
WriteX 9991 2080 512 512
Close 9991
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 9995
Close 9995
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 9996
QUERY_FILE_INFORMATION 9996
ReadX 9996 0 512 512
ReadX 9996 2048 512 512
ReadX 9996 2560 512 512
QUERY_FILE_INFORMATION 9996
QUERY_FILE_INFORMATION 9996
ReadX 9996 1312 512 512
ReadX 9996 1536 512 512
ReadX 9996 2048 512 512
ReadX 9996 576 512 512
ReadX 9996 1088 512 512
ReadX 9996 1056 512 512
ReadX 9996 1120 512 512
ReadX 9996 1184 512 512
ReadX 9996 2560 2048 2048
ReadX 9996 4608 2048 2048
ReadX 9996 6656 2048 2048
ReadX 9996 8704 2048 2048
ReadX 9996 10752 2048 2048
ReadX 9996 12800 2048 2048
ReadX 9996 14848 2048 512
ReadX 9996 15360 1536 0
ReadX 9996 1088 2048 2048
ReadX 9996 3136 2048 2048
ReadX 9996 1665 5835 5835
ReadX 9996 1856 2048 2048
ReadX 9996 2112 512 512
ReadX 9996 2152 384 384
ReadX 9996 2432 92 92
ReadX 9996 2176 512 512
ReadX 9996 2440 220 220
QUERY_FILE_INFORMATION 9996
QUERY_FILE_INFORMATION 9996
ReadX 9996 2432 512 512
WriteX 9996 2272 512 512
ReadX 9996 2144 512 512
WriteX 9996 2304 512 512
WriteX 9996 2272 92 92
WriteX 9996 2208 512 512
WriteX 9996 2720 512 512
WriteX 9996 0 512 512
QUERY_FILE_INFORMATION 9996
QUERY_FILE_INFORMATION 9996
ReadX 9996 1312 4096 4096
ReadX 9996 5408 4096 4096
ReadX 9996 9504 3305 3305
ReadX 9996 512 4096 4096
QUERY_FILE_INFORMATION 9996
QUERY_FILE_INFORMATION 9996
QUERY_FILE_INFORMATION 9996
WriteX 9996 3132 50 50
WriteX 9996 3182 4096 4096
WriteX 9996 7278 4096 4096
WriteX 9996 15469 1 1
QUERY_FILE_INFORMATION 9996
WriteX 9996 11374 4096 4096
WriteX 9996 15470 3584 3584
WriteX 9996 2144 512 512
WriteX 9996 2336 4096 4096
WriteX 9996 6432 4096 4096
WriteX 9996 10528 4096 4096
WriteX 9996 14624 462 462
WriteX 9996 2048 512 512
WriteX 9996 2560 512 512
WriteX 9996 0 512 512
QUERY_FILE_INFORMATION 9996
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 9997
QUERY_FILE_INFORMATION 9997
ReadX 9997 0 512 512
ReadX 9997 1152 512 512
ReadX 9997 1664 512 512
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
ReadX 9997 512 2048 2048
ReadX 9997 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 9998
WriteX 9998 52 1 1
QUERY_FILE_INFORMATION 9998
WriteX 9998 0 53 53
Close 9998
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
ReadX 9997 1120 504 504
ReadX 9997 896 2048 2048
ReadX 9997 1056 1528 1528
ReadX 9997 864 2048 2048
ReadX 9997 832 2048 2048
ReadX 9997 736 2048 2048
ReadX 9997 1216 512 512
ReadX 9997 1256 384 384
ReadX 9997 1536 140 140
ReadX 9997 1280 512 512
ReadX 9997 1548 252 252
ReadX 9996 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 9999
Close 9999
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 10000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 9997 2560 2048 2048
ReadX 9997 4608 2048 2048
ReadX 9997 6656 2048 2048
ReadX 9997 8704 2048 2048
ReadX 9997 10752 2048 2048
WriteX 10000 12005 1 1
QUERY_FILE_INFORMATION 10000
WriteX 10000 0 12006 12006
Close 10000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 10001
QUERY_FILE_INFORMATION 10001
ReadX 10001 0 512 512
ReadX 10001 1152 512 512
ReadX 10001 1664 512 512
QUERY_FILE_INFORMATION 10001
QUERY_FILE_INFORMATION 10001
QUERY_FILE_INFORMATION 10001
QUERY_FILE_INFORMATION 10001
QUERY_FILE_INFORMATION 10001
QUERY_FILE_INFORMATION 10001
QUERY_FILE_INFORMATION 10001
WriteX 10001 1256 384 384
QUERY_FILE_INFORMATION 10001
WriteX 10001 1254 22 22
WriteX 10001 1248 106 106
QUERY_FILE_INFORMATION 10001
WriteX 10001 1280 508 508
ReadX 10001 1280 508 508
QUERY_FILE_INFORMATION 10001
WriteX 10001 1544 384 384
QUERY_FILE_INFORMATION 10001
WriteX 10001 1256 384 384
WriteX 10001 1536 124 124
QUERY_FILE_INFORMATION 10001
WriteX 10001 1543 4 4
QUERY_FILE_INFORMATION 10001
WriteX 10001 1312 252 252
ReadX 10001 1312 252 252
QUERY_FILE_INFORMATION 10001
QUERY_FILE_INFORMATION 10001
WriteX 10001 1544 252 252
QUERY_FILE_INFORMATION 10001
WriteX 10001 1559 4 4
WriteX 10001 1184 512 512
WriteX 10001 1280 512 512
WriteX 10001 1216 512 512
WriteX 10001 1152 512 512
WriteX 10001 0 512 512
QUERY_FILE_INFORMATION 9997
QUERY_FILE_INFORMATION 9997
WriteX 10001 1184 512 512
Close 10001
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 10002
Close 10002
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 10003
QUERY_FILE_INFORMATION 10003
ReadX 10003 0 512 512
ReadX 10003 1152 512 512
ReadX 10003 1664 512 512
QUERY_FILE_INFORMATION 10003
QUERY_FILE_INFORMATION 10003
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 10004
Close 10004
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 9997
ReadX 10003 736 512 512
ReadX 10003 1536 2048 2048
ReadX 10003 3584 2048 2048
ReadX 10003 5632 2048 2048
ReadX 10003 7680 2048 2048
ReadX 10003 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 10005
WriteX 10005 11990 1 1
QUERY_FILE_INFORMATION 10005
WriteX 10005 0 11991 11991
Close 10005
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 10006
QUERY_FILE_INFORMATION 10006
ReadX 10006 0 512 512
ReadX 10006 1184 512 512
ReadX 10006 1696 512 512
QUERY_FILE_INFORMATION 10006
QUERY_FILE_INFORMATION 10006
QUERY_FILE_INFORMATION 10006
QUERY_FILE_INFORMATION 10006
QUERY_FILE_INFORMATION 10006
QUERY_FILE_INFORMATION 10006
QUERY_FILE_INFORMATION 10006
WriteX 10006 1288 384 384
QUERY_FILE_INFORMATION 10006
WriteX 10006 1286 22 22
WriteX 10006 1280 106 106
QUERY_FILE_INFORMATION 10006
WriteX 10006 1312 508 508
ReadX 10006 1312 508 508
QUERY_FILE_INFORMATION 10006
WriteX 10006 1576 384 384
QUERY_FILE_INFORMATION 10006
WriteX 10006 1288 384 384
WriteX 10006 1568 124 124
QUERY_FILE_INFORMATION 10006
WriteX 10006 1575 4 4
QUERY_FILE_INFORMATION 10006
WriteX 10006 1344 252 252
ReadX 10006 1344 252 252
QUERY_FILE_INFORMATION 10006
QUERY_FILE_INFORMATION 10006
WriteX 10006 1576 252 252
QUERY_FILE_INFORMATION 10006
WriteX 10006 1591 4 4
WriteX 10006 1216 512 512
WriteX 10006 1312 512 512
WriteX 10006 1248 512 512
WriteX 10006 1184 512 512
WriteX 10006 0 512 512
QUERY_FILE_INFORMATION 10003
QUERY_FILE_INFORMATION 10003
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 10003
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 10007
Close 10007
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 10008
QUERY_FILE_INFORMATION 10008
ReadX 10008 0 512 512
ReadX 10008 1152 512 512
ReadX 10008 1664 512 512
QUERY_FILE_INFORMATION 10008
QUERY_FILE_INFORMATION 10008
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 10009
Close 10009
WriteX 10006 1216 512 512
Close 10006
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 10010
Close 10010
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 10011
QUERY_FILE_INFORMATION 10011
ReadX 10011 0 512 512
ReadX 10011 1184 512 512
ReadX 10011 1696 512 512
QUERY_FILE_INFORMATION 10011
QUERY_FILE_INFORMATION 10011
ReadX 10011 1536 512 512
ReadX 10011 736 512 512
ReadX 10011 2048 512 512
ReadX 10011 2560 512 512
ReadX 10011 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 10012
Close 10012
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 10011 914 3899 3899
ReadX 10011 1248 512 512
ReadX 10011 1288 384 384
ReadX 10011 1568 124 124
ReadX 10011 1312 512 512
ReadX 10011 1576 252 252
QUERY_FILE_INFORMATION 10011
QUERY_FILE_INFORMATION 10011
ReadX 10011 1568 512 512
WriteX 10011 1408 512 512
ReadX 10011 1280 512 512
WriteX 10011 1440 512 512
WriteX 10011 1408 124 124
WriteX 10011 1344 512 512
WriteX 10011 1856 512 512
WriteX 10011 0 512 512
QUERY_FILE_INFORMATION 10011
QUERY_FILE_INFORMATION 10011
ReadX 10011 544 4096 4096
ReadX 10011 4640 4096 4096
ReadX 10011 8736 1637 1637
ReadX 10011 512 4096 4096
QUERY_FILE_INFORMATION 10011
QUERY_FILE_INFORMATION 10011
WriteX 10011 1280 512 512
WriteX 10011 1472 3584 3584
WriteX 10011 5056 4096 4096
WriteX 10011 13247 1 1
QUERY_FILE_INFORMATION 10011
WriteX 10011 9152 4096 4096
WriteX 10011 13248 1736 1736
WriteX 10011 1184 512 512
WriteX 10011 1696 512 512
WriteX 10011 0 512 512
QUERY_FILE_INFORMATION 10011
ReadX 10011 1632 1024 1024
ReadX 10011 288 1024 1024
ReadX 10011 1312 2048 2048
ReadX 10011 3360 1024 1024
ReadX 10011 1696 1024 1024
ReadX 10011 2720 512 512
ReadX 10011 3232 512 512
ReadX 10011 3744 512 512
ReadX 10011 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 10011 2066 3998 3998
ReadX 10011 1448 384 384
ReadX 10011 1408 124 124
ReadX 10011 1416 252 252
QUERY_FILE_INFORMATION 10011
QUERY_FILE_INFORMATION 10011
ReadX 10011 1408 512 512
WriteX 10011 1536 512 512
ReadX 10011 1440 512 512
WriteX 10011 2048 512 512
WriteX 10011 1536 124 124
WriteX 10011 512 512 512
WriteX 10011 1024 512 512
WriteX 10011 0 512 512
QUERY_FILE_INFORMATION 10011
ReadX 10011 1696 4096 4096
ReadX 10011 5792 4096 4096
ReadX 10011 9888 1736 1736
ReadX 10011 1280 512 512
ReadX 10011 1472 3584 3584
QUERY_FILE_INFORMATION 10011
QUERY_FILE_INFORMATION 10011
WriteX 10011 3940 156 156
WriteX 10011 4096 512 512
WriteX 10011 544 3584 3584
WriteX 10011 4128 4096 4096
WriteX 10011 8224 3584 3584
WriteX 10011 1344 512 512
WriteX 10011 1856 1536 1536
WriteX 10011 2336 512 512
WriteX 10011 3584 356 356
WriteX 10011 2560 512 512
WriteX 10011 3072 512 512
WriteX 10011 0 512 512
QUERY_FILE_INFORMATION 10011
Close 9993
Close 9996
Close 10011
Close 10008
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 10013
Close 10013
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 10014
Close 10014
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10015
WriteX 10015 0 65471 65471
WriteX 10015 65471 63 63
WriteX 10015 65534 65471 65471
WriteX 10015 131005 63 63
Close 10015
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10016
WriteX 10016 0 65471 65471
WriteX 10016 65471 63 63
WriteX 10016 65534 65471 65471
WriteX 10016 131005 63 63
WriteX 10016 131068 65471 65471
WriteX 10016 196539 63 63
WriteX 10016 196602 65471 65471
WriteX 10016 262073 63 63
Close 10016
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10017
WriteX 10017 0 65471 65471
WriteX 10017 65471 63 63
WriteX 10017 65534 65471 65471
WriteX 10017 131005 63 63
WriteX 10017 131068 65471 65471
WriteX 10017 196539 63 63
WriteX 10017 196602 65471 65471
WriteX 10017 262073 63 63
WriteX 10017 262136 65471 65471
WriteX 10017 327607 63 63
WriteX 10017 327670 65471 65471
WriteX 10017 393141 63 63
WriteX 10017 393204 65471 65471
WriteX 10017 458675 63 63
WriteX 10017 458738 65471 65471
WriteX 10017 524209 63 63
Close 10017
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 10018
QUERY_FILE_INFORMATION 10018
QUERY_FILE_INFORMATION 10018
ReadX 10018 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 10019
Close 10019
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 10020
WriteX 10020 63 1 1
QUERY_FILE_INFORMATION 10020
WriteX 10020 0 64 64
ReadX 10018 992 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 344 2048 2048
ReadX 10018 1344 2048 2048
ReadX 10018 1352 2048 2048
ReadX 10018 1320 2048 2048
ReadX 10018 1360 2048 2048
ReadX 10018 1344 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2304 2048 2048
ReadX 10018 1472 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 1480 2048 2048
ReadX 10018 1488 2048 2048
ReadX 10018 1496 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 1504 2048 2048
ReadX 10018 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 1000 2048 2048
ReadX 10018 1416 2048 2048
ReadX 10018 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10018 360 2048 2048
ReadX 10018 368 2048 2048
ReadX 10018 360 2048 2048
ReadX 10018 376 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 1232 2048 2048
ReadX 10018 2432 6144 6144
ReadX 10018 2376 2048 2048
ReadX 10018 2360 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 2376 2048 2048
ReadX 10018 2384 2048 2048
ReadX 10018 2368 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 1296 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 10018 0 2048 2048
ReadX 10018 2688 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 2688 2048 2048
WriteX 10018 2688 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 2688 2048 2048
ReadX 10018 2688 2048 2048
ReadX 10018 2688 2048 2048
WriteX 10018 2688 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10018 2688 2048 2048
ReadX 10018 2688 2048 2048
WriteX 10018 2688 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 320 4096 4096
ReadX 10018 0 2048 2048
ReadX 10018 3584 2048 2048
ReadX 10018 3584 2048 2048
ReadX 10018 3584 2048 2048
ReadX 10018 0 2048 2048
WriteX 10018 3584 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2688 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 2688 2048 2048
ReadX 10018 2688 2048 2048
WriteX 10018 2688 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 3200 2048 2048
ReadX 10018 3200 2048 2048
ReadX 10018 3200 2048 2048
WriteX 10018 3200 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 3456 2048 2048
ReadX 10018 3456 2048 2048
ReadX 10018 3456 2048 2048
WriteX 10018 3456 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2496 2048 2048
ReadX 10018 2472 2048 2048
ReadX 10018 2456 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 2472 2048 2048
ReadX 10018 2480 2048 2048
ReadX 10018 2464 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 2488 2048 2048
ReadX 10018 2568 8192 8192
ReadX 10018 1000 2048 2048
ReadX 10018 328 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 2048 2048 2048
ReadX 10018 2560 2048 2048
ReadX 10018 920 2048 2048
WriteX 10018 2048 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 312 2048 2048
WriteX 10018 336 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 328 2048 2048
WriteX 10018 2560 2048 2048
WriteX 10018 3840 2048 2048
WriteX 10018 920 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2432 2048 2048
WriteX 10018 2432 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2456 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 328 2048 2048
ReadX 10018 2560 2048 2048
ReadX 10018 2048 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 336 2048 2048
ReadX 10018 920 2048 2048
WriteX 10018 1536 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 2048 2048 2048
WriteX 10018 2560 2048 2048
WriteX 10018 336 2048 2048
WriteX 10018 920 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2048 2048 2048
ReadX 10018 2432 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 2048 2048 2048
WriteX 10018 2432 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2456 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1536 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 336 2048 2048
ReadX 10018 920 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 1536 2048 2048
WriteX 10018 336 2048 2048
WriteX 10018 920 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2432 2048 2048
WriteX 10018 2432 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2456 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1536 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 336 2048 2048
ReadX 10018 920 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 1536 2048 2048
WriteX 10018 336 2048 2048
WriteX 10018 920 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2432 2048 2048
WriteX 10018 2432 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2456 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1536 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 336 2048 2048
ReadX 10018 920 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 1536 2048 2048
WriteX 10018 336 2048 2048
WriteX 10018 920 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2432 2048 2048
WriteX 10018 2432 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2456 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1536 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 336 2048 2048
ReadX 10018 920 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 1536 2048 2048
WriteX 10018 336 2048 2048
WriteX 10018 920 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2432 2048 2048
WriteX 10018 2432 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
Flush 10018
ReadX 10018 2456 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1536 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 336 2048 2048
ReadX 10018 920 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 1536 2048 2048
WriteX 10018 336 2048 2048
WriteX 10018 920 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2432 2048 2048
WriteX 10018 2432 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2624 6144 6144
ReadX 10018 2616 2048 2048
ReadX 10018 2688 2048 2048
ReadX 10018 2600 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 2616 2048 2048
ReadX 10018 2608 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 344 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 520 2048 2048
ReadX 10018 1392 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 400 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 536 2048 2048
ReadX 10018 824 2048 2048
ReadX 10018 832 2048 2048
ReadX 10018 384 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 408 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 552 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 824 2048 2048
ReadX 10018 840 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 768 2048 2048
ReadX 10018 2048 2048 2048
WriteX 10018 1415 1 1
WriteX 10018 352 2048 2048
WriteX 10018 1112 2048 2048
WriteX 10018 1400 2048 2048
WriteX 10018 1408 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 2048 2048 2048
WriteX 10018 768 2048 2048
WriteX 10018 344 2048 2048
WriteX 10018 1000 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 416 2048 2048
ReadX 10018 424 2048 2048
ReadX 10018 432 2048 2048
ReadX 10018 440 2048 2048
ReadX 10018 576 16384 16384
ReadX 10018 448 2048 2048
ReadX 10018 456 2048 2048
ReadX 10018 464 2048 2048
ReadX 10018 640 16384 16384
ReadX 10018 704 16384 16384
ReadX 10018 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 10018 848 2048 2048
ReadX 10018 560 2048 2048
ReadX 10018 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 2600 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 352 2048 2048
ReadX 10018 1928 8192 8192
ReadX 10018 528 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 824 2048 2048
ReadX 10018 0 2048 2048
Flush 10018
ReadX 10018 2600 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 352 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 824 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 856 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 392 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 472 2048 2048
ReadX 10018 480 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 488 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 928 2048 2048
ReadX 10018 936 2048 2048
ReadX 10018 976 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 392 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 952 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 528 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 528 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 816 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10018 1336 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 528 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 528 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1240 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2200 4096 4096
ReadX 10018 2152 2048 2048
ReadX 10018 2160 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1312 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 1928 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 824 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1416 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 352 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 824 2048 2048
ReadX 10018 384 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10018 352 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 768 2048 2048
ReadX 10018 2048 2048 2048
ReadX 10018 352 2048 2048
WriteX 10018 1551 1 1
WriteX 10018 1512 2048 2048
WriteX 10018 1520 2048 2048
WriteX 10018 1528 2048 2048
WriteX 10018 1544 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 2048 2048 2048
WriteX 10018 768 2048 2048
WriteX 10018 344 2048 2048
WriteX 10018 1000 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2048 2048 2048
WriteX 10018 2048 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 1000 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1240 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 344 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 384 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 768 2048 2048
WriteX 10018 1567 1 1
WriteX 10018 1552 2048 2048
WriteX 10018 1560 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 768 2048 2048
WriteX 10018 344 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 1328 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1240 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2200 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1240 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 344 2048 2048
ReadX 10018 384 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 2048 2048 2048
ReadX 10018 768 2048 2048
WriteX 10018 1583 1 1
WriteX 10018 1568 2048 2048
WriteX 10018 1576 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 2048 2048 2048
WriteX 10018 768 2048 2048
WriteX 10018 344 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 864 2048 2048
ReadX 10018 872 2048 2048
ReadX 10018 912 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 2688 2048 2048
ReadX 10018 1000 2048 2048
WriteX 10018 2688 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 2944 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 0 2048 2048
Flush 10018
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 2688 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 2688 2048 2048
WriteX 10018 2688 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 392 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 416 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 416 2048 2048
ReadX 10018 864 2048 2048
ReadX 10018 872 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 312 2048 2048
ReadX 10018 888 2048 2048
ReadX 10018 400 2048 2048
ReadX 10018 896 2048 2048
WriteX 10018 1584 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 400 2048 2048
WriteX 10018 416 2048 2048
WriteX 10018 864 2048 2048
WriteX 10018 872 2048 2048
WriteX 10018 888 2048 2048
WriteX 10018 896 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 584 2048 2048
ReadX 10018 392 2048 2048
WriteX 10018 392 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 1328 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 0 2048 2048
ReadX 10018 408 2048 2048
ReadX 10018 1328 2048 2048
ReadX 10018 864 2048 2048
ReadX 10018 912 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 3840 2048 2048
ReadX 10018 312 2048 2048
ReadX 10018 1584 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 408 2048 2048
WriteX 10018 912 2048 2048
WriteX 10018 1584 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 408 2048 2048
ReadX 10018 392 2048 2048
WriteX 10018 392 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 528 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 528 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 552 2048 2048
ReadX 10018 1336 2048 2048
WriteX 10018 552 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 0 2048 2048
ReadX 10018 552 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 2664 2048 2048
ReadX 10018 2648 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 2672 2048 2048
ReadX 10018 2656 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10018 528 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 1336 2048 2048
ReadX 10018 2680 2048 2048
ReadX 10018 2760 8192 8192
ReadX 10018 544 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 568 2048 2048
ReadX 10018 544 2048 2048
ReadX 10018 0 2048 2048
Flush 10018
ReadX 10018 2816 6144 6144
ReadX 10018 2760 2048 2048
ReadX 10018 2744 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 2752 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 528 2048 2048
ReadX 10018 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 10022
Close 10022
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 10024
WriteX 10024 4065 1 1
QUERY_FILE_INFORMATION 10024
WriteX 10024 0 62591 62591
Close 10024
ReadX 10018 0 2048 2048
ReadX 10018 2808 2048 2048
ReadX 10018 2792 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 2800 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 384 2048 2048
ReadX 10018 392 2048 2048
ReadX 10018 1384 2048 2048
ReadX 10018 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 10026
Close 10026
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 10028
WriteX 10028 4094 1 1
QUERY_FILE_INFORMATION 10028
WriteX 10028 0 10845 10845
Close 10028
ReadX 10018 1432 2048 2048
ReadX 10018 1304 2048 2048
ReadX 10018 1368 2048 2048
ReadX 10018 2304 2048 2048
ReadX 10018 1440 2048 2048
ReadX 10018 1424 2048 2048
ReadX 10018 1448 2048 2048
ReadX 10018 1456 2048 2048
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 10030
Close 10030
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 10032
ReadX 10018 0 2048 2048
WriteX 10032 4081 1 1
QUERY_FILE_INFORMATION 10032
WriteX 10032 0 30118 30118
Close 10032
ReadX 10018 1344 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1152 2048 2048
ReadX 10018 1152 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 1000 2048 2048
ReadX 10018 768 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 344 2048 2048
WriteX 10018 1000 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 1416 2048 2048
ReadX 10018 1416 2048 2048
ReadX 10018 344 2048 2048
ReadX 10018 896 2048 2048
WriteX 10018 1538 2 2
WriteX 10018 344 2048 2048
WriteX 10018 1416 2048 2048
WriteX 10018 1538 2 2
ReadX 10018 2048 2048 2048
WriteX 10018 2048 2048 2048
WriteX 10018 1538 2 2
Close 10018
Close 10020
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10033
ReadX 10033 0 65471 65471
ReadX 10033 65471 63 63
ReadX 10033 65534 65471 65471
ReadX 10033 131005 63 63
ReadX 10033 131068 65471 65471
ReadX 10033 196539 63 63
ReadX 10033 196602 65471 65471
ReadX 10033 262073 63 63
ReadX 10033 262136 65471 65471
ReadX 10033 327607 63 63
ReadX 10033 327670 10 10
Close 10033
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10034
ReadX 10034 0 65471 65471
ReadX 10034 65471 63 63
ReadX 10034 65534 65471 65471
ReadX 10034 131005 63 63
ReadX 10034 131068 65471 65471
ReadX 10034 196539 63 63
ReadX 10034 196602 65471 65471
ReadX 10034 262073 63 63
ReadX 10034 262136 65471 65471
ReadX 10034 327607 63 63
ReadX 10034 327670 65471 65471
ReadX 10034 393141 63 63
ReadX 10034 393204 65471 65471
ReadX 10034 458675 63 63
ReadX 10034 458738 65471 65471
ReadX 10034 524209 63 63
ReadX 10034 524272 65471 65471
ReadX 10034 589743 63 63
ReadX 10034 589806 65471 65471
ReadX 10034 655277 63 63
ReadX 10034 655340 32 32
Close 10034
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10035
ReadX 10035 0 65471 65471
ReadX 10035 65471 63 63
ReadX 10035 65534 65471 65471
ReadX 10035 131005 63 63
ReadX 10035 131068 65471 65471
ReadX 10035 196539 63 63
ReadX 10035 196602 65471 65471
ReadX 10035 262073 63 63
ReadX 10035 262136 65471 65471
ReadX 10035 327607 63 63
ReadX 10035 327670 65471 65471
ReadX 10035 393141 63 63
ReadX 10035 393204 65471 65471
ReadX 10035 458675 63 63
ReadX 10035 458738 65471 65471
ReadX 10035 524209 63 63
ReadX 10035 524272 65471 65471
ReadX 10035 589743 63 63
ReadX 10035 589806 65471 65471
ReadX 10035 655277 63 63
ReadX 10035 655340 65471 65471
ReadX 10035 720811 63 63
ReadX 10035 720874 65471 65471
ReadX 10035 786345 63 63
ReadX 10035 786408 65471 65471
ReadX 10035 851879 63 63
ReadX 10035 851942 65471 65471
ReadX 10035 917413 63 63
ReadX 10035 917476 65471 65471
ReadX 10035 982947 63 63
ReadX 10035 983010 65471 65471
ReadX 10035 1048481 63 63
ReadX 10035 1048544 65471 65471
ReadX 10035 1114015 63 63
ReadX 10035 1114078 65471 65471
ReadX 10035 1179549 63 63
ReadX 10035 1179612 65471 65471
ReadX 10035 1245083 63 63
ReadX 10035 1245146 65471 65471
ReadX 10035 1310617 63 63
ReadX 10035 1310680 65471 65471
ReadX 10035 1376151 63 63
ReadX 10035 1376214 65471 65471
ReadX 10035 1441685 63 63
ReadX 10035 1441748 65471 65471
ReadX 10035 1507219 63 63
ReadX 10035 1507282 65471 65471
ReadX 10035 1572753 63 63
ReadX 10035 1572816 65471 65471
ReadX 10035 1638287 63 63
ReadX 10035 1638350 65471 65471
ReadX 10035 1703821 63 63
ReadX 10035 1703884 65471 65471
ReadX 10035 1769355 63 63
ReadX 10035 1769418 65471 65471
ReadX 10035 1834889 63 63
ReadX 10035 1834952 32824 32824
Close 10035
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10036
Close 10036
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10037
ReadX 10037 0 24 24
Close 10037
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10038
QUERY_FILE_INFORMATION 10038
ReadX 10038 0 512 512
ReadX 10038 464 512 512
ReadX 10038 498 512 512
ReadX 10038 472 512 512
ReadX 10038 466 512 512
ReadX 10038 978 512 512
ReadX 10038 497 57 57
Close 10038
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10039
QUERY_FILE_INFORMATION 10039
ReadX 10039 0 512 512
ReadX 10039 464 512 512
ReadX 10039 498 512 512
ReadX 10039 472 512 512
ReadX 10039 462 512 512
ReadX 10039 468 512 512
ReadX 10039 466 512 512
QUERY_FILE_INFORMATION 10039
WriteX 10039 482 60 60
WriteX 10039 482 4 4
QUERY_FILE_INFORMATION 10039
WriteX 10039 482 11 11
ReadX 10039 497 57 57
ReadX 10039 497 57 57
ReadX 10039 368 4096 4096
ReadX 10039 460 512 512
ReadX 10039 512 4096 4096
ReadX 10039 4608 4096 4096
ReadX 10039 8704 4096 4096
ReadX 10039 12800 4096 4096
ReadX 10039 16896 4096 4096
ReadX 10039 20992 4096 4096
ReadX 10039 25088 4096 4096
ReadX 10039 29184 4096 4096
ReadX 10039 33280 4096 4096
ReadX 10039 37376 4096 4096
ReadX 10039 41472 4096 4096
ReadX 10039 45568 4096 4096
ReadX 10039 49664 4096 4096
ReadX 10039 53760 4096 4096
ReadX 10039 57856 4096 4096
ReadX 10039 61952 4096 4096
ReadX 10039 66048 4096 4096
ReadX 10039 70144 4096 4096
ReadX 10039 497 20 20
ReadX 10039 496 103 103
ReadX 10039 500 448 448
ReadX 10039 470 512 512
ReadX 10039 486 2692 2692
ReadX 10039 290 4096 4096
ReadX 10039 4386 4096 4096
ReadX 10039 8482 4096 4096
ReadX 10039 500 20 20
ReadX 10039 483 108 108
ReadX 10039 482 292 292
ReadX 10039 338 4096 4096
ReadX 10039 4434 3103 3103
ReadX 10039 384 28 28
ReadX 10039 412 20 20
ReadX 10039 432 8 8
ReadX 10039 440 136 136
ReadX 10039 576 8 8
ReadX 10039 584 4 4
ReadX 10039 588 4 4
ReadX 10039 592 39 39
ReadX 10039 384 4 4
ReadX 10039 388 4 4
ReadX 10039 392 23 23
ReadX 10039 385 4 4
ReadX 10039 389 4 4
ReadX 10039 393 12 12
ReadX 10039 405 4 4
ReadX 10039 409 4 4
ReadX 10039 413 1 1
ReadX 10039 385 4 4
ReadX 10039 389 4 4
ReadX 10039 393 1 1
ReadX 10039 385 4 4
ReadX 10039 389 4 4
ReadX 10039 393 12 12
ReadX 10039 405 4 4
ReadX 10039 409 4 4
ReadX 10039 413 2 2
ReadX 10039 385 4 4
ReadX 10039 389 4 4
ReadX 10039 393 25 25
ReadX 10039 385 4 4
ReadX 10039 389 8 8
ReadX 10039 397 4 4
ReadX 10039 401 8 8
ReadX 10039 409 4 4
ReadX 10039 413 8 8
ReadX 10039 421 4 4
ReadX 10039 425 8 8
ReadX 10039 433 4 4
ReadX 10039 437 4 4
ReadX 10039 441 4 4
ReadX 10039 445 4 4
ReadX 10039 449 4 4
ReadX 10039 453 4 4
ReadX 10039 457 4 4
ReadX 10039 461 4 4
ReadX 10039 465 10670 10670
ReadX 10039 428 4096 4096
WriteX 10039 498 512 512
WriteX 10039 472 512 512
WriteX 10039 462 512 512
WriteX 10039 468 512 512
Close 10039
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10040
Close 10040
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10041
QUERY_FILE_INFORMATION 10041
ReadX 10041 0 512 512
ReadX 10041 464 512 512
ReadX 10041 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10042
Close 10042
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10041
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10044
WriteX 10044 4607 1 1
QUERY_FILE_INFORMATION 10044
WriteX 10044 0 65471 65471
WriteX 10044 65471 65 65
WriteX 10044 65536 19979 19979
Close 10044
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10045
QUERY_FILE_INFORMATION 10045
ReadX 10045 0 512 512
ReadX 10045 462 512 512
ReadX 10045 974 512 512
ReadX 10045 1486 512 512
ReadX 10045 460 512 512
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
WriteX 10045 470 448 448
QUERY_FILE_INFORMATION 10045
WriteX 10045 470 60 60
WriteX 10045 470 4 4
QUERY_FILE_INFORMATION 10045
WriteX 10045 470 11 11
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
WriteX 10045 464 512 512
WriteX 10045 976 512 512
WriteX 10045 1488 512 512
WriteX 10045 462 512 512
WriteX 10045 0 512 512
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
ReadX 10045 470 512 512
WriteX 10045 482 512 512
WriteX 10045 482 292 292
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
WriteX 10045 483 20 20
WriteX 10045 483 108 108
QUERY_FILE_INFORMATION 10045
WriteX 10045 484 448 448
QUERY_FILE_INFORMATION 10045
WriteX 10045 484 44 44
WriteX 10045 484 20 20
WriteX 10045 480 512 512
WriteX 10045 472 512 512
WriteX 10045 476 512 512
WriteX 10045 988 512 512
WriteX 10045 474 512 512
Flush 10045
WriteX 10045 0 512 512
Flush 10045
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
WriteX 10045 480 512 512
WriteX 10045 472 512 512
WriteX 10045 476 512 512
QUERY_FILE_INFORMATION 10045
WriteX 10045 496 320 320
QUERY_FILE_INFORMATION 10045
WriteX 10045 496 60 60
ReadX 10045 484 512 512
WriteX 10045 500 512 512
WriteX 10045 470 512 512
WriteX 10045 486 2692 2692
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
WriteX 10045 497 25 25
WriteX 10045 496 103 103
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
WriteX 10045 497 44 44
WriteX 10045 497 20 20
WriteX 10045 498 512 512
WriteX 10045 462 512 512
WriteX 10045 466 512 512
WriteX 10045 978 512 512
WriteX 10045 464 512 512
Flush 10045
WriteX 10045 0 512 512
Flush 10045
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
QUERY_FILE_INFORMATION 10045
WriteX 10045 497 7 7
WriteX 10045 497 57 57
WriteX 10045 498 512 512
WriteX 10045 472 512 512
WriteX 10045 462 512 512
WriteX 10045 466 512 512
WriteX 10045 978 512 512
Flush 10045
WriteX 10045 498 512 512
Flush 10045
Close 10045
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10046
QUERY_FILE_INFORMATION 10046
ReadX 10046 0 512 512
ReadX 10046 464 512 512
ReadX 10046 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 10047
ReadX 10047 0 20 20
ReadX 10047 14 40 40
ReadX 10047 54 64 64
ReadX 10047 118 1152 1152
Close 10047
Close 10046
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10048
Close 10048
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10049
ReadX 10049 0 24 24
Close 10049
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10050
QUERY_FILE_INFORMATION 10050
ReadX 10050 0 512 512
ReadX 10050 464 512 512
ReadX 10050 498 512 512
ReadX 10050 472 512 512
ReadX 10050 462 512 512
ReadX 10050 466 512 512
ReadX 10050 978 512 512
ReadX 10050 497 57 57
Close 10050
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10051
QUERY_FILE_INFORMATION 10051
ReadX 10051 0 512 512
ReadX 10051 464 512 512
ReadX 10051 498 512 512
ReadX 10051 472 512 512
ReadX 10051 468 512 512
ReadX 10051 462 512 512
ReadX 10051 466 512 512
QUERY_FILE_INFORMATION 10051
WriteX 10051 482 60 60
WriteX 10051 482 4 4
QUERY_FILE_INFORMATION 10051
WriteX 10051 482 11 11
WriteX 10051 498 512 512
WriteX 10051 472 512 512
WriteX 10051 462 512 512
WriteX 10051 466 512 512
WriteX 10051 978 512 512
Close 10051
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 10052
Close 10052
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 10053
Close 10053
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10055
WriteX 10055 4607 1 1
QUERY_FILE_INFORMATION 10055
WriteX 10055 0 65471 65471
WriteX 10055 65471 65 65
WriteX 10055 65536 17654 17654
Close 10055
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10056
QUERY_FILE_INFORMATION 10056
ReadX 10056 0 512 512
ReadX 10056 474 512 512
ReadX 10056 986 512 512
ReadX 10056 1498 512 512
ReadX 10056 472 512 512
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
WriteX 10056 482 448 448
QUERY_FILE_INFORMATION 10056
WriteX 10056 482 60 60
WriteX 10056 482 4 4
QUERY_FILE_INFORMATION 10056
WriteX 10056 482 11 11
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
WriteX 10056 476 512 512
WriteX 10056 988 512 512
WriteX 10056 1500 512 512
WriteX 10056 474 512 512
WriteX 10056 0 512 512
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
ReadX 10056 482 512 512
WriteX 10056 494 512 512
WriteX 10056 494 292 292
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
WriteX 10056 495 20 20
WriteX 10056 495 108 108
QUERY_FILE_INFORMATION 10056
WriteX 10056 496 448 448
QUERY_FILE_INFORMATION 10056
WriteX 10056 496 44 44
WriteX 10056 496 20 20
WriteX 10056 492 512 512
WriteX 10056 484 512 512
WriteX 10056 488 512 512
WriteX 10056 1000 512 512
WriteX 10056 486 512 512
Flush 10056
WriteX 10056 0 512 512
Flush 10056
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
WriteX 10056 492 512 512
WriteX 10056 484 512 512
WriteX 10056 488 512 512
QUERY_FILE_INFORMATION 10056
WriteX 10056 508 320 320
QUERY_FILE_INFORMATION 10056
WriteX 10056 508 60 60
ReadX 10056 496 512 512
WriteX 10056 512 512 512
WriteX 10056 482 512 512
WriteX 10056 498 2692 2692
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
WriteX 10056 509 25 25
WriteX 10056 508 103 103
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
WriteX 10056 509 44 44
WriteX 10056 509 20 20
WriteX 10056 510 512 512
WriteX 10056 474 512 512
WriteX 10056 478 512 512
WriteX 10056 990 512 512
WriteX 10056 476 512 512
Flush 10056
WriteX 10056 0 512 512
Flush 10056
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
QUERY_FILE_INFORMATION 10056
WriteX 10056 509 7 7
WriteX 10056 509 57 57
WriteX 10056 510 512 512
WriteX 10056 484 512 512
WriteX 10056 474 512 512
WriteX 10056 478 512 512
WriteX 10056 990 512 512
Flush 10056
WriteX 10056 510 512 512
Flush 10056
Close 10056
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10057
Close 10057
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10058
QUERY_FILE_INFORMATION 10058
ReadX 10058 0 512 512
ReadX 10058 476 512 512
ReadX 10058 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 10059
Close 10059
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 10060
QUERY_FILE_INFORMATION 10060
ReadX 10060 0 512 512
ReadX 10060 512 512 512
ReadX 10060 770 512 512
ReadX 10060 1282 512 512
ReadX 10060 1794 512 512
ReadX 10060 2562 512 512
ReadX 10060 3586 512 512
ReadX 10060 3828 512 512
ReadX 10060 288 512 512
ReadX 10060 1024 512 512
ReadX 10060 954 512 512
ReadX 10060 295 512 512
ReadX 10060 320 512 512
ReadX 10060 322 512 512
ReadX 10060 834 512 512
ReadX 10060 1346 512 512
ReadX 10060 1858 512 512
ReadX 10060 323 512 512
ReadX 10060 835 512 512
ReadX 10060 1347 512 512
ReadX 10060 1859 512 512
ReadX 10060 2371 345 345
ReadX 10060 322 167 167
ReadX 10060 489 512 512
ReadX 10060 1001 512 512
ReadX 10060 1513 512 512
ReadX 10060 2025 512 512
ReadX 10060 2537 512 512
ReadX 10060 3049 512 512
ReadX 10060 3561 345 345
ReadX 10060 323 167 167
ReadX 10060 490 512 512
ReadX 10060 1002 512 512
ReadX 10060 1514 512 512
ReadX 10060 2026 512 512
ReadX 10060 2538 512 512
ReadX 10060 3050 512 512
ReadX 10060 3562 512 512
ReadX 10060 4074 512 512
ReadX 10060 4586 512 512
ReadX 10060 5098 512 512
ReadX 10060 5610 512 512
ReadX 10060 6122 512 512
ReadX 10060 6634 512 512
ReadX 10060 7146 512 512
ReadX 10060 7658 512 512
ReadX 10060 8170 512 512
ReadX 10060 8682 512 512
ReadX 10060 9194 512 512
ReadX 10060 9706 512 512
ReadX 10060 10218 512 512
ReadX 10060 10730 345 345
ReadX 10060 11075 512 512
ReadX 10060 11587 167 167
ReadX 10060 11754 512 512
ReadX 10060 12266 512 512
ReadX 10060 12778 512 512
ReadX 10060 13290 512 512
ReadX 10060 13802 512 512
ReadX 10060 14314 512 512
ReadX 10060 14826 512 512
ReadX 10060 15338 512 512
ReadX 10060 337 512 512
ReadX 10060 337 512 512
ReadX 10060 849 34 34
ReadX 10060 352 512 512
ReadX 10060 864 512 512
ReadX 10060 1376 512 512
ReadX 10060 1888 512 512
ReadX 10060 2400 512 512
ReadX 10060 2912 512 512
ReadX 10060 3424 512 512
ReadX 10060 3936 512 512
ReadX 10060 1632 512 512
ReadX 10060 2144 512 512
ReadX 10060 1682 512 512
ReadX 10060 258 512 512
ReadX 10060 360 144 144
ReadX 10060 2517 512 512
ReadX 10060 3029 512 512
ReadX 10060 1751 512 512
ReadX 10060 2263 512 512
ReadX 10060 2775 512 512
ReadX 10060 3287 512 512
ReadX 10060 3799 512 512
ReadX 10060 4311 512 512
ReadX 10060 4823 512 512
ReadX 10060 5335 512 512
ReadX 10060 5847 512 512
ReadX 10060 6359 512 512
ReadX 10060 6871 512 512
ReadX 10060 7383 512 512
ReadX 10060 7895 512 512
ReadX 10060 8407 512 512
ReadX 10060 8919 512 512
ReadX 10060 9431 512 512
ReadX 10060 9943 512 512
ReadX 10060 10455 512 512
ReadX 10060 10967 512 512
ReadX 10060 11479 512 512
ReadX 10060 2556 512 512
ReadX 10060 3068 512 512
ReadX 10060 3580 512 512
ReadX 10060 4092 512 512
ReadX 10060 4604 512 512
ReadX 10060 5116 512 512
ReadX 10060 5628 512 512
ReadX 10060 6140 512 512
ReadX 10060 6652 512 512
ReadX 10060 7164 512 512
ReadX 10060 7676 512 512
ReadX 10060 8188 512 512
ReadX 10060 8700 512 512
ReadX 10060 9212 512 512
ReadX 10060 9724 512 512
ReadX 10060 10236 512 512
ReadX 10060 10748 512 512
ReadX 10060 11260 512 512
ReadX 10060 11772 512 512
ReadX 10060 12284 512 512
ReadX 10060 12796 49 49
ReadX 10060 260 463 463
ReadX 10060 723 512 512
ReadX 10060 1235 512 512
ReadX 10060 1747 512 512
ReadX 10060 2259 512 512
ReadX 10060 2771 512 512
ReadX 10060 3283 512 512
ReadX 10060 3795 512 512
ReadX 10060 4307 512 512
ReadX 10060 4819 512 512
ReadX 10060 5331 512 512
ReadX 10060 5843 512 512
ReadX 10060 6355 512 512
ReadX 10060 6867 512 512
ReadX 10060 7379 512 512
ReadX 10060 7891 512 512
ReadX 10060 8403 512 512
ReadX 10060 8915 512 512
ReadX 10060 9427 512 512
ReadX 10060 9939 512 512
ReadX 10060 10451 512 512
ReadX 10060 10963 402 402
ReadX 10060 593 240 240
ReadX 10060 2048 272 272
ReadX 10060 2320 512 512
ReadX 10060 2832 512 512
ReadX 10060 3344 512 512
ReadX 10060 3856 512 512
ReadX 10060 4368 512 512
ReadX 10060 4880 512 512
ReadX 10060 5392 240 240
ReadX 10060 608 272 272
ReadX 10060 880 512 512
ReadX 10060 1392 512 512
ReadX 10060 1904 512 512
ReadX 10060 2416 512 512
ReadX 10060 2928 512 512
ReadX 10060 3440 512 512
ReadX 10060 3952 512 512
ReadX 10060 4464 512 512
ReadX 10060 4976 512 512
ReadX 10060 5488 512 512
ReadX 10060 6000 512 512
ReadX 10060 6512 512 512
ReadX 10060 7024 512 512
ReadX 10060 7536 512 512
ReadX 10060 8048 512 512
ReadX 10060 8560 512 512
ReadX 10060 9072 512 512
ReadX 10060 9584 512 512
ReadX 10060 10096 512 512
ReadX 10060 1683 512 512
ReadX 10060 514 512 512
ReadX 10060 620 512 512
ReadX 10060 770 512 512
ReadX 10060 1282 512 512
ReadX 10060 1794 512 512
ReadX 10060 2000 512 512
ReadX 10060 1434 512 512
ReadX 10060 2050 512 512
ReadX 10060 2118 512 512
ReadX 10060 1715 512 512
ReadX 10060 1024 512 512
ReadX 10060 954 512 512
ReadX 10060 1880 512 512
ReadX 10060 1286 512 512
ReadX 10060 1510 512 512
ReadX 10060 2562 512 512
ReadX 10060 2610 512 512
ReadX 10060 3586 512 512
ReadX 10060 3812 512 512
ReadX 10060 3828 512 512
ReadX 10060 4046 512 512
ReadX 10060 4066 512 512
ReadX 10060 1747 512 512
ReadX 10060 1026 512 512
ReadX 10060 1538 512 512
ReadX 10060 514 512 512
ReadX 10060 751 512 512
ReadX 10060 1263 512 512
ReadX 10060 620 512 512
ReadX 10060 1132 512 512
ReadX 10060 1644 512 512
ReadX 10060 2156 512 512
ReadX 10060 2668 512 512
ReadX 10060 3180 512 512
ReadX 10060 3692 512 512
ReadX 10060 4204 394 394
ReadX 10060 606 118 118
ReadX 10060 724 512 512
ReadX 10060 1236 512 512
ReadX 10060 1748 512 512
ReadX 10060 2260 512 512
ReadX 10060 2772 512 512
ReadX 10060 3284 512 512
ReadX 10060 3796 394 394
ReadX 10060 636 118 118
ReadX 10060 754 512 512
ReadX 10060 1266 512 512
ReadX 10060 1778 512 512
ReadX 10060 2290 512 512
ReadX 10060 2802 512 512
ReadX 10060 3314 512 512
ReadX 10060 3826 512 512
ReadX 10060 4338 512 512
ReadX 10060 4850 512 512
ReadX 10060 5362 512 512
ReadX 10060 5874 512 512
ReadX 10060 6386 512 512
ReadX 10060 6898 512 512
ReadX 10060 7410 512 512
ReadX 10060 7922 512 512
ReadX 10060 8434 512 512
ReadX 10060 8946 512 512
ReadX 10060 9458 512 512
ReadX 10060 9970 512 512
ReadX 10060 10482 512 512
ReadX 10060 723 512 512
ReadX 10060 1235 512 512
ReadX 10060 725 512 512
ReadX 10060 729 512 512
ReadX 10060 1241 512 512
ReadX 10060 1753 512 512
ReadX 10060 2265 512 512
ReadX 10060 2777 512 512
ReadX 10060 3289 512 512
ReadX 10060 3801 512 512
ReadX 10060 4313 512 512
ReadX 10060 4825 512 512
ReadX 10060 5337 512 512
ReadX 10060 5849 512 512
ReadX 10060 6361 512 512
ReadX 10060 755 512 512
ReadX 10060 1267 512 512
ReadX 10060 1779 512 512
ReadX 10060 2291 512 512
ReadX 10060 2803 512 512
ReadX 10060 3315 512 512
ReadX 10060 3827 512 512
ReadX 10060 4339 244 244
ReadX 10060 4583 512 512
ReadX 10060 5095 268 268
ReadX 10060 5363 512 512
ReadX 10060 5875 512 512
ReadX 10060 6387 512 512
ReadX 10060 6899 512 512
ReadX 10060 7411 512 512
ReadX 10060 7923 512 512
ReadX 10060 8435 512 512
ReadX 10060 8947 512 512
ReadX 10060 9459 512 512
ReadX 10060 9971 512 512
ReadX 10060 10483 512 512
ReadX 10060 10995 512 512
ReadX 10060 11507 512 512
ReadX 10060 12019 512 512
ReadX 10060 12531 512 512
ReadX 10060 13043 512 512
ReadX 10060 13555 512 512
ReadX 10060 14067 512 512
ReadX 10060 14579 512 512
ReadX 10060 15091 512 512
ReadX 10060 15603 342 342
ReadX 10060 725 512 512
ReadX 10060 2000 512 512
ReadX 10060 3918 512 512
ReadX 10060 727 512 512
ReadX 10060 258 512 512
ReadX 10060 376 512 512
ReadX 10060 1109 512 512
ReadX 10060 1028 512 512
ReadX 10060 1540 512 512
ReadX 10060 2052 512 512
ReadX 10060 2564 512 512
ReadX 10060 3076 512 512
ReadX 10060 3588 512 512
ReadX 10060 4100 512 512
ReadX 10060 4612 412 412
ReadX 10060 1012 100 100
ReadX 10060 1112 512 512
ReadX 10060 1624 512 512
ReadX 10060 2136 512 512
ReadX 10060 2648 512 512
ReadX 10060 3160 512 512
ReadX 10060 3672 512 512
ReadX 10060 4184 412 412
ReadX 10060 1044 100 100
ReadX 10060 1144 512 512
ReadX 10060 1656 512 512
ReadX 10060 2168 512 512
ReadX 10060 2680 512 512
ReadX 10060 3192 512 512
ReadX 10060 3704 512 512
ReadX 10060 4216 512 512
ReadX 10060 4728 512 512
ReadX 10060 5240 512 512
ReadX 10060 5752 512 512
ReadX 10060 6264 512 512
ReadX 10060 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 10060 7288 512 512
ReadX 10060 7800 512 512
ReadX 10060 8312 512 512
ReadX 10060 8824 512 512
ReadX 10060 9336 512 512
ReadX 10060 9848 512 512
ReadX 10060 10360 512 512
ReadX 10060 10872 512 512
ReadX 10060 11384 512 512
ReadX 10060 11896 512 512
ReadX 10060 12408 512 512
ReadX 10060 1088 512 512
ReadX 10060 1600 512 512
ReadX 10060 1090 512 512
ReadX 10060 1094 512 512
ReadX 10060 1606 512 512
ReadX 10060 2118 512 512
ReadX 10060 2630 512 512
ReadX 10060 3142 512 512
ReadX 10060 3654 512 512
ReadX 10060 4166 512 512
ReadX 10060 4678 512 512
ReadX 10060 1111 512 512
ReadX 10060 1623 512 512
ReadX 10060 2135 512 512
ReadX 10060 2647 512 512
ReadX 10060 3159 512 512
ReadX 10060 3671 512 512
ReadX 10060 4183 512 512
ReadX 10060 4695 512 512
ReadX 10060 5207 512 512
ReadX 10060 5719 512 512
ReadX 10060 6231 512 512
ReadX 10060 6743 512 512
ReadX 10060 7255 512 512
ReadX 10060 7767 512 512
ReadX 10060 8279 512 512
ReadX 10060 8791 512 512
ReadX 10060 9303 512 512
ReadX 10060 9815 512 512
ReadX 10060 10327 512 512
ReadX 10060 10839 512 512
ReadX 10060 11351 294 294
ReadX 10060 1091 512 512
ReadX 10060 970 512 512
ReadX 10060 1093 512 512
ReadX 10060 1434 512 512
ReadX 10060 2050 512 512
ReadX 10060 2158 512 512
ReadX 10060 2118 512 512
ReadX 10060 2630 512 512
ReadX 10060 3142 512 512
ReadX 10060 3654 512 512
ReadX 10060 4166 512 512
ReadX 10060 4678 512 512
ReadX 10060 5190 512 512
ReadX 10060 5702 382 382
ReadX 10060 2104 130 130
ReadX 10060 2234 512 512
ReadX 10060 2746 512 512
ReadX 10060 3258 512 512
ReadX 10060 3770 512 512
ReadX 10060 4282 512 512
ReadX 10060 4794 512 512
ReadX 10060 5306 382 382
ReadX 10060 2134 130 130
ReadX 10060 2264 512 512
ReadX 10060 2776 512 512
ReadX 10060 3288 512 512
ReadX 10060 3800 512 512
ReadX 10060 4312 512 512
ReadX 10060 4824 512 512
ReadX 10060 5336 512 512
ReadX 10060 2147 512 512
ReadX 10060 2149 512 512
ReadX 10060 2152 512 512
ReadX 10060 2664 512 512
ReadX 10060 3176 512 512
ReadX 10060 3688 512 512
ReadX 10060 2159 512 512
ReadX 10060 2671 512 512
ReadX 10060 3183 512 512
ReadX 10060 3695 512 512
ReadX 10060 4207 512 512
ReadX 10060 4719 512 512
ReadX 10060 5231 512 512
ReadX 10060 5743 512 512
ReadX 10060 6255 512 512
ReadX 10060 6767 512 512
ReadX 10060 7279 512 512
ReadX 10060 7791 512 512
ReadX 10060 8303 512 512
ReadX 10060 8815 512 512
ReadX 10060 9327 512 512
ReadX 10060 9839 512 512
ReadX 10060 10351 512 512
ReadX 10060 10863 512 512
ReadX 10060 11375 512 512
ReadX 10060 11887 512 512
ReadX 10060 12399 38 38
ReadX 10060 2149 512 512
ReadX 10060 1794 512 512
ReadX 10060 2016 512 512
ReadX 10060 2151 512 512
ReadX 10060 1918 512 512
ReadX 10060 1880 512 512
ReadX 10060 2392 512 512
ReadX 10060 2904 512 512
ReadX 10060 3416 512 512
ReadX 10060 3928 512 512
ReadX 10060 4440 512 512
ReadX 10060 4952 512 512
ReadX 10060 5464 416 416
ReadX 10060 1866 96 96
ReadX 10060 1962 512 512
ReadX 10060 2474 512 512
ReadX 10060 2986 512 512
ReadX 10060 3498 512 512
ReadX 10060 4010 512 512
ReadX 10060 4522 512 512
ReadX 10060 5034 416 416
ReadX 10060 1896 96 96
ReadX 10060 1992 512 512
ReadX 10060 2504 512 512
ReadX 10060 3016 512 512
ReadX 10060 3528 512 512
ReadX 10060 1903 512 512
ReadX 10060 1905 512 512
ReadX 10060 1908 512 512
ReadX 10060 2420 512 512
ReadX 10060 2932 512 512
ReadX 10060 3444 512 512
ReadX 10060 3956 512 512
ReadX 10060 1919 512 512
ReadX 10060 2431 512 512
ReadX 10060 2943 512 512
ReadX 10060 3455 512 512
ReadX 10060 3967 512 512
ReadX 10060 4479 512 512
ReadX 10060 4991 512 512
ReadX 10060 5503 512 512
ReadX 10060 6015 512 512
ReadX 10060 6527 512 512
ReadX 10060 7039 512 512
ReadX 10060 7551 512 512
ReadX 10060 8063 512 512
ReadX 10060 8575 512 512
ReadX 10060 9087 512 512
ReadX 10060 9599 512 512
ReadX 10060 10111 512 512
ReadX 10060 10623 512 512
ReadX 10060 11135 512 512
ReadX 10060 11647 512 512
ReadX 10060 12159 322 322
ReadX 10060 1905 512 512
ReadX 10060 1846 512 512
ReadX 10060 1907 512 512
ReadX 10060 1860 268 268
ReadX 10060 1832 244 244
ReadX 10060 1846 512 512
ReadX 10060 2358 512 512
ReadX 10060 2870 512 512
ReadX 10060 3382 512 512
ReadX 10060 3894 512 512
ReadX 10060 4406 512 512
ReadX 10060 4918 512 512
ReadX 10060 1858 512 512
ReadX 10060 1859 512 512
ReadX 10060 1860 488 488
ReadX 10060 1832 24 24
ReadX 10060 1861 228 228
ReadX 10060 1832 284 284
ReadX 10060 2116 512 512
ReadX 10060 2628 512 512
ReadX 10060 3140 512 512
ReadX 10060 3652 512 512
ReadX 10060 4164 512 512
ReadX 10060 4676 512 512
ReadX 10060 5188 228 228
ReadX 10060 1862 284 284
ReadX 10060 2146 512 512
ReadX 10060 2658 38 38
ReadX 10060 1859 512 512
ReadX 10060 2047 512 512
ReadX 10060 2016 512 512
ReadX 10060 2528 512 512
ReadX 10060 3040 512 512
ReadX 10060 3552 512 512
ReadX 10060 4064 512 512
ReadX 10060 4576 512 512
ReadX 10060 5088 512 512
ReadX 10060 5600 424 424
ReadX 10060 2002 88 88
ReadX 10060 2090 512 512
ReadX 10060 2602 512 512
ReadX 10060 3114 512 512
ReadX 10060 3626 512 512
ReadX 10060 4138 512 512
ReadX 10060 4650 512 512
ReadX 10060 5162 424 424
ReadX 10060 2032 88 88
ReadX 10060 2120 512 512
ReadX 10060 2632 512 512
ReadX 10060 3144 512 512
ReadX 10060 3656 512 512
ReadX 10060 4168 512 512
ReadX 10060 4680 512 512
ReadX 10060 5192 512 512
ReadX 10060 2044 512 512
ReadX 10060 2045 512 512
ReadX 10060 2046 512 512
ReadX 10060 2047 512 512
ReadX 10060 2559 110 110
ReadX 10060 2052 402 402
ReadX 10060 2454 512 512
ReadX 10060 2966 512 512
ReadX 10060 3478 512 512
ReadX 10060 3990 512 512
ReadX 10060 4502 512 512
ReadX 10060 5014 512 512
ReadX 10060 5526 512 512
ReadX 10060 6038 512 512
ReadX 10060 6550 512 512
ReadX 10060 7062 512 512
ReadX 10060 7574 512 512
ReadX 10060 8086 512 512
ReadX 10060 8598 512 512
ReadX 10060 9110 512 512
ReadX 10060 9622 512 512
ReadX 10060 10134 512 512
ReadX 10060 10646 512 512
ReadX 10060 11158 512 512
ReadX 10060 11670 512 512
ReadX 10060 12182 512 512
ReadX 10060 12694 118 118
ReadX 10060 2045 512 512
ReadX 10060 1282 512 512
ReadX 10060 1343 512 512
ReadX 10060 1286 512 512
ReadX 10060 1798 512 512
ReadX 10060 2310 512 512
ReadX 10060 2822 512 512
ReadX 10060 3334 512 512
ReadX 10060 3846 512 512
ReadX 10060 4358 512 512
ReadX 10060 4870 416 416
ReadX 10060 1270 96 96
ReadX 10060 1366 512 512
ReadX 10060 1878 512 512
ReadX 10060 2390 512 512
ReadX 10060 2902 512 512
ReadX 10060 3414 512 512
ReadX 10060 3926 416 416
ReadX 10060 1284 96 96
ReadX 10060 1380 416 416
ReadX 10060 1302 96 96
ReadX 10060 1398 512 512
ReadX 10060 1910 512 512
ReadX 10060 2422 512 512
ReadX 10060 2934 512 512
ReadX 10060 3446 512 512
ReadX 10060 3958 512 512
ReadX 10060 4470 512 512
ReadX 10060 4982 512 512
ReadX 10060 5494 512 512
ReadX 10060 6006 512 512
ReadX 10060 6518 512 512
ReadX 10060 7030 512 512
ReadX 10060 7542 512 512
ReadX 10060 1328 512 512
ReadX 10060 1330 512 512
ReadX 10060 1333 512 512
ReadX 10060 1845 512 512
ReadX 10060 2357 512 512
ReadX 10060 2869 512 512
ReadX 10060 3381 512 512
ReadX 10060 1344 512 512
ReadX 10060 1856 512 512
ReadX 10060 2368 512 512
ReadX 10060 2880 512 512
ReadX 10060 3392 512 512
ReadX 10060 3904 512 512
ReadX 10060 4416 512 512
ReadX 10060 4928 512 512
ReadX 10060 5440 512 512
ReadX 10060 5952 512 512
ReadX 10060 6464 512 512
ReadX 10060 6976 512 512
ReadX 10060 7488 512 512
ReadX 10060 8000 512 512
ReadX 10060 8512 512 512
ReadX 10060 9024 512 512
ReadX 10060 9536 512 512
ReadX 10060 10048 512 512
ReadX 10060 10560 512 512
ReadX 10060 11072 512 512
ReadX 10060 11584 426 426
ReadX 10060 1330 512 512
ReadX 10060 1842 512 512
ReadX 10060 1250 512 512
ReadX 10060 1264 268 268
ReadX 10060 1236 244 244
ReadX 10060 1250 512 512
ReadX 10060 1762 512 512
ReadX 10060 2274 512 512
ReadX 10060 2786 512 512
ReadX 10060 3298 512 512
ReadX 10060 3810 512 512
ReadX 10060 4322 512 512
ReadX 10060 1262 512 512
ReadX 10060 1263 512 512
ReadX 10060 1264 488 488
ReadX 10060 1236 24 24
ReadX 10060 1265 228 228
ReadX 10060 1236 284 284
ReadX 10060 1520 512 512
ReadX 10060 2032 512 512
ReadX 10060 2544 512 512
ReadX 10060 3056 512 512
ReadX 10060 3568 512 512
ReadX 10060 4080 512 512
ReadX 10060 4592 228 228
ReadX 10060 1266 284 284
ReadX 10060 1550 512 512
ReadX 10060 2062 42 42
ReadX 10060 1263 512 512
ReadX 10060 1538 512 512
ReadX 10060 1640 512 512
ReadX 10060 1510 512 512
ReadX 10060 2022 512 512
ReadX 10060 2534 512 512
ReadX 10060 3046 512 512
ReadX 10060 3558 512 512
ReadX 10060 4070 512 512
ReadX 10060 4582 512 512
ReadX 10060 5094 408 408
ReadX 10060 1496 104 104
ReadX 10060 1600 512 512
ReadX 10060 2112 512 512
ReadX 10060 2624 512 512
ReadX 10060 3136 512 512
ReadX 10060 3648 512 512
ReadX 10060 4160 512 512
ReadX 10060 4672 408 408
ReadX 10060 1526 104 104
ReadX 10060 1630 512 512
ReadX 10060 2142 512 512
ReadX 10060 2654 512 512
ReadX 10060 3166 512 512
ReadX 10060 3678 512 512
ReadX 10060 4190 408 408
ReadX 10060 1540 104 104
ReadX 10060 1644 512 512
ReadX 10060 2156 512 512
ReadX 10060 2668 512 512
ReadX 10060 3180 512 512
ReadX 10060 3692 512 512
ReadX 10060 4204 512 512
ReadX 10060 4716 512 512
ReadX 10060 5228 512 512
ReadX 10060 5740 512 512
ReadX 10060 6252 512 512
ReadX 10060 6764 512 512
ReadX 10060 7276 512 512
ReadX 10060 7788 512 512
ReadX 10060 8300 512 512
ReadX 10060 8812 512 512
ReadX 10060 9324 512 512
ReadX 10060 9836 512 512
ReadX 10060 10348 512 512
ReadX 10060 10860 512 512
ReadX 10060 11372 512 512
ReadX 10060 1615 512 512
ReadX 10060 2127 512 512
ReadX 10060 1617 512 512
ReadX 10060 1621 512 512
ReadX 10060 2133 512 512
ReadX 10060 2645 512 512
ReadX 10060 3157 512 512
ReadX 10060 3669 512 512
ReadX 10060 4181 512 512
ReadX 10060 4693 512 512
ReadX 10060 5205 512 512
ReadX 10060 5717 512 512
ReadX 10060 6229 512 512
ReadX 10060 1641 512 512
ReadX 10060 2153 512 512
ReadX 10060 2665 512 512
ReadX 10060 3177 512 512
ReadX 10060 3689 512 512
ReadX 10060 4201 512 512
ReadX 10060 4713 512 512
ReadX 10060 5225 512 512
ReadX 10060 5737 512 512
ReadX 10060 6249 512 512
ReadX 10060 6761 512 512
ReadX 10060 7273 512 512
ReadX 10060 7785 512 512
ReadX 10060 8297 512 512
ReadX 10060 8809 512 512
ReadX 10060 9321 512 512
ReadX 10060 9833 512 512
ReadX 10060 10345 512 512
ReadX 10060 10857 512 512
ReadX 10060 11369 512 512
ReadX 10060 11881 2 2
ReadX 10060 1796 510 510
ReadX 10060 2306 512 512
ReadX 10060 2818 512 512
ReadX 10060 3330 512 512
ReadX 10060 3842 512 512
ReadX 10060 4354 512 512
ReadX 10060 4866 512 512
ReadX 10060 5378 512 512
ReadX 10060 5890 512 512
ReadX 10060 6402 512 512
ReadX 10060 6914 512 512
ReadX 10060 7426 512 512
ReadX 10060 7938 512 512
ReadX 10060 8450 512 512
ReadX 10060 8962 512 512
ReadX 10060 9474 512 512
ReadX 10060 9986 512 512
ReadX 10060 10498 326 326
ReadX 10060 1617 512 512
ReadX 10060 2129 512 512
ReadX 10060 1450 512 512
ReadX 10060 1621 512 512
ReadX 10060 1446 512 512
ReadX 10060 1450 512 512
ReadX 10060 1962 512 512
ReadX 10060 2474 512 512
ReadX 10060 2986 512 512
ReadX 10060 3498 512 512
ReadX 10060 4010 512 512
ReadX 10060 4522 512 512
ReadX 10060 5034 424 424
ReadX 10060 1436 88 88
ReadX 10060 1524 512 512
ReadX 10060 2036 512 512
ReadX 10060 2548 512 512
ReadX 10060 3060 512 512
ReadX 10060 1442 512 512
ReadX 10060 1443 512 512
ReadX 10060 1444 512 512
ReadX 10060 1446 512 512
ReadX 10060 1958 386 386
ReadX 10060 1466 126 126
ReadX 10060 1592 512 512
ReadX 10060 2104 512 512
ReadX 10060 2616 512 512
ReadX 10060 3128 512 512
ReadX 10060 3640 512 512
ReadX 10060 4152 512 512
ReadX 10060 4664 512 512
ReadX 10060 5176 512 512
ReadX 10060 5688 512 512
ReadX 10060 6200 512 512
ReadX 10060 6712 512 512
ReadX 10060 7224 512 512
ReadX 10060 7736 512 512
ReadX 10060 8248 512 512
ReadX 10060 8760 294 294
ReadX 10060 1443 512 512
ReadX 10060 964 512 512
ReadX 10060 970 512 512
ReadX 10060 1482 512 512
ReadX 10060 1994 512 512
ReadX 10060 2506 512 512
ReadX 10060 3018 512 512
ReadX 10060 3530 512 512
ReadX 10060 4042 512 512
ReadX 10060 4554 424 424
ReadX 10060 956 88 88
ReadX 10060 1044 512 512
ReadX 10060 1556 512 512
ReadX 10060 2068 512 512
ReadX 10060 2580 512 512
ReadX 10060 962 512 512
ReadX 10060 963 512 512
ReadX 10060 964 512 512
ReadX 10060 965 512 512
ReadX 10060 1477 512 512
ReadX 10060 1989 228 228
ReadX 10060 986 284 284
ReadX 10060 1270 512 512
ReadX 10060 1782 512 512
ReadX 10060 2294 512 512
ReadX 10060 2806 512 512
ReadX 10060 3318 512 512
ReadX 10060 3830 512 512
ReadX 10060 4342 512 512
ReadX 10060 4854 512 512
ReadX 10060 5366 512 512
ReadX 10060 5878 512 512
ReadX 10060 6390 512 512
ReadX 10060 6902 512 512
ReadX 10060 7414 42 42
ReadX 10060 963 512 512
ReadX 10060 2610 512 512
ReadX 10060 3812 512 512
ReadX 10060 3828 512 512
ReadX 10060 3969 512 512
ReadX 10060 3918 512 512
ReadX 10060 4430 512 512
ReadX 10060 4942 512 512
ReadX 10060 5454 512 512
ReadX 10060 5966 512 512
ReadX 10060 6478 512 512
ReadX 10060 6990 512 512
ReadX 10060 7502 424 424
ReadX 10060 3904 88 88
ReadX 10060 3992 512 512
ReadX 10060 4504 512 512
ReadX 10060 5016 512 512
ReadX 10060 5528 512 512
ReadX 10060 6040 512 512
ReadX 10060 6552 512 512
ReadX 10060 7064 424 424
ReadX 10060 3934 88 88
ReadX 10060 4022 512 512
ReadX 10060 4534 512 512
ReadX 10060 5046 512 512
ReadX 10060 5558 512 512
ReadX 10060 6070 512 512
ReadX 10060 6582 512 512
ReadX 10060 7094 512 512
ReadX 10060 7606 512 512
ReadX 10060 8118 512 512
ReadX 10060 8630 512 512
ReadX 10060 3953 512 512
ReadX 10060 4465 512 512
ReadX 10060 3956 512 512
ReadX 10060 3964 512 512
ReadX 10060 4476 512 512
ReadX 10060 4988 512 512
ReadX 10060 3970 512 512
ReadX 10060 4482 512 512
ReadX 10060 4994 512 512
ReadX 10060 5506 512 512
ReadX 10060 6018 512 512
ReadX 10060 6530 512 512
ReadX 10060 7042 512 512
ReadX 10060 7554 512 512
ReadX 10060 8066 512 512
ReadX 10060 8578 512 512
ReadX 10060 9090 512 512
ReadX 10060 9602 512 512
ReadX 10060 10114 512 512
ReadX 10060 10626 512 512
ReadX 10060 11138 512 512
ReadX 10060 11650 512 512
ReadX 10060 12162 512 512
ReadX 10060 12674 512 512
ReadX 10060 13186 512 512
ReadX 10060 13698 512 512
ReadX 10060 14210 134 134
ReadX 10060 3956 512 512
ReadX 10060 4468 512 512
ReadX 10060 4980 512 512
ReadX 10060 5492 512 512
ReadX 10060 3074 512 512
ReadX 10060 3246 512 512
ReadX 10060 3964 512 512
ReadX 10060 3330 512 512
ReadX 10060 3465 512 512
ReadX 10060 3246 512 512
ReadX 10060 3758 512 512
ReadX 10060 4270 512 512
ReadX 10060 4782 512 512
ReadX 10060 5294 512 512
ReadX 10060 5806 512 512
ReadX 10060 6318 512 512
ReadX 10060 6830 368 368
ReadX 10060 3232 144 144
ReadX 10060 3376 512 512
ReadX 10060 3888 512 512
ReadX 10060 4400 512 512
ReadX 10060 4912 512 512
ReadX 10060 5424 512 512
ReadX 10060 5936 512 512
ReadX 10060 6448 368 368
ReadX 10060 3262 144 144
ReadX 10060 3406 512 512
ReadX 10060 3918 512 512
ReadX 10060 4430 512 512
ReadX 10060 4942 512 512
ReadX 10060 5454 512 512
ReadX 10060 5966 512 512
ReadX 10060 6478 512 512
ReadX 10060 6990 512 512
ReadX 10060 7502 512 512
ReadX 10060 8014 512 512
ReadX 10060 8526 512 512
ReadX 10060 9038 512 512
ReadX 10060 9550 512 512
ReadX 10060 10062 512 512
ReadX 10060 10574 512 512
ReadX 10060 11086 512 512
ReadX 10060 11598 512 512
ReadX 10060 12110 512 512
ReadX 10060 12622 512 512
ReadX 10060 13134 512 512
ReadX 10060 13646 368 368
ReadX 10060 3332 144 144
ReadX 10060 3476 512 512
ReadX 10060 3988 512 512
ReadX 10060 4500 512 512
ReadX 10060 5012 512 512
ReadX 10060 5524 512 512
ReadX 10060 6036 512 512
ReadX 10060 6548 512 512
ReadX 10060 7060 512 512
ReadX 10060 7572 512 512
ReadX 10060 8084 512 512
ReadX 10060 8596 512 512
ReadX 10060 9108 512 512
ReadX 10060 9620 512 512
ReadX 10060 10132 512 512
ReadX 10060 10644 512 512
ReadX 10060 11156 512 512
ReadX 10060 11668 512 512
ReadX 10060 12180 512 512
ReadX 10060 12692 512 512
ReadX 10060 13204 512 512
ReadX 10060 3430 512 512
ReadX 10060 3942 512 512
ReadX 10060 3434 512 512
ReadX 10060 3435 512 512
ReadX 10060 3947 512 512
ReadX 10060 4459 512 512
ReadX 10060 4971 512 512
ReadX 10060 5483 512 512
ReadX 10060 5995 512 512
ReadX 10060 6507 512 512
ReadX 10060 7019 512 512
ReadX 10060 7531 512 512
ReadX 10060 8043 512 512
ReadX 10060 8555 512 512
ReadX 10060 9067 512 512
ReadX 10060 9579 512 512
ReadX 10060 10091 512 512
ReadX 10060 10603 512 512
ReadX 10060 11115 512 512
ReadX 10060 3467 512 512
ReadX 10060 3979 512 512
ReadX 10060 4491 512 512
ReadX 10060 5003 512 512
ReadX 10060 5515 512 512
ReadX 10060 6027 512 512
ReadX 10060 6539 512 512
ReadX 10060 7051 512 512
ReadX 10060 7563 512 512
ReadX 10060 8075 512 512
ReadX 10060 8587 512 512
ReadX 10060 9099 512 512
ReadX 10060 9611 512 512
ReadX 10060 10123 512 512
ReadX 10060 10635 512 512
ReadX 10060 11147 512 512
ReadX 10060 11659 512 512
ReadX 10060 12171 512 512
ReadX 10060 12683 512 512
ReadX 10060 13195 512 512
ReadX 10060 13707 56 56
ReadX 10060 13763 512 512
ReadX 10060 14275 456 456
ReadX 10060 14731 512 512
ReadX 10060 15243 512 512
ReadX 10060 15755 512 512
ReadX 10060 16267 512 512
ReadX 10060 16779 512 512
ReadX 10060 17291 512 512
ReadX 10060 17803 512 512
ReadX 10060 18315 512 512
ReadX 10060 18827 512 512
ReadX 10060 19339 512 512
ReadX 10060 19851 512 512
ReadX 10060 20363 512 512
ReadX 10060 20875 512 512
ReadX 10060 21387 512 512
ReadX 10060 21899 512 512
ReadX 10060 22411 512 512
ReadX 10060 22923 512 512
ReadX 10060 23435 512 512
ReadX 10060 23947 512 512
ReadX 10060 24459 512 512
ReadX 10060 24971 282 282
ReadX 10060 3434 512 512
ReadX 10060 2818 512 512
ReadX 10060 2870 512 512
ReadX 10060 3026 512 512
ReadX 10060 3538 512 512
ReadX 10060 2870 512 512
ReadX 10060 3382 512 512
ReadX 10060 3894 512 512
ReadX 10060 4406 512 512
ReadX 10060 4918 512 512
ReadX 10060 5430 512 512
ReadX 10060 5942 512 512
ReadX 10060 6454 374 374
ReadX 10060 2856 138 138
ReadX 10060 2994 512 512
ReadX 10060 3506 512 512
ReadX 10060 4018 512 512
ReadX 10060 4530 512 512
ReadX 10060 5042 512 512
ReadX 10060 5554 512 512
ReadX 10060 6066 374 374
ReadX 10060 2886 138 138
ReadX 10060 3024 512 512
ReadX 10060 3536 512 512
ReadX 10060 4048 512 512
ReadX 10060 4560 512 512
ReadX 10060 5072 512 512
ReadX 10060 5584 512 512
ReadX 10060 6096 512 512
ReadX 10060 6608 512 512
ReadX 10060 7120 512 512
ReadX 10060 7632 512 512
ReadX 10060 8144 512 512
ReadX 10060 8656 512 512
ReadX 10060 9168 512 512
ReadX 10060 9680 512 512
ReadX 10060 10192 512 512
ReadX 10060 10704 512 512
ReadX 10060 11216 512 512
ReadX 10060 11728 512 512
ReadX 10060 12240 512 512
ReadX 10060 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 10060 13264 512 512
ReadX 10060 13776 512 512
ReadX 10060 14288 512 512
ReadX 10060 14800 512 512
ReadX 10060 15312 512 512
ReadX 10060 15824 512 512
ReadX 10060 16336 512 512
ReadX 10060 16848 512 512
ReadX 10060 17360 512 512
ReadX 10060 17872 512 512
ReadX 10060 18384 512 512
ReadX 10060 18896 512 512
ReadX 10060 19408 512 512
ReadX 10060 19920 512 512
ReadX 10060 20432 512 512
ReadX 10060 20944 512 512
ReadX 10060 21456 512 512
ReadX 10060 21968 512 512
ReadX 10060 22480 512 512
ReadX 10060 22992 512 512
ReadX 10060 2998 512 512
ReadX 10060 3510 512 512
ReadX 10060 3001 512 512
ReadX 10060 3003 512 512
ReadX 10060 3515 512 512
ReadX 10060 4027 512 512
ReadX 10060 4539 512 512
ReadX 10060 5051 512 512
ReadX 10060 5563 512 512
ReadX 10060 6075 512 512
ReadX 10060 6587 512 512
ReadX 10060 7099 512 512
ReadX 10060 7611 512 512
ReadX 10060 8123 512 512
ReadX 10060 8635 512 512
ReadX 10060 3029 512 512
ReadX 10060 3541 512 512
ReadX 10060 4053 512 512
ReadX 10060 4565 512 512
ReadX 10060 5077 512 512
ReadX 10060 5589 512 512
ReadX 10060 6101 512 512
ReadX 10060 6613 512 512
ReadX 10060 7125 512 512
ReadX 10060 7637 512 512
ReadX 10060 8149 512 512
ReadX 10060 8661 512 512
ReadX 10060 9173 512 512
ReadX 10060 9685 512 512
ReadX 10060 10197 512 512
ReadX 10060 10709 512 512
ReadX 10060 11221 512 512
ReadX 10060 11733 512 512
ReadX 10060 12245 512 512
ReadX 10060 12757 512 512
ReadX 10060 13269 40 40
ReadX 10060 3076 472 472
ReadX 10060 3548 512 512
ReadX 10060 4060 512 512
ReadX 10060 4572 512 512
ReadX 10060 5084 512 512
ReadX 10060 5596 512 512
ReadX 10060 6108 512 512
ReadX 10060 6620 512 512
ReadX 10060 7132 512 512
ReadX 10060 7644 512 512
ReadX 10060 8156 512 512
ReadX 10060 8668 512 512
ReadX 10060 9180 512 512
ReadX 10060 9692 512 512
ReadX 10060 10204 512 512
ReadX 10060 10716 512 512
ReadX 10060 11228 512 512
ReadX 10060 11740 512 512
ReadX 10060 12252 512 512
ReadX 10060 12764 512 512
ReadX 10060 13276 310 310
ReadX 10060 3001 512 512
ReadX 10060 2562 512 512
ReadX 10060 2626 512 512
ReadX 10060 3003 512 512
ReadX 10060 2721 512 512
ReadX 10060 2626 512 512
ReadX 10060 3138 512 512
ReadX 10060 3650 512 512
ReadX 10060 4162 512 512
ReadX 10060 4674 512 512
ReadX 10060 5186 512 512
ReadX 10060 5698 512 512
ReadX 10060 6210 424 424
ReadX 10060 2612 88 88
ReadX 10060 2700 512 512
ReadX 10060 3212 512 512
ReadX 10060 3724 512 512
ReadX 10060 4236 512 512
ReadX 10060 4748 512 512
ReadX 10060 5260 512 512
ReadX 10060 5772 424 424
ReadX 10060 2642 88 88
ReadX 10060 2730 512 512
ReadX 10060 3242 512 512
ReadX 10060 3754 512 512
ReadX 10060 4266 512 512
ReadX 10060 4778 512 512
ReadX 10060 5290 512 512
ReadX 10060 5802 512 512
ReadX 10060 6314 512 512
ReadX 10060 6826 512 512
ReadX 10060 7338 512 512
ReadX 10060 7850 512 512
ReadX 10060 8362 512 512
ReadX 10060 8874 512 512
ReadX 10060 9386 512 512
ReadX 10060 9898 512 512
ReadX 10060 10410 512 512
ReadX 10060 10922 512 512
ReadX 10060 11434 512 512
ReadX 10060 11946 512 512
ReadX 10060 12458 512 512
ReadX 10060 2716 512 512
ReadX 10060 2717 512 512
ReadX 10060 2718 512 512
ReadX 10060 3230 512 512
ReadX 10060 2721 512 512
ReadX 10060 3233 512 512
ReadX 10060 3745 512 512
ReadX 10060 4257 512 512
ReadX 10060 4769 512 512
ReadX 10060 5281 512 512
ReadX 10060 5793 512 512
ReadX 10060 6305 512 512
ReadX 10060 6817 512 512
ReadX 10060 7329 512 512
ReadX 10060 7841 512 512
ReadX 10060 8353 512 512
ReadX 10060 8865 512 512
ReadX 10060 9377 512 512
ReadX 10060 9889 512 512
ReadX 10060 10401 512 512
ReadX 10060 10913 512 512
ReadX 10060 11425 512 512
ReadX 10060 11937 512 512
ReadX 10060 12449 512 512
ReadX 10060 12961 512 512
ReadX 10060 13473 512 512
ReadX 10060 13985 106 106
ReadX 10060 2820 406 406
ReadX 10060 3226 512 512
ReadX 10060 3738 512 512
ReadX 10060 4250 512 512
ReadX 10060 4762 512 512
ReadX 10060 5274 512 512
ReadX 10060 5786 512 512
ReadX 10060 6298 512 512
ReadX 10060 6810 512 512
ReadX 10060 7322 512 512
ReadX 10060 7834 512 512
ReadX 10060 8346 512 512
ReadX 10060 8858 512 512
ReadX 10060 9370 512 512
ReadX 10060 9882 512 512
ReadX 10060 10394 512 512
ReadX 10060 10906 512 512
ReadX 10060 11418 182 182
ReadX 10060 2717 512 512
ReadX 10060 258 512 512
ReadX 10060 470 512 512
ReadX 10060 376 512 512
ReadX 10060 888 512 512
ReadX 10060 1400 512 512
ReadX 10060 1912 512 512
ReadX 10060 2424 512 512
ReadX 10060 2936 512 512
ReadX 10060 3448 512 512
ReadX 10060 3960 424 424
ReadX 10060 362 88 88
ReadX 10060 450 512 512
ReadX 10060 962 512 512
ReadX 10060 1474 512 512
ReadX 10060 1986 512 512
ReadX 10060 2498 512 512
ReadX 10060 3010 512 512
ReadX 10060 3522 424 424
ReadX 10060 392 88 88
ReadX 10060 480 512 512
ReadX 10060 992 512 512
ReadX 10060 1504 512 512
ReadX 10060 2016 512 512
ReadX 10060 2528 512 512
ReadX 10060 3040 512 512
ReadX 10060 3552 512 512
ReadX 10060 4064 512 512
ReadX 10060 4576 512 512
ReadX 10060 5088 512 512
ReadX 10060 5600 512 512
ReadX 10060 6112 512 512
ReadX 10060 6624 512 512
ReadX 10060 7136 512 512
ReadX 10060 7648 512 512
ReadX 10060 8160 512 512
ReadX 10060 8672 512 512
ReadX 10060 9184 512 512
ReadX 10060 9696 512 512
ReadX 10060 10208 512 512
ReadX 10060 464 512 512
ReadX 10060 465 512 512
ReadX 10060 466 512 512
ReadX 10060 978 512 512
ReadX 10060 470 512 512
ReadX 10060 982 512 512
ReadX 10060 1494 512 512
ReadX 10060 2006 512 512
ReadX 10060 2518 512 512
ReadX 10060 3030 512 512
ReadX 10060 3542 512 512
ReadX 10060 4054 512 512
ReadX 10060 4566 512 512
ReadX 10060 5078 512 512
ReadX 10060 5590 512 512
ReadX 10060 6102 512 512
ReadX 10060 6614 512 512
ReadX 10060 7126 512 512
ReadX 10060 7638 512 512
ReadX 10060 8150 512 512
ReadX 10060 8662 512 512
ReadX 10060 9174 512 512
ReadX 10060 9686 512 512
ReadX 10060 10198 512 512
ReadX 10060 10710 333 333
ReadX 10060 11043 512 512
ReadX 10060 11555 179 179
ReadX 10060 11734 512 512
ReadX 10060 12246 512 512
ReadX 10060 12758 512 512
ReadX 10060 13270 512 512
ReadX 10060 13782 512 512
ReadX 10060 14294 512 512
ReadX 10060 14806 512 512
ReadX 10060 15318 512 512
ReadX 10060 15830 512 512
ReadX 10060 16342 512 512
ReadX 10060 16854 512 512
ReadX 10060 17366 512 512
ReadX 10060 17878 512 512
ReadX 10060 18390 512 512
ReadX 10060 18902 512 512
ReadX 10060 19414 512 512
ReadX 10060 19926 512 512
ReadX 10060 20438 512 512
ReadX 10060 20950 512 512
ReadX 10060 21462 512 512
ReadX 10060 21974 350 350
ReadX 10060 465 512 512
ReadX 10060 3812 512 512
ReadX 10060 4046 512 512
ReadX 10060 3828 512 512
ReadX 10060 256 512 512
ReadX 10060 260 512 512
ReadX 10060 4066 512 512
ReadX 10060 4578 512 512
ReadX 10060 5090 512 512
ReadX 10060 5602 512 512
ReadX 10060 6114 512 512
ReadX 10060 6626 512 512
ReadX 10060 7138 512 512
ReadX 10060 7650 394 394
ReadX 10060 4052 118 118
ReadX 10060 4170 512 512
ReadX 10060 4682 512 512
ReadX 10060 5194 512 512
ReadX 10060 5706 512 512
ReadX 10060 6218 512 512
ReadX 10060 6730 512 512
ReadX 10060 7242 394 394
ReadX 10060 4082 118 118
ReadX 10060 4200 512 512
ReadX 10060 4712 512 512
ReadX 10060 5224 512 512
ReadX 10060 5736 512 512
ReadX 10060 6248 512 512
ReadX 10060 6760 512 512
ReadX 10060 7272 512 512
ReadX 10060 7784 394 394
ReadX 10060 256 118 118
ReadX 10060 374 512 512
ReadX 10060 886 512 512
ReadX 10060 1398 512 512
ReadX 10060 1910 512 512
ReadX 10060 2422 512 512
ReadX 10060 2934 512 512
ReadX 10060 3446 512 512
ReadX 10060 3958 512 512
ReadX 10060 4470 512 512
ReadX 10060 4982 512 512
ReadX 10060 5494 512 512
ReadX 10060 6006 512 512
ReadX 10060 6518 512 512
ReadX 10060 7030 512 512
ReadX 10060 7542 512 512
ReadX 10060 8054 512 512
ReadX 10060 8566 512 512
ReadX 10060 9078 512 512
ReadX 10060 9590 512 512
ReadX 10060 10102 512 512
ReadX 10060 259 512 512
ReadX 10060 771 512 512
ReadX 10060 259 512 512
ReadX 10060 259 512 512
ReadX 10060 771 512 512
ReadX 10060 1283 512 512
ReadX 10060 1795 512 512
ReadX 10060 2307 512 512
ReadX 10060 2819 512 512
ReadX 10060 3331 512 512
ReadX 10060 3843 512 512
ReadX 10060 4355 512 512
ReadX 10060 4867 512 512
ReadX 10060 260 512 512
ReadX 10060 772 512 512
ReadX 10060 1284 512 512
ReadX 10060 1796 512 512
ReadX 10060 2308 512 512
ReadX 10060 2820 512 512
ReadX 10060 3332 512 512
ReadX 10060 3844 512 512
ReadX 10060 4356 512 512
ReadX 10060 4868 512 512
ReadX 10060 5380 512 512
ReadX 10060 5892 512 512
ReadX 10060 6404 512 512
ReadX 10060 6916 512 512
ReadX 10060 7428 512 512
ReadX 10060 7940 512 512
ReadX 10060 8452 512 512
ReadX 10060 8964 512 512
ReadX 10060 9476 512 512
ReadX 10060 9988 512 512
ReadX 10060 10500 378 378
ReadX 10060 10878 512 512
ReadX 10060 11390 134 134
ReadX 10060 11524 512 512
ReadX 10060 12036 512 512
ReadX 10060 12548 512 512
ReadX 10060 13060 512 512
ReadX 10060 13572 138 138
ReadX 10060 259 512 512
ReadX 10060 273 512 512
ReadX 10060 276 512 512
ReadX 10060 295 512 512
ReadX 10060 288 512 512
ReadX 10060 296 512 512
ReadX 10060 259 512 512
ReadX 10060 273 512 512
ReadX 10060 273 512 512
ReadX 10060 785 512 512
ReadX 10060 1297 512 512
ReadX 10060 1809 512 512
ReadX 10060 2321 512 512
ReadX 10060 274 512 512
ReadX 10060 274 512 512
ReadX 10060 274 497 497
ReadX 10060 272 15 15
ReadX 10060 287 512 512
ReadX 10060 799 512 512
ReadX 10060 273 512 512
ReadX 10060 785 512 512
ReadX 10060 1297 512 512
ReadX 10060 1809 512 512
ReadX 10060 2321 512 512
ReadX 10060 2833 317 317
ReadX 10060 274 195 195
ReadX 10060 469 512 512
ReadX 10060 981 512 512
ReadX 10060 1493 512 512
ReadX 10060 2005 512 512
ReadX 10060 2517 512 512
ReadX 10060 3029 512 512
ReadX 10060 3541 512 512
ReadX 10060 4053 512 512
ReadX 10060 4565 250 250
ReadX 10060 274 512 512
ReadX 10060 283 512 512
ReadX 10060 795 512 512
ReadX 10060 276 512 512
ReadX 10060 788 512 512
ReadX 10060 1300 512 512
ReadX 10060 1812 512 512
ReadX 10060 2324 512 512
ReadX 10060 2836 512 512
ReadX 10060 3348 512 512
ReadX 10060 3860 420 420
ReadX 10060 275 92 92
ReadX 10060 367 512 512
ReadX 10060 879 512 512
ReadX 10060 1391 512 512
ReadX 10060 1903 512 512
ReadX 10060 2415 512 512
ReadX 10060 2927 512 512
ReadX 10060 3439 420 420
ReadX 10060 277 92 92
ReadX 10060 369 512 512
ReadX 10060 881 512 512
ReadX 10060 1393 512 512
ReadX 10060 1905 512 512
ReadX 10060 2417 512 512
ReadX 10060 2929 512 512
ReadX 10060 3441 512 512
ReadX 10060 3953 512 512
ReadX 10060 4465 512 512
ReadX 10060 4977 512 512
ReadX 10060 5489 512 512
ReadX 10060 6001 512 512
ReadX 10060 6513 512 512
ReadX 10060 7025 512 512
ReadX 10060 7537 512 512
ReadX 10060 8049 512 512
ReadX 10060 8561 512 512
ReadX 10060 9073 512 512
ReadX 10060 9585 512 512
ReadX 10060 10097 512 512
ReadX 10060 282 512 512
ReadX 10060 794 512 512
ReadX 10060 1306 512 512
ReadX 10060 1818 512 512
ReadX 10060 2330 512 512
ReadX 10060 2842 512 512
ReadX 10060 3354 512 512
ReadX 10060 3866 512 512
ReadX 10060 4378 512 512
ReadX 10060 284 512 512
ReadX 10060 796 512 512
ReadX 10060 1308 512 512
ReadX 10060 1820 512 512
ReadX 10060 2332 512 512
ReadX 10060 2844 512 512
ReadX 10060 3356 512 512
ReadX 10060 3868 512 512
ReadX 10060 4380 512 512
ReadX 10060 4892 512 512
ReadX 10060 5404 512 512
ReadX 10060 5916 512 512
ReadX 10060 6428 512 512
ReadX 10060 6940 512 512
ReadX 10060 7452 512 512
ReadX 10060 7964 512 512
ReadX 10060 8476 512 512
ReadX 10060 8988 512 512
ReadX 10060 9500 512 512
ReadX 10060 10012 512 512
ReadX 10060 10524 472 472
ReadX 10060 288 40 40
ReadX 10060 328 512 512
ReadX 10060 840 512 512
ReadX 10060 1352 512 512
ReadX 10060 1864 512 512
ReadX 10060 2376 512 512
ReadX 10060 2888 512 512
ReadX 10060 3400 512 512
ReadX 10060 3912 512 512
ReadX 10060 4424 512 512
ReadX 10060 4936 512 512
ReadX 10060 5448 512 512
ReadX 10060 5960 512 512
ReadX 10060 6472 512 512
ReadX 10060 6984 512 512
ReadX 10060 7496 512 512
ReadX 10060 8008 512 512
ReadX 10060 8520 512 512
ReadX 10060 9032 512 512
ReadX 10060 9544 512 512
ReadX 10060 10056 512 512
ReadX 10060 10568 506 506
ReadX 10060 282 512 512
ReadX 10060 794 512 512
ReadX 10060 301 512 512
ReadX 10060 296 512 512
ReadX 10060 808 512 512
ReadX 10060 1320 512 512
ReadX 10060 1832 512 512
ReadX 10060 2344 512 512
ReadX 10060 2856 512 512
ReadX 10060 3368 512 512
ReadX 10060 3880 424 424
ReadX 10060 295 88 88
ReadX 10060 383 512 512
ReadX 10060 895 512 512
ReadX 10060 1407 512 512
ReadX 10060 1919 512 512
ReadX 10060 2431 512 512
ReadX 10060 2943 512 512
ReadX 10060 3455 424 424
ReadX 10060 297 88 88
ReadX 10060 385 512 512
ReadX 10060 897 512 512
ReadX 10060 1409 512 512
ReadX 10060 1921 512 512
ReadX 10060 2433 512 512
ReadX 10060 2945 512 512
ReadX 10060 3457 512 512
ReadX 10060 3969 512 512
ReadX 10060 4481 512 512
ReadX 10060 4993 512 512
ReadX 10060 5505 512 512
ReadX 10060 6017 512 512
ReadX 10060 6529 512 512
ReadX 10060 7041 512 512
ReadX 10060 7553 512 512
ReadX 10060 8065 512 512
ReadX 10060 8577 512 512
ReadX 10060 9089 512 512
ReadX 10060 9601 512 512
ReadX 10060 10113 512 512
ReadX 10060 301 512 512
ReadX 10060 301 512 512
ReadX 10060 301 512 512
ReadX 10060 813 512 512
ReadX 10060 301 512 512
ReadX 10060 813 512 512
ReadX 10060 1325 512 512
ReadX 10060 1837 512 512
ReadX 10060 2349 512 512
ReadX 10060 2861 512 512
ReadX 10060 3373 512 512
ReadX 10060 3885 512 512
ReadX 10060 4397 512 512
ReadX 10060 4909 512 512
ReadX 10060 5421 512 512
ReadX 10060 5933 512 512
ReadX 10060 6445 512 512
ReadX 10060 6957 512 512
ReadX 10060 7469 512 512
ReadX 10060 7981 512 512
ReadX 10060 8493 512 512
ReadX 10060 9005 512 512
ReadX 10060 9517 463 463
ReadX 10060 9980 512 512
ReadX 10060 10492 49 49
ReadX 10060 10541 512 512
ReadX 10060 11053 512 512
ReadX 10060 11565 512 512
ReadX 10060 12077 512 512
ReadX 10060 12589 512 512
ReadX 10060 13101 512 512
ReadX 10060 13613 512 512
ReadX 10060 14125 512 512
ReadX 10060 14637 512 512
ReadX 10060 15149 512 512
ReadX 10060 15661 512 512
ReadX 10060 16173 512 512
ReadX 10060 16685 512 512
ReadX 10060 17197 512 512
ReadX 10060 17709 512 512
ReadX 10060 18221 512 512
ReadX 10060 18733 512 512
ReadX 10060 19245 512 512
ReadX 10060 19757 512 512
ReadX 10060 20269 512 512
ReadX 10060 20781 326 326
ReadX 10060 301 512 512
QUERY_FS_INFORMATION 259
Close 10058
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10061
Close 10061
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10062
ReadX 10062 0 24 24
Close 10062
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10063
QUERY_FILE_INFORMATION 10063
ReadX 10063 0 512 512
ReadX 10063 476 512 512
ReadX 10063 510 512 512
ReadX 10063 484 512 512
ReadX 10063 474 512 512
ReadX 10063 478 512 512
ReadX 10063 990 512 512
ReadX 10063 509 57 57
Close 10063
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10064
QUERY_FILE_INFORMATION 10064
ReadX 10064 0 512 512
ReadX 10064 476 512 512
ReadX 10064 510 512 512
ReadX 10064 484 512 512
ReadX 10064 480 512 512
ReadX 10064 474 512 512
ReadX 10064 478 512 512
QUERY_FILE_INFORMATION 10064
WriteX 10064 494 60 60
WriteX 10064 494 4 4
QUERY_FILE_INFORMATION 10064
WriteX 10064 494 11 11
WriteX 10064 510 512 512
WriteX 10064 484 512 512
WriteX 10064 474 512 512
WriteX 10064 478 512 512
WriteX 10064 990 512 512
Close 10064
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 10065
Close 10065
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 10066
Close 10066
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10068
WriteX 10068 4607 1 1
QUERY_FILE_INFORMATION 10068
WriteX 10068 0 57856 57856
WriteX 10068 0 16384 16384
WriteX 10068 57344 27682 27682
Close 10068
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10069
QUERY_FILE_INFORMATION 10069
ReadX 10069 0 512 512
ReadX 10069 482 512 512
ReadX 10069 994 512 512
ReadX 10069 1506 512 512
ReadX 10069 480 512 512
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 490 448 448
QUERY_FILE_INFORMATION 10069
WriteX 10069 490 60 60
WriteX 10069 490 4 4
QUERY_FILE_INFORMATION 10069
WriteX 10069 490 11 11
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 484 512 512
WriteX 10069 996 512 512
WriteX 10069 1508 512 512
WriteX 10069 482 512 512
WriteX 10069 0 512 512
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
ReadX 10069 490 512 512
WriteX 10069 502 512 512
WriteX 10069 502 292 292
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 503 20 20
WriteX 10069 503 108 108
QUERY_FILE_INFORMATION 10069
WriteX 10069 504 448 448
QUERY_FILE_INFORMATION 10069
WriteX 10069 504 44 44
WriteX 10069 504 20 20
WriteX 10069 500 512 512
WriteX 10069 492 512 512
WriteX 10069 496 512 512
WriteX 10069 1008 512 512
WriteX 10069 494 512 512
Flush 10069
WriteX 10069 0 512 512
Flush 10069
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 500 512 512
WriteX 10069 492 512 512
WriteX 10069 496 512 512
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 518 320 320
QUERY_FILE_INFORMATION 10069
WriteX 10069 518 60 60
ReadX 10069 504 512 512
WriteX 10069 522 512 512
WriteX 10069 506 3204 3204
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 519 25 25
WriteX 10069 518 103 103
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 519 44 44
WriteX 10069 519 20 20
WriteX 10069 520 512 512
WriteX 10069 482 512 512
WriteX 10069 486 512 512
WriteX 10069 998 512 512
WriteX 10069 484 512 512
WriteX 10069 490 512 512
Flush 10069
WriteX 10069 0 512 512
Flush 10069
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
QUERY_FILE_INFORMATION 10069
WriteX 10069 519 7 7
WriteX 10069 519 57 57
WriteX 10069 520 512 512
WriteX 10069 492 512 512
WriteX 10069 482 512 512
WriteX 10069 486 512 512
WriteX 10069 998 512 512
Flush 10069
WriteX 10069 520 512 512
Flush 10069
Close 10069
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10070
Close 10070
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10071
QUERY_FILE_INFORMATION 10071
ReadX 10071 0 512 512
ReadX 10071 490 512 512
ReadX 10071 484 512 512
ReadX 10071 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 10072
Close 10072
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10073
Close 10073
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10074
ReadX 10074 0 24 24
Close 10074
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10075
QUERY_FILE_INFORMATION 10075
ReadX 10075 0 512 512
ReadX 10075 366 512 512
ReadX 10075 878 512 512
ReadX 10075 1390 512 512
ReadX 10075 1902 512 512
ReadX 10075 374 57 57
Close 10075
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10076
QUERY_FILE_INFORMATION 10076
ReadX 10076 0 512 512
ReadX 10076 366 512 512
ReadX 10076 878 512 512
ReadX 10076 1390 512 512
ReadX 10076 1902 512 512
QUERY_FILE_INFORMATION 10076
WriteX 10076 374 60 60
WriteX 10076 374 4 4
QUERY_FILE_INFORMATION 10076
WriteX 10076 374 11 11
ReadX 10076 374 57 57
ReadX 10076 374 57 57
ReadX 10076 292 4096 4096
ReadX 10076 364 512 512
ReadX 10076 512 4096 4096
ReadX 10076 4608 4096 4096
ReadX 10076 8704 4096 4096
ReadX 10076 12800 4096 4096
ReadX 10076 16896 4096 4096
ReadX 10076 20992 4096 4096
ReadX 10076 25088 4096 4096
ReadX 10076 29184 4096 4096
ReadX 10076 33280 4096 4096
ReadX 10076 37376 4096 4096
ReadX 10076 41472 4096 4096
ReadX 10076 45568 4096 4096
ReadX 10076 49664 4096 4096
ReadX 10076 53760 4096 4096
ReadX 10076 57856 4096 4096
ReadX 10076 61952 4096 4096
ReadX 10076 66048 4096 4096
ReadX 10076 70144 4096 4096
ReadX 10076 74240 162 162
ReadX 10076 308 4096 4096
ReadX 10076 4404 4096 4096
WriteX 10076 368 512 512
WriteX 10076 880 512 512
WriteX 10076 1392 512 512
Close 10076
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10077
Close 10077
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10078
QUERY_FILE_INFORMATION 10078
ReadX 10078 0 512 512
ReadX 10078 366 512 512
ReadX 10078 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10079
Close 10079
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10078
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10081
WriteX 10081 4607 1 1
QUERY_FILE_INFORMATION 10081
WriteX 10081 0 65471 65471
WriteX 10081 65471 65 65
WriteX 10081 65536 8866 8866
Close 10081
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10082
QUERY_FILE_INFORMATION 10082
ReadX 10082 0 512 512
ReadX 10082 366 512 512
ReadX 10082 878 512 512
ReadX 10082 1390 512 512
ReadX 10082 364 512 512
QUERY_FILE_INFORMATION 10082
QUERY_FILE_INFORMATION 10082
QUERY_FILE_INFORMATION 10082
WriteX 10082 374 448 448
QUERY_FILE_INFORMATION 10082
WriteX 10082 374 60 60
WriteX 10082 374 4 4
QUERY_FILE_INFORMATION 10082
WriteX 10082 374 11 11
QUERY_FILE_INFORMATION 10082
QUERY_FILE_INFORMATION 10082
WriteX 10082 374 7 7
WriteX 10082 374 57 57
WriteX 10082 368 512 512
WriteX 10082 880 512 512
WriteX 10082 1392 512 512
WriteX 10082 366 512 512
WriteX 10082 0 512 512
Flush 10082
WriteX 10082 368 512 512
Flush 10082
Close 10082
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10083
QUERY_FILE_INFORMATION 10083
ReadX 10083 0 512 512
ReadX 10083 366 512 512
ReadX 10083 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10083
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10084
Close 10084
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10085
ReadX 10085 0 24 24
Close 10085
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10086
QUERY_FILE_INFORMATION 10086
ReadX 10086 0 512 512
ReadX 10086 366 512 512
ReadX 10086 878 512 512
ReadX 10086 1390 512 512
ReadX 10086 1902 512 512
ReadX 10086 374 57 57
Close 10086
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10087
QUERY_FILE_INFORMATION 10087
ReadX 10087 0 512 512
ReadX 10087 366 512 512
ReadX 10087 878 512 512
ReadX 10087 1390 512 512
ReadX 10087 1902 512 512
QUERY_FILE_INFORMATION 10087
WriteX 10087 374 60 60
WriteX 10087 374 4 4
QUERY_FILE_INFORMATION 10087
WriteX 10087 374 11 11
WriteX 10087 368 512 512
WriteX 10087 880 512 512
WriteX 10087 1392 512 512
Close 10087
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 10088
Close 10088
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 10089
Close 10089
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10091
WriteX 10091 4607 1 1
QUERY_FILE_INFORMATION 10091
WriteX 10091 0 65471 65471
WriteX 10091 65471 65 65
WriteX 10091 65536 9298 9298
Close 10091
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10092
QUERY_FILE_INFORMATION 10092
ReadX 10092 0 512 512
ReadX 10092 368 512 512
ReadX 10092 880 512 512
ReadX 10092 1392 512 512
ReadX 10092 366 512 512
QUERY_FILE_INFORMATION 10092
QUERY_FILE_INFORMATION 10092
QUERY_FILE_INFORMATION 10092
WriteX 10092 376 448 448
QUERY_FILE_INFORMATION 10092
WriteX 10092 376 60 60
WriteX 10092 376 4 4
QUERY_FILE_INFORMATION 10092
WriteX 10092 376 11 11
QUERY_FILE_INFORMATION 10092
QUERY_FILE_INFORMATION 10092
WriteX 10092 376 7 7
WriteX 10092 376 57 57
WriteX 10092 370 512 512
WriteX 10092 882 512 512
WriteX 10092 1394 512 512
WriteX 10092 368 512 512
WriteX 10092 0 512 512
Flush 10092
WriteX 10092 370 512 512
Flush 10092
Close 10092
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10093
Close 10093
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10094
QUERY_FILE_INFORMATION 10094
ReadX 10094 0 512 512
ReadX 10094 368 512 512
ReadX 10094 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 10095
Close 10095
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10097
Close 10097
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10098
ReadX 10098 0 24 24
Close 10098
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10099
QUERY_FILE_INFORMATION 10099
ReadX 10099 0 512 512
ReadX 10099 512 512 512
ReadX 10099 1024 512 512
ReadX 10099 2016 512 512
ReadX 10099 1056 512 512
ReadX 10099 1096 57 57
Close 10099
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10100
QUERY_FILE_INFORMATION 10100
ReadX 10100 0 512 512
ReadX 10100 512 512 512
ReadX 10100 1024 512 512
ReadX 10100 2016 512 512
ReadX 10100 1056 512 512
ReadX 10100 1096 57 57
ReadX 10100 1096 57 57
ReadX 10100 1088 62 62
ReadX 10100 1536 4096 4096
ReadX 10100 5632 4096 4096
ReadX 10100 9728 4096 4096
ReadX 10100 13824 2859 2859
ReadX 10100 1120 28 28
ReadX 10100 1148 20 20
ReadX 10100 1168 8 8
ReadX 10100 1176 88 88
ReadX 10100 1264 8 8
ReadX 10100 1272 4 4
ReadX 10100 1276 4 4
ReadX 10100 1280 1 1
ReadX 10100 1130 4 4
ReadX 10100 1134 4 4
ReadX 10100 1138 1 1
ReadX 10100 1131 4 4
ReadX 10100 1135 4 4
ReadX 10100 1139 1 1
ReadX 10100 1131 4 4
ReadX 10100 1135 4 4
ReadX 10100 1139 2 2
ReadX 10100 1132 4 4
ReadX 10100 1136 4 4
ReadX 10100 1140 25 25
ReadX 10100 1134 4 4
ReadX 10100 1138 8 8
ReadX 10100 1146 4 4
ReadX 10100 1150 8 8
ReadX 10100 1158 4 4
ReadX 10100 1162 8 8
ReadX 10100 1170 4 4
ReadX 10100 1174 4 4
ReadX 10100 1178 4 4
ReadX 10100 1182 4 4
ReadX 10100 1186 4 4
ReadX 10100 1190 4 4
ReadX 10100 1194 13900 13900
ReadX 10100 2048 4096 4096
Close 10100
QUERY_FS_INFORMATION 259
Close 10094
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10101
Close 10101
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10102
ReadX 10102 0 24 24
Close 10102
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10103
QUERY_FILE_INFORMATION 10103
ReadX 10103 0 512 512
ReadX 10103 368 512 512
ReadX 10103 880 512 512
ReadX 10103 1392 512 512
ReadX 10103 1904 512 512
ReadX 10103 376 57 57
Close 10103
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10104
QUERY_FILE_INFORMATION 10104
ReadX 10104 0 512 512
ReadX 10104 368 512 512
ReadX 10104 880 512 512
ReadX 10104 1392 512 512
ReadX 10104 1904 512 512
QUERY_FILE_INFORMATION 10104
WriteX 10104 376 60 60
WriteX 10104 376 4 4
QUERY_FILE_INFORMATION 10104
WriteX 10104 376 11 11
WriteX 10104 370 512 512
WriteX 10104 882 512 512
WriteX 10104 1394 512 512
Close 10104
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 10105
Close 10105
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 10106
Close 10106
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10108
WriteX 10108 4607 1 1
QUERY_FILE_INFORMATION 10108
WriteX 10108 0 65471 65471
WriteX 10108 65471 65 65
WriteX 10108 65536 11540 11540
Close 10108
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10109
QUERY_FILE_INFORMATION 10109
ReadX 10109 0 512 512
ReadX 10109 398 512 512
ReadX 10109 910 512 512
ReadX 10109 1422 512 512
ReadX 10109 396 512 512
QUERY_FILE_INFORMATION 10109
QUERY_FILE_INFORMATION 10109
QUERY_FILE_INFORMATION 10109
WriteX 10109 406 448 448
QUERY_FILE_INFORMATION 10109
WriteX 10109 406 60 60
WriteX 10109 406 4 4
QUERY_FILE_INFORMATION 10109
WriteX 10109 406 11 11
QUERY_FILE_INFORMATION 10109
QUERY_FILE_INFORMATION 10109
WriteX 10109 406 7 7
WriteX 10109 406 57 57
WriteX 10109 400 512 512
WriteX 10109 912 512 512
WriteX 10109 1424 512 512
WriteX 10109 398 512 512
WriteX 10109 0 512 512
Flush 10109
WriteX 10109 400 512 512
Flush 10109
Close 10109
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10110
Close 10110
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10111
QUERY_FILE_INFORMATION 10111
ReadX 10111 0 512 512
ReadX 10111 398 512 512
ReadX 10111 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 10112
Close 10112
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10111
ReadX 10060 1434 512 512
Close 10060
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10113
WriteX 10113 0 65471 65471
WriteX 10113 65471 63 63
WriteX 10113 65534 65471 65471
WriteX 10113 131005 63 63
Close 10113
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10114
WriteX 10114 0 65471 65471
WriteX 10114 65471 63 63
WriteX 10114 65534 65471 65471
WriteX 10114 131005 63 63
WriteX 10114 131068 65471 65471
WriteX 10114 196539 63 63
WriteX 10114 196602 65471 65471
WriteX 10114 262073 63 63
Close 10114
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10115
WriteX 10115 0 65471 65471
WriteX 10115 65471 63 63
WriteX 10115 65534 65471 65471
WriteX 10115 131005 63 63
WriteX 10115 131068 65471 65471
WriteX 10115 196539 63 63
WriteX 10115 196602 65471 65471
WriteX 10115 262073 63 63
WriteX 10115 262136 65471 65471
WriteX 10115 327607 63 63
WriteX 10115 327670 65471 65471
WriteX 10115 393141 63 63
WriteX 10115 393204 65471 65471
WriteX 10115 458675 63 63
WriteX 10115 458738 65471 65471
WriteX 10115 524209 63 63
Close 10115
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10116
Close 10116
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 10117
ReadX 10117 0 512 512
ReadX 10117 512 511 511
ReadX 10117 1023 512 512
ReadX 10117 1535 512 512
Close 10117
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 10118
ReadX 10118 0 512 512
ReadX 10118 512 510 510
ReadX 10118 1022 512 512
ReadX 10118 1534 510 510
ReadX 10118 2044 510 510
Close 10118
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 10119
ReadX 10119 0 512 512
ReadX 10119 512 512 512
ReadX 10119 1024 512 512
ReadX 10119 1536 512 512
ReadX 10119 2048 512 512
ReadX 10119 2560 512 512
ReadX 10119 3072 512 512
ReadX 10119 3584 512 512
ReadX 10119 4096 512 512
ReadX 10119 4608 512 512
ReadX 10119 5120 512 512
ReadX 10119 5632 512 512
ReadX 10119 6144 512 512
ReadX 10119 6656 512 512
ReadX 10119 7168 512 512
ReadX 10119 7680 512 512
ReadX 10119 8192 512 512
ReadX 10119 8704 512 512
Close 10119
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10120
Close 10120
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 10121
QUERY_FILE_INFORMATION 10121
Close 10121
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 10122
ReadX 10122 0 8192 8192
Close 10122
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 10123
Close 10123
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 10124
QUERY_FILE_INFORMATION 10124
Close 10124
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 10125
ReadX 10125 0 8192 8192
Close 10125
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10126
Close 10126
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 10127
QUERY_FILE_INFORMATION 10127
Close 10127
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 10128
ReadX 10128 0 8192 8192
Close 10128
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 10129
ReadX 10129 0 8192 8192
ReadX 10129 8192 8192 8192
ReadX 10129 16384 8192 8192
ReadX 10129 24576 8192 8192
Close 10129
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 10131
Close 10131
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 10133
WriteX 10133 8191 1 1
QUERY_FILE_INFORMATION 10133
WriteX 10133 0 10438 10438
Close 10133
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 10134
Close 10134
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 10135
QUERY_FILE_INFORMATION 10135
QUERY_FILE_INFORMATION 10135
Close 10135
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 10136
QUERY_FILE_INFORMATION 10136
QUERY_FILE_INFORMATION 10136
Close 10136
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 10137
Close 10137
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 10138
QUERY_FILE_INFORMATION 10138
QUERY_FILE_INFORMATION 10138
Close 10138
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 10139
QUERY_FILE_INFORMATION 10139
QUERY_FILE_INFORMATION 10139
Close 10139
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 10140
Close 10140
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 10141
QUERY_FILE_INFORMATION 10141
QUERY_FILE_INFORMATION 10141
Close 10141
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 10142
QUERY_FILE_INFORMATION 10142
QUERY_FILE_INFORMATION 10142
Close 10142
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 10143
Close 10143
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 10144
QUERY_FILE_INFORMATION 10144
QUERY_FILE_INFORMATION 10144
Close 10144
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 10145
ReadX 10145 0 8 8
ReadX 10145 8 4 4
ReadX 10145 12 8 8
ReadX 10145 22 8 8
ReadX 10145 520 8 8
ReadX 10145 525 8 8
ReadX 10145 533 4 4
ReadX 10145 543 8 8
ReadX 10145 551 4 4
ReadX 10145 1058 8 8
ReadX 10145 1066 4 4
ReadX 10145 1081 8 8
ReadX 10145 1089 4 4
ReadX 10145 660 8 8
Close 10145
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 10146
ReadX 10146 0 8192 8192
Close 10146
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 10147
ReadX 10147 0 8192 8192
ReadX 10147 520 8192 8192
ReadX 10147 8712 8192 8192
ReadX 10147 16904 8192 8192
ReadX 10147 25096 8192 8192
ReadX 10147 33288 8192 8192
ReadX 10147 41480 8192 8192
ReadX 10147 49672 8192 8192
ReadX 10147 57864 8192 8192
ReadX 10147 66056 8192 8192
ReadX 10147 74248 8192 8192
ReadX 10147 82440 8192 8192
ReadX 10147 90632 8192 8192
ReadX 10147 98824 8192 8192
ReadX 10147 107016 8192 8192
ReadX 10147 115208 8192 8192
ReadX 10147 123400 8192 8192
ReadX 10147 131592 8192 8192
ReadX 10147 139784 8192 8192
ReadX 10147 147976 8192 8192
ReadX 10147 156168 8192 8192
Close 10147
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 10148
QUERY_FILE_INFORMATION 10148
Close 10148
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 10149
Close 10149
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 10151
WriteX 10151 8191 1 1
QUERY_FILE_INFORMATION 10151
WriteX 10151 0 28489 28489
Close 10151
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 10152
Close 10152
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 10153
Close 10153
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 10154
QUERY_FILE_INFORMATION 10154
Close 10154
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 10155
ReadX 10155 0 8192 8192
Close 10155
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10156
Close 10156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 10157
QUERY_FILE_INFORMATION 10157
Close 10157
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 10158
ReadX 10158 0 8192 8192
Close 10158
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 10159
ReadX 10159 0 8192 8192
ReadX 10159 8192 8192 8192
ReadX 10159 16384 8192 8192
ReadX 10159 24576 8192 8192
ReadX 10159 32768 16384 16384
ReadX 10159 49152 8192 8192
ReadX 10159 57344 8192 8192
ReadX 10159 65536 8192 8192
Close 10159
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 10161
Close 10161
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 10163
WriteX 10163 8191 1 1
QUERY_FILE_INFORMATION 10163
WriteX 10163 0 29253 29253
Close 10163
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 10164
Close 10164
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 10165
QUERY_FILE_INFORMATION 10165
QUERY_FILE_INFORMATION 10165
Close 10165
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 10166
QUERY_FILE_INFORMATION 10166
QUERY_FILE_INFORMATION 10166
Close 10166
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 10167
QUERY_FILE_INFORMATION 10167
Close 10167
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 10168
Close 10168
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 10170
WriteX 10170 8191 1 1
QUERY_FILE_INFORMATION 10170
WriteX 10170 0 30183 30183
Close 10170
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 10171
Close 10171
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 10172
WriteX 10172 0 510 510
WriteX 10172 510 512 512
WriteX 10172 1022 510 510
WriteX 10172 1532 510 510
WriteX 10172 2042 168 168
Close 10172
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10173
Close 10173
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 10174
WriteX 10174 0 511 511
WriteX 10174 511 512 512
WriteX 10174 1023 512 512
WriteX 10174 1535 488 488
Close 10174
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10175
ReadX 10175 0 65471 65471
ReadX 10175 65471 63 63
ReadX 10175 65534 65471 65471
ReadX 10175 131005 63 63
ReadX 10175 131068 65471 65471
ReadX 10175 196539 63 63
ReadX 10175 196602 65471 65471
ReadX 10175 262073 63 63
ReadX 10175 262136 65471 65471
ReadX 10175 327607 63 63
ReadX 10175 327670 10 10
Close 10175
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10176
ReadX 10176 0 65471 65471
ReadX 10176 65471 63 63
ReadX 10176 65534 65471 65471
ReadX 10176 131005 63 63
ReadX 10176 131068 65471 65471
ReadX 10176 196539 63 63
ReadX 10176 196602 65471 65471
ReadX 10176 262073 63 63
ReadX 10176 262136 65471 65471
ReadX 10176 327607 63 63
ReadX 10176 327670 65471 65471
ReadX 10176 393141 63 63
ReadX 10176 393204 65471 65471
ReadX 10176 458675 63 63
ReadX 10176 458738 65471 65471
ReadX 10176 524209 63 63
ReadX 10176 524272 65471 65471
ReadX 10176 589743 63 63
ReadX 10176 589806 65471 65471
ReadX 10176 655277 63 63
ReadX 10176 655340 32 32
Close 10176
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10177
ReadX 10177 0 65471 65471
ReadX 10177 65471 63 63
ReadX 10177 65534 65471 65471
ReadX 10177 131005 63 63
ReadX 10177 131068 65471 65471
ReadX 10177 196539 63 63
ReadX 10177 196602 65471 65471
ReadX 10177 262073 63 63
ReadX 10177 262136 65471 65471
ReadX 10177 327607 63 63
ReadX 10177 327670 65471 65471
ReadX 10177 393141 63 63
ReadX 10177 393204 65471 65471
ReadX 10177 458675 63 63
ReadX 10177 458738 65471 65471
ReadX 10177 524209 63 63
ReadX 10177 524272 65471 65471
ReadX 10177 589743 63 63
ReadX 10177 589806 65471 65471
ReadX 10177 655277 63 63
ReadX 10177 655340 65471 65471
ReadX 10177 720811 63 63
ReadX 10177 720874 65471 65471
ReadX 10177 786345 63 63
ReadX 10177 786408 65471 65471
ReadX 10177 851879 63 63
ReadX 10177 851942 65471 65471
ReadX 10177 917413 63 63
ReadX 10177 917476 65471 65471
ReadX 10177 982947 63 63
ReadX 10177 983010 65471 65471
ReadX 10177 1048481 63 63
ReadX 10177 1048544 65471 65471
ReadX 10177 1114015 63 63
ReadX 10177 1114078 65471 65471
ReadX 10177 1179549 63 63
ReadX 10177 1179612 65471 65471
ReadX 10177 1245083 63 63
ReadX 10177 1245146 65471 65471
ReadX 10177 1310617 63 63
ReadX 10177 1310680 65471 65471
ReadX 10177 1376151 63 63
ReadX 10177 1376214 65471 65471
ReadX 10177 1441685 63 63
ReadX 10177 1441748 65471 65471
ReadX 10177 1507219 63 63
ReadX 10177 1507282 65471 65471
ReadX 10177 1572753 63 63
ReadX 10177 1572816 65471 65471
ReadX 10177 1638287 63 63
ReadX 10177 1638350 65471 65471
ReadX 10177 1703821 63 63
ReadX 10177 1703884 65471 65471
ReadX 10177 1769355 63 63
ReadX 10177 1769418 65471 65471
ReadX 10177 1834889 63 63
ReadX 10177 1834952 32824 32824
Close 10177
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 10178
QUERY_FILE_INFORMATION 10178
ReadX 10178 0 512 512
ReadX 10178 512 512 512
ReadX 10178 1024 512 512
QUERY_FILE_INFORMATION 10178
QUERY_FILE_INFORMATION 10178
ReadX 10178 512 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 10178
QUERY_FILE_INFORMATION 10178
ReadX 10178 512 4096 4096
QUERY_FILE_INFORMATION 10178
QUERY_FILE_INFORMATION 10178
QUERY_FILE_INFORMATION 10178
WriteX 10178 512 4096 4096
WriteX 10178 1024 512 512
ReadX 10178 502 512 512
QUERY_FILE_INFORMATION 10178
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10178 2560 512 512
ReadX 10178 1536 512 512
ReadX 10178 2176 384 384
ReadX 10178 3072 128 128
ReadX 10178 3107 512 512
ReadX 10178 3619 512 512
ReadX 10178 4131 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10178 286 123 123
ReadX 10178 292 24 24
ReadX 10178 512 2048 2048
ReadX 10178 512 2048 2048
ReadX 10178 2560 2048 2048
ReadX 10178 416 1536 1536
ReadX 10178 768 512 512
ReadX 10178 1280 2048 2048
ReadX 10178 3328 2048 2048
ReadX 10178 5376 2048 2048
ReadX 10178 7424 2048 2048
ReadX 10178 9472 2048 2048
ReadX 10178 11520 2048 2048
ReadX 10178 13568 2048 2048
ReadX 10178 15616 2048 2048
ReadX 10178 17664 2048 2048
ReadX 10178 19712 2048 2048
ReadX 10178 21760 2048 2048
ReadX 10178 23808 2048 2048
ReadX 10178 25856 2048 2048
ReadX 10178 27904 2048 2048
ReadX 10178 29952 2048 2048
ReadX 10178 32000 2048 2048
ReadX 10178 34048 2048 2048
ReadX 10178 36096 2048 2048
ReadX 10178 38144 2048 2048
ReadX 10178 40192 2048 2048
ReadX 10178 42240 512 512
ReadX 10178 42752 2048 2048
ReadX 10178 44800 2048 2048
ReadX 10178 46848 2048 2048
ReadX 10178 48896 2048 2048
ReadX 10178 50944 2048 2048
ReadX 10178 52992 2048 2048
ReadX 10178 55040 2048 2048
ReadX 10178 57088 2048 2048
ReadX 10178 316 2048 2048
ReadX 10178 2364 2048 2048
ReadX 10178 4412 2048 2048
ReadX 10178 6460 2048 2048
ReadX 10178 8508 2048 2048
ReadX 10178 10556 2048 2048
ReadX 10178 12604 2048 2048
ReadX 10178 14652 2048 2048
ReadX 10178 16700 2048 2048
ReadX 10178 18748 2048 2048
ReadX 10178 20796 2048 2048
ReadX 10178 22844 2048 2048
ReadX 10178 24892 2048 2048
ReadX 10178 26940 2048 2048
ReadX 10178 28988 2048 2048
ReadX 10178 31036 2048 2048
ReadX 10178 436 2048 2048
ReadX 10178 2484 2048 2048
ReadX 10178 4532 2048 2048
ReadX 10178 6580 2048 2048
ReadX 10178 8628 2048 2048
ReadX 10178 10676 2048 2048
ReadX 10178 476 2048 2048
ReadX 10178 476 2048 2048
ReadX 10178 476 2048 2048
ReadX 10178 2524 2048 2048
ReadX 10178 484 2048 2048
ReadX 10178 484 2048 2048
ReadX 10178 484 2048 2048
ReadX 10178 2532 665 665
ReadX 10178 492 665 665
ReadX 10178 492 665 665
ReadX 10178 492 665 665
ReadX 10178 296 512 512
ReadX 10178 318 512 512
ReadX 10178 300 512 512
ReadX 10178 312 512 512
ReadX 10178 320 512 512
ReadX 10178 832 354 354
ReadX 10178 504 4096 4096
ReadX 10178 496 1428 1428
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 10179
Close 10179
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 10180
WriteX 10180 1535 1 1
QUERY_FILE_INFORMATION 10180
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10178 296 1251 1251
ReadX 10178 2176 384 384
ReadX 10178 3072 1634 1634
QUERY_FILE_INFORMATION 10180
WriteX 10180 0 57088 57088
WriteX 10180 0 4096 4096
Flush 10180
Close 10178
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 10181
Close 10181
WriteX 10180 0 4096 4096
Close 10180
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 10182
Close 10182
Rename \clients\client1\~dmtmp\EXCEL\5D7C0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 10183
QUERY_FILE_INFORMATION 10183
ReadX 10183 0 512 512
ReadX 10183 512 512 512
ReadX 10183 1024 512 512
QUERY_FILE_INFORMATION 10183
QUERY_FILE_INFORMATION 10183
ReadX 10183 512 2048 2048
QUERY_FILE_INFORMATION 10183
QUERY_FILE_INFORMATION 10183
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10183 4096 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 10184
WriteX 10184 1535 1 1
QUERY_FILE_INFORMATION 10184
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10183 1536 512 512
ReadX 10183 288 1251 1251
ReadX 10183 2048 2018 2018
QUERY_FILE_INFORMATION 10184
WriteX 10184 0 51456 51456
WriteX 10184 0 4096 4096
Flush 10184
QUERY_FILE_INFORMATION 10183
QUERY_FILE_INFORMATION 10183
Close 10183
WriteX 10184 0 4096 4096
Close 10184
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x200000 0x1 10185
Close 10185
Rename \clients\client1\~dmtmp\EXCEL\0BBC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 10186
QUERY_FILE_INFORMATION 10186
ReadX 10186 0 512 512
ReadX 10186 512 512 512
ReadX 10186 1024 512 512
QUERY_FILE_INFORMATION 10186
QUERY_FILE_INFORMATION 10186
ReadX 10186 512 2048 2048
QUERY_FILE_INFORMATION 10186
QUERY_FILE_INFORMATION 10186
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10186 4096 512 512
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 10188
Close 10188
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 10190
WriteX 10190 4045 1 1
QUERY_FILE_INFORMATION 10190
WriteX 10190 0 53077 53077
Close 10190
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 10191
WriteX 10191 1535 1 1
QUERY_FILE_INFORMATION 10191
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10186 1536 512 512
ReadX 10186 288 1251 1251
ReadX 10186 2048 2018 2018
QUERY_FILE_INFORMATION 10191
WriteX 10191 0 65471 65471
WriteX 10191 65471 65 65
WriteX 10191 65536 1856 1856
WriteX 10191 0 4096 4096
Flush 10191
QUERY_FILE_INFORMATION 10186
QUERY_FILE_INFORMATION 10186
Close 10186
WriteX 10191 0 4096 4096
Close 10191
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x200000 0x1 10192
Close 10192
Rename \clients\client1\~dmtmp\EXCEL\51EC0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 10193
QUERY_FILE_INFORMATION 10193
ReadX 10193 0 512 512
ReadX 10193 512 512 512
ReadX 10193 1024 512 512
QUERY_FILE_INFORMATION 10193
QUERY_FILE_INFORMATION 10193
ReadX 10193 576 2048 2048
QUERY_FILE_INFORMATION 10193
QUERY_FILE_INFORMATION 10193
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 10195
Close 10195
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 10197
WriteX 10197 4076 1 1
QUERY_FILE_INFORMATION 10197
WriteX 10197 0 7983 7983
Close 10197
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 10199
Close 10199
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 10201
WriteX 10201 4095 1 1
QUERY_FILE_INFORMATION 10201
WriteX 10201 0 65471 65471
WriteX 10201 65471 65 65
WriteX 10201 65536 65471 65471
WriteX 10201 131007 65 65
WriteX 10201 131072 65471 65471
WriteX 10201 196543 65 65
WriteX 10201 196608 65471 65471
WriteX 10201 262079 65 65
WriteX 10201 262144 65471 65471
WriteX 10201 327615 65 65
WriteX 10201 327680 65471 65471
WriteX 10201 393151 65 65
WriteX 10201 393216 65471 65471
WriteX 10201 458687 65 65
WriteX 10201 458752 46731 46731
Close 10201
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 10202
WriteX 10202 1535 1 1
QUERY_FILE_INFORMATION 10202
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10193 1536 512 512
ReadX 10193 2048 2018 2018
ReadX 10193 4096 512 512
ReadX 10193 4608 2197 2197
QUERY_FILE_INFORMATION 10202
WriteX 10202 0 65471 65471
WriteX 10202 65471 65 65
WriteX 10202 65536 22848 22848
WriteX 10202 0 4096 4096
Flush 10202
QUERY_FILE_INFORMATION 10193
QUERY_FILE_INFORMATION 10193
Close 10193
WriteX 10202 0 4096 4096
Close 10202
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x200000 0x1 10203
Close 10203
Rename \clients\client1\~dmtmp\EXCEL\62AD0000 \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x1 10204
QUERY_FILE_INFORMATION 10204
ReadX 10204 0 512 512
ReadX 10204 512 512 512
ReadX 10204 1024 512 512
QUERY_FILE_INFORMATION 10204
QUERY_FILE_INFORMATION 10204
ReadX 10204 576 2048 2048
QUERY_FILE_INFORMATION 10204
QUERY_FILE_INFORMATION 10204
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10204 4096 512 512
Close 10204
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 10205
QUERY_FILE_INFORMATION 10205
ReadX 10205 0 512 512
ReadX 10205 512 512 512
ReadX 10205 1024 512 512
QUERY_FILE_INFORMATION 10205
QUERY_FILE_INFORMATION 10205
ReadX 10205 288 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FILE_INFORMATION 10205
QUERY_FILE_INFORMATION 10205
ReadX 10205 288 4096 4096
QUERY_FILE_INFORMATION 10205
QUERY_FILE_INFORMATION 10205
QUERY_FILE_INFORMATION 10205
WriteX 10205 288 4096 4096
WriteX 10205 1024 512 512
ReadX 10205 1536 512 512
QUERY_FILE_INFORMATION 10205
ReadX 10205 288 2048 2048
ReadX 10205 2336 2048 2048
ReadX 10205 3072 1536 1536
ReadX 10205 544 512 512
ReadX 10205 1056 2048 2048
ReadX 10205 3104 2048 2048
ReadX 10205 5152 2048 2048
ReadX 10205 7200 2048 2048
ReadX 10205 9248 2048 2048
ReadX 10205 11296 2048 2048
ReadX 10205 13344 2048 2048
ReadX 10205 15392 2048 2048
ReadX 10205 17440 2048 2048
ReadX 10205 19488 2048 2048
ReadX 10205 21536 2048 2048
ReadX 10205 23584 2048 2048
ReadX 10205 25632 2048 2048
ReadX 10205 27680 2048 2048
ReadX 10205 29728 2048 2048
ReadX 10205 31776 2048 2048
ReadX 10205 33824 2048 2048
ReadX 10205 35872 2048 2048
ReadX 10205 37920 2048 2048
ReadX 10205 39968 2048 2048
ReadX 10205 42016 512 512
ReadX 10205 42528 512 512
ReadX 10205 43040 1536 1536
ReadX 10205 44576 2048 2048
ReadX 10205 46624 2048 2048
ReadX 10205 48672 2048 2048
ReadX 10205 50720 2048 2048
ReadX 10205 52768 2048 2048
ReadX 10205 54816 2048 2048
ReadX 10205 56864 2048 2048
ReadX 10205 58912 2048 2048
ReadX 10205 60960 2048 2048
ReadX 10205 63008 2048 2048
ReadX 10205 65056 2048 2048
ReadX 10205 67104 2048 2048
ReadX 10205 69152 2048 2048
ReadX 10205 71200 2048 2048
ReadX 10205 73248 2048 2048
ReadX 10205 75296 2048 2048
ReadX 10205 77344 2048 2048
ReadX 10205 79392 2048 2048
ReadX 10205 81440 2048 2048
ReadX 10205 83488 2048 2048
ReadX 10205 85536 512 512
ReadX 10205 86048 512 512
ReadX 10205 86560 1536 1536
ReadX 10205 88096 2048 2048
ReadX 10205 90144 2048 2048
ReadX 10205 92192 2048 2048
ReadX 10205 94240 2048 2048
ReadX 10205 96288 2048 2048
ReadX 10205 552 2048 2048
ReadX 10205 2600 2048 2048
ReadX 10205 4648 2048 2048
ReadX 10205 6696 2048 2048
ReadX 10205 8744 2048 2048
ReadX 10205 10792 2048 2048
ReadX 10205 12840 2048 2048
ReadX 10205 14888 2048 2048
ReadX 10205 16936 2048 2048
ReadX 10205 18984 2048 2048
ReadX 10205 21032 2048 2048
ReadX 10205 23080 2048 2048
ReadX 10205 25128 2048 2048
ReadX 10205 27176 2048 2048
ReadX 10205 29224 2048 2048
ReadX 10205 31272 2048 2048
ReadX 10205 33320 2048 2048
ReadX 10205 35368 2048 2048
ReadX 10205 37416 2048 2048
ReadX 10205 39464 2048 2048
ReadX 10205 41512 512 512
ReadX 10205 42024 512 512
ReadX 10205 42536 1536 1536
ReadX 10205 44072 2048 2048
ReadX 10205 46120 2048 2048
ReadX 10205 48168 2048 2048
ReadX 10205 50216 2048 2048
ReadX 10205 52264 2048 2048
ReadX 10205 54312 2048 2048
ReadX 10205 56360 2048 2048
ReadX 10205 58408 2048 2048
ReadX 10205 60456 2048 2048
ReadX 10205 62504 2048 2048
ReadX 10205 64552 2048 2048
ReadX 10205 66600 2048 2048
ReadX 10205 68648 2048 2048
ReadX 10205 70696 2048 2048
ReadX 10205 72744 2048 2048
ReadX 10205 74792 2048 2048
ReadX 10205 76840 2048 2048
ReadX 10205 78888 2048 2048
ReadX 10205 80936 2048 2048
ReadX 10205 82984 2048 2048
ReadX 10205 85032 512 512
ReadX 10205 85544 2048 2048
ReadX 10205 87592 2048 2048
ReadX 10205 89640 2048 2048
ReadX 10205 91688 2048 2048
ReadX 10205 93736 2048 2048
ReadX 10205 95784 2048 2048
ReadX 10205 97832 2048 2048
ReadX 10205 99880 2048 2048
ReadX 10205 101928 2048 2048
ReadX 10205 103976 2048 2048
ReadX 10205 106024 2048 2048
ReadX 10205 108072 2048 2048
ReadX 10205 110120 2048 2048
ReadX 10205 112168 2048 2048
ReadX 10205 114216 2048 2048
ReadX 10205 116264 2048 2048
ReadX 10205 118312 2048 2048
ReadX 10205 120360 2048 2048
ReadX 10205 122408 2048 2048
ReadX 10205 124456 512 512
ReadX 10205 124968 512 512
ReadX 10205 125480 1536 1536
ReadX 10205 127016 2048 2048
ReadX 10205 129064 2048 2048
ReadX 10205 131112 2048 2048
ReadX 10205 133160 2048 2048
ReadX 10205 135208 2048 2048
ReadX 10205 137256 2048 2048
ReadX 10205 139304 2048 2048
ReadX 10205 141352 2048 2048
ReadX 10205 143400 2048 2048
ReadX 10205 145448 2048 2048
ReadX 10205 147496 2048 2048
ReadX 10205 149544 2048 2048
ReadX 10205 151592 2048 2048
ReadX 10205 153640 2048 2048
ReadX 10205 155688 2048 2048
ReadX 10205 157736 2048 2048
ReadX 10205 159784 2048 2048
ReadX 10205 161832 2048 2048
ReadX 10205 163880 2048 2048
ReadX 10205 165928 2048 2048
ReadX 10205 167976 2048 2048
ReadX 10205 170024 512 512
ReadX 10205 1538 1536 1536
ReadX 10205 3074 2048 2048
ReadX 10205 5122 2048 2048
ReadX 10205 7170 2048 2048
ReadX 10205 9218 2048 2048
ReadX 10205 11266 2048 2048
ReadX 10205 13314 2048 2048
ReadX 10205 15362 2048 2048
ReadX 10205 17410 2048 2048
ReadX 10205 19458 2048 2048
ReadX 10205 21506 2048 2048
ReadX 10205 23554 2048 2048
ReadX 10205 25602 2048 2048
ReadX 10205 27650 2048 2048
ReadX 10205 29698 2048 2048
ReadX 10205 31746 2048 2048
ReadX 10205 33794 2048 2048
ReadX 10205 35842 2048 2048
ReadX 10205 37890 2048 2048
ReadX 10205 39938 2048 2048
ReadX 10205 41986 2048 2048
ReadX 10205 44034 875 875
ReadX 10205 1730 4096 4096
ReadX 10205 1724 1536 1536
ReadX 10205 1746 588 588
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 10206
Close 10206
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 10207
WriteX 10207 2047 1 1
QUERY_FILE_INFORMATION 10207
Close 10205
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 10208
Close 10208
WriteX 10207 0 42388 42388
Close 10207
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 10209
Close 10209
Rename \clients\client1\~dmtmp\EXCEL\E0BD0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 10210
QUERY_FILE_INFORMATION 10210
ReadX 10210 0 512 512
ReadX 10210 1756 512 512
ReadX 10210 2268 512 512
QUERY_FILE_INFORMATION 10210
QUERY_FILE_INFORMATION 10210
ReadX 10210 1744 512 512
ReadX 10210 2256 512 512
ReadX 10210 2768 512 512
ReadX 10210 3280 512 512
ReadX 10210 3792 512 512
ReadX 10210 4304 512 512
ReadX 10210 512 2048 2048
QUERY_FILE_INFORMATION 10210
QUERY_FILE_INFORMATION 10210
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 10211
WriteX 10211 2047 1 1
QUERY_FILE_INFORMATION 10211
QUERY_FILE_INFORMATION 10210
QUERY_FILE_INFORMATION 10210
Close 10210
WriteX 10211 0 42652 42652
Close 10211
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x200000 0x1 10212
Close 10212
Rename \clients\client1\~dmtmp\EXCEL\BEED0000 \clients\client1\~dmtmp\EXCEL\SALES1.XLS
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x1 10213
QUERY_FILE_INFORMATION 10213
ReadX 10213 0 512 512
ReadX 10213 1762 512 512
ReadX 10213 2274 512 512
QUERY_FILE_INFORMATION 10213
QUERY_FILE_INFORMATION 10213
ReadX 10213 1750 512 512
ReadX 10213 2262 512 512
ReadX 10213 2774 512 512
ReadX 10213 3286 512 512
ReadX 10213 3798 512 512
ReadX 10213 4310 512 512
ReadX 10213 512 2048 2048
QUERY_FILE_INFORMATION 10213
QUERY_FILE_INFORMATION 10213
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 10215
Close 10215
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 10217
WriteX 10217 4080 1 1
QUERY_FILE_INFORMATION 10217
WriteX 10217 0 65471 65471
WriteX 10217 65471 65 65
WriteX 10217 65536 49 49
Close 10217
Close 10213
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10218
WriteX 10218 0 65471 65471
WriteX 10218 65471 63 63
WriteX 10218 65534 65471 65471
WriteX 10218 131005 63 63
Close 10218
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10219
WriteX 10219 0 65471 65471
WriteX 10219 65471 63 63
WriteX 10219 65534 65471 65471
WriteX 10219 131005 63 63
WriteX 10219 131068 65471 65471
WriteX 10219 196539 63 63
WriteX 10219 196602 65471 65471
WriteX 10219 262073 63 63
Close 10219
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10220
WriteX 10220 0 65471 65471
WriteX 10220 65471 63 63
WriteX 10220 65534 65471 65471
WriteX 10220 131005 63 63
WriteX 10220 131068 65471 65471
WriteX 10220 196539 63 63
WriteX 10220 196602 65471 65471
WriteX 10220 262073 63 63
WriteX 10220 262136 65471 65471
WriteX 10220 327607 63 63
WriteX 10220 327670 65471 65471
WriteX 10220 393141 63 63
WriteX 10220 393204 65471 65471
WriteX 10220 458675 63 63
WriteX 10220 458738 65471 65471
WriteX 10220 524209 63 63
Close 10220
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 10221
Close 10221
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC162.TMP 0x40 0x2 10222
Close 10222
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 10225
Close 10225
Unlink \clients\client1\~dmtmp\PM\PMC175.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC176.TMP 0x40 0x2 10227
Close 10227
Unlink \clients\client1\~dmtmp\PM\PMC176.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC180.TMP 0x40 0x2 10228
Close 10228
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 10231
Close 10231
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 10233
Close 10233
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 10234
Close 10234
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10237
Close 10237
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10241
Close 10241
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10245
Close 10245
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10249
Close 10249
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 10253
Close 10253
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 10257
Close 10257
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 10261
Close 10261
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 10265
Close 10265
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 10267
Close 10267
Unlink \clients\client1\~dmtmp\PM\PMC1A2.TMP
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 10269
Close 10269
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 10271
WriteX 10271 4095 1 1
QUERY_FILE_INFORMATION 10271
QUERY_FS_INFORMATION 259
WriteX 10271 0 65471 65471
WriteX 10271 65471 65 65
WriteX 10271 65536 65471 65471
WriteX 10271 131007 65 65
WriteX 10271 131072 65471 65471
WriteX 10271 196543 65 65
WriteX 10271 196608 65471 65471
WriteX 10271 262079 65 65
WriteX 10271 262144 26634 26634
Close 10271
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.X 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XL 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 10276
QUERY_FILE_INFORMATION 10276
QUERY_FILE_INFORMATION 10276
Close 10276
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 10277
Close 10277
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 10278
Close 10278
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 10279
QUERY_FILE_INFORMATION 10279
ReadX 10279 0 512 512
ReadX 10279 288 512 512
ReadX 10279 800 512 512
Close 10279
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 10280
ReadX 10280 0 24 24
Close 10280
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 10281
ReadX 10281 0 24 24
Close 10281
NTCreateX \clients\client1\~dmtmp\PM\T1.XLS 0x40 0x1 10282
QUERY_FILE_INFORMATION 10282
ReadX 10282 0 512 512
ReadX 10282 288 512 512
ReadX 10282 800 512 512
ReadX 10282 512 4096 4096
QUERY_FS_INFORMATION 259
ReadX 10282 1759 2849 2849
Close 10282
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 10283
Close 10283
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 10286
Close 10286
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 10288
Close 10288
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 10289
Close 10289
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 10292
Close 10292
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 10294
Close 10294
Unlink \clients\client1\~dmtmp\PM\PMD391.TMP
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10295
Close 10295
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10298
Close 10298
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10302
Close 10302
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10306
Close 10306
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10310
Close 10310
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 10314
Close 10314
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 10318
Close 10318
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 10321
Close 10321
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 10325
Close 10325
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 10329
Close 10329
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD395.TMP 0x40 0x2 10331
Close 10331
Unlink \clients\client1\~dmtmp\PM\PMD395.TMP
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMD3A4.TMP 0x40 0x2 10332
Close 10332
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 10341
QUERY_FILE_INFORMATION 10341
QUERY_FILE_INFORMATION 10341
Close 10341
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 10342
Close 10342
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 10343
Close 10343
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 10344
QUERY_FILE_INFORMATION 10344
ReadX 10344 0 512 512
ReadX 10344 288 512 512
ReadX 10344 800 512 512
Close 10344
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 10345
ReadX 10345 0 24 24
Close 10345
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 10346
QUERY_FILE_INFORMATION 10346
ReadX 10346 0 512 512
ReadX 10346 288 512 512
ReadX 10346 800 512 512
ReadX 10346 512 36 36
Close 10346
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\EVENTS.DOC 0x40 0x1 10347
QUERY_FILE_INFORMATION 10347
ReadX 10347 0 512 512
ReadX 10347 288 512 512
ReadX 10347 800 512 512
ReadX 10347 512 682 682
ReadX 10347 3584 106 106
ReadX 10347 3712 10 10
ReadX 10347 3722 10 10
ReadX 10347 512 2048 2048
ReadX 10347 3072 512 512
ReadX 10347 276 84 84
ReadX 10347 273 49 49
ReadX 10347 2560 512 512
Close 10347
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\M 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOV 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.D 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DO 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 10357
QUERY_FILE_INFORMATION 10357
QUERY_FILE_INFORMATION 10357
Close 10357
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 10358
Close 10358
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 10359
Close 10359
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 10360
QUERY_FILE_INFORMATION 10360
ReadX 10360 0 512 512
ReadX 10360 288 512 512
ReadX 10360 800 512 512
Close 10360
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 10361
ReadX 10361 0 24 24
Close 10361
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 10362
QUERY_FILE_INFORMATION 10362
ReadX 10362 0 512 512
ReadX 10362 288 512 512
ReadX 10362 800 512 512
ReadX 10362 512 36 36
Close 10362
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\MOVED.DOC 0x40 0x1 10363
QUERY_FILE_INFORMATION 10363
ReadX 10363 0 512 512
ReadX 10363 288 512 512
ReadX 10363 800 512 512
ReadX 10363 512 682 682
ReadX 10363 3072 106 106
ReadX 10363 3200 10 10
ReadX 10363 3210 10 10
ReadX 10363 512 2048 2048
ReadX 10363 2560 512 512
ReadX 10363 3887 84 84
ReadX 10363 3838 49 49
ReadX 10363 2048 512 512
Close 10363
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
Unlink \clients\client1\~dmtmp\PM\BDES1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 10364
Close 10364
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 10365
QUERY_FILE_INFORMATION 10365
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
QUERY_FILE_INFORMATION 10365
QUERY_FILE_INFORMATION 10365
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP 0x40 0x1 10366
QUERY_FILE_INFORMATION 10366
QUERY_FILE_INFORMATION 10366
QUERY_FILE_INFORMATION 10366
ReadX 10366 2156 24 24
ReadX 10366 2139 276 276
ReadX 10366 2136 14 14
ReadX 10366 2136 7 7
ReadX 10366 2138 12 12
ReadX 10366 2137 8 8
ReadX 10366 2135 15 15
ReadX 10366 0 16 16
ReadX 10366 16 2048 2048
ReadX 10366 2064 2048 2048
ReadX 10366 257 2048 2048
ReadX 10366 385 2048 2048
ReadX 10366 513 2048 2048
ReadX 10366 641 2048 2048
ReadX 10366 769 2048 2048
ReadX 10366 897 2048 2048
ReadX 10366 1025 2048 2048
ReadX 10366 1153 2048 2048
ReadX 10366 1281 2048 2048
ReadX 10366 1409 2048 2048
ReadX 10366 1537 408 408
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 10368
Close 10368
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 10370
WriteX 10370 15 1 1
QUERY_FILE_INFORMATION 10370
WriteX 10370 0 10575 10575
Flush 10370
Close 10370
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 10371
Close 10371
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 10372
QUERY_FILE_INFORMATION 10372
QUERY_FILE_INFORMATION 10372
QUERY_FILE_INFORMATION 10372
ReadX 10372 2157 24 24
ReadX 10372 2139 276 276
ReadX 10372 2137 14 14
ReadX 10372 2137 7 7
ReadX 10372 2139 12 12
ReadX 10372 2138 8 8
ReadX 10372 2136 15 15
Close 10366
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS.~TS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 10373
Close 10373
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 10374
QUERY_FILE_INFORMATION 10374
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 10375
QUERY_FILE_INFORMATION 10375
ReadX 10375 0 512 512
ReadX 10375 512 512 512
ReadX 10375 1024 512 512
QUERY_FILE_INFORMATION 10375
QUERY_FILE_INFORMATION 10375
Close 10375
QUERY_FILE_INFORMATION 10374
ReadX 10374 0 24 24
NTCreateX \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS 0x40 0x1 10376
QUERY_FILE_INFORMATION 10376
ReadX 10376 0 512 512
ReadX 10376 512 512 512
ReadX 10376 1024 512 512
ReadX 10376 288 20 20
ReadX 10376 308 2084 2084
ReadX 10376 388 2084 2084
ReadX 10376 388 2084 2084
ReadX 10365 2157 1386 1386
ReadX 10376 2472 399 399
ReadX 10376 3072 1536 1536
ReadX 10376 544 149 149
ReadX 10376 693 485 485
Close 10376
ReadX 10365 2157 4096 4096
ReadX 10365 6253 4096 4096
ReadX 10365 10349 4096 4096
ReadX 10365 14445 4096 4096
ReadX 10365 18541 4096 4096
ReadX 10365 22637 256 256
ReadX 10365 22893 4096 4096
ReadX 10365 26989 4096 4096
ReadX 10365 31085 4096 4096
ReadX 10365 35181 4096 4096
ReadX 10365 39277 4096 4096
ReadX 10365 43373 4096 4096
ReadX 10365 47469 4096 4096
QUERY_FS_INFORMATION 259
ReadX 10365 2157 1024 1024
ReadX 10365 1667 4688 4688
ReadX 10365 6355 3516 3516
ReadX 10365 9871 16384 16384
ReadX 10365 26255 3771 3771
ReadX 10365 30026 2048 2048
ReadX 10365 32074 1024 1024
ReadX 10365 33098 6652 6652
ReadX 10365 39750 16384 16384
ReadX 10365 56134 10496 10496
ReadX 10365 66630 1784 1784
ReadX 10365 68414 90 90
ReadX 10365 68504 273 273
ReadX 10365 68777 1600 1600
ReadX 10365 70377 640 640
ReadX 10365 71017 1280 1280
ReadX 10365 72297 8464 8464
ReadX 10365 80761 158 158
ReadX 10365 80919 912 912
ReadX 10365 81831 1980 1980
ReadX 10365 83811 2256 2256
ReadX 10365 86067 400 400
ReadX 10365 86467 252 252
ReadX 10365 86719 42 42
ReadX 10365 86761 725 725
ReadX 10365 2009 512 512
ReadX 10365 3895 9 9
ReadX 10365 3781 46 46
ReadX 10365 4059 92 92
ReadX 10365 3781 92 92
ReadX 10365 3986 184 184
ReadX 10365 3987 16384 16384
ReadX 10365 3902 16384 16384
ReadX 10365 3781 10240 10240
ReadX 10365 3821 16384 16384
ReadX 10365 3891 935 935
ReadX 10365 4060 10240 10240
ReadX 10365 4059 184 184
ReadX 10365 256 184 184
ReadX 10365 256 1026 1026
ReadX 10365 3901 326 326
ReadX 10365 3899 652 652
ReadX 10365 256 2 2
ReadX 10365 258 4948 4948
Close 10365
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 10378
Close 10378
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 10380
WriteX 10380 4055 1 1
QUERY_FILE_INFORMATION 10380
WriteX 10380 0 65471 65471
WriteX 10380 65471 65 65
WriteX 10380 65536 65471 65471
WriteX 10380 131007 65 65
WriteX 10380 131072 65471 65471
WriteX 10380 196543 65 65
WriteX 10380 196608 65471 65471
WriteX 10380 262079 65 65
WriteX 10380 262144 65471 65471
WriteX 10380 327615 65 65
WriteX 10380 327680 65471 65471
WriteX 10380 393151 65 65
WriteX 10380 393216 65471 65471
WriteX 10380 458687 65 65
WriteX 10380 458752 65471 65471
WriteX 10380 524223 65 65
WriteX 10380 524288 65471 65471
WriteX 10380 589759 65 65
WriteX 10380 589824 35257 35257
Close 10380
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 10382
Close 10382
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 10384
WriteX 10384 4055 1 1
QUERY_FILE_INFORMATION 10384
WriteX 10384 0 65471 65471
WriteX 10384 65471 65 65
WriteX 10384 65536 65471 65471
WriteX 10384 131007 65 65
WriteX 10384 131072 65471 65471
WriteX 10384 196543 65 65
WriteX 10384 196608 65471 65471
WriteX 10384 262079 65 65
WriteX 10384 262144 65471 65471
WriteX 10384 327615 65 65
WriteX 10384 327680 65471 65471
WriteX 10384 393151 65 65
WriteX 10384 393216 65471 65471
WriteX 10384 458687 65 65
WriteX 10384 458752 65471 65471
WriteX 10384 524223 65 65
WriteX 10384 524288 65471 65471
WriteX 10384 589759 65 65
WriteX 10384 589824 57598 57598
Close 10384
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 10386
WriteX 10386 15 1 1
QUERY_FILE_INFORMATION 10386
WriteX 10386 0 12543 12543
Flush 10386
Close 10386
Close 10372
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 10387
Close 10387
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 10388
QUERY_FILE_INFORMATION 10388
QUERY_FILE_INFORMATION 10388
QUERY_FILE_INFORMATION 10388
ReadX 10388 288 24 24
ReadX 10388 287 276 276
ReadX 10388 286 14 14
ReadX 10388 286 7 7
ReadX 10388 287 12 12
ReadX 10388 287 8 8
ReadX 10388 286 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 10389
Close 10389
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 10390
QUERY_FILE_INFORMATION 10390
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
QUERY_FILE_INFORMATION 10390
QUERY_FILE_INFORMATION 10390
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP 0x40 0x1 10391
QUERY_FILE_INFORMATION 10391
QUERY_FILE_INFORMATION 10391
QUERY_FILE_INFORMATION 10391
ReadX 10391 1938 24 24
ReadX 10391 1920 276 276
ReadX 10391 1918 14 14
ReadX 10391 1918 7 7
ReadX 10391 1919 12 12
ReadX 10391 1919 8 8
ReadX 10391 1917 15 15
ReadX 10391 0 16 16
ReadX 10391 16 2048 2048
ReadX 10391 2064 2048 2048
ReadX 10391 257 2048 2048
ReadX 10391 385 2048 2048
ReadX 10391 513 2048 2048
ReadX 10391 641 2048 2048
ReadX 10391 769 2048 2048
ReadX 10391 897 2048 2048
ReadX 10391 1025 2048 2048
ReadX 10391 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 10393
Close 10393
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 10395
WriteX 10395 15 1 1
QUERY_FILE_INFORMATION 10395
WriteX 10395 0 11588 11588
Flush 10395
Close 10395
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 10396
Close 10396
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 10397
QUERY_FILE_INFORMATION 10397
QUERY_FILE_INFORMATION 10397
QUERY_FILE_INFORMATION 10397
ReadX 10397 1909 24 24
ReadX 10397 1892 276 276
ReadX 10397 1889 14 14
ReadX 10397 1889 7 7
ReadX 10397 1891 12 12
ReadX 10397 1890 8 8
ReadX 10397 1888 15 15
Close 10391
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1.~TS
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 10399
WriteX 10399 15 1 1
QUERY_FILE_INFORMATION 10399
WriteX 10399 0 11615 11615
Flush 10399
Close 10399
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 10397
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 10400
Close 10400
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 10401
QUERY_FILE_INFORMATION 10401
QUERY_FILE_INFORMATION 10401
QUERY_FILE_INFORMATION 10401
ReadX 10401 1947 24 24
ReadX 10401 1929 276 276
ReadX 10401 1927 14 14
ReadX 10401 1927 7 7
ReadX 10401 1929 12 12
ReadX 10401 1928 8 8
ReadX 10401 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 10403
Close 10403
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 10405
WriteX 10405 4088 1 1
QUERY_FILE_INFORMATION 10405
WriteX 10405 0 65471 65471
WriteX 10405 65471 65 65
WriteX 10405 65536 16050 16050
Close 10405
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10390 1939 64 64
ReadX 10390 128 248 248
ReadX 10390 128 568 568
ReadX 10390 3872 1536 1536
ReadX 10390 3456 2560 2560
ReadX 10390 3136 512 512
ReadX 10390 2880 4096 4096
ReadX 10390 3264 3072 3072
ReadX 10390 320 4096 4096
ReadX 10390 1024 4096 4096
ReadX 10390 3616 4096 4096
ReadX 10390 1939 64 64
ReadX 10390 128 248 248
ReadX 10390 128 608 608
ReadX 10390 2858 1024 1024
ReadX 10390 2810 4096 4096
ReadX 10390 2826 4096 4096
ReadX 10390 2580 2048 2048
ReadX 10390 2800 2560 2560
ReadX 10390 2100 4096 4096
ReadX 10390 2084 4096 4096
ReadX 10390 868 4096 4096
ReadX 10390 2324 4096 4096
ReadX 10390 884 4096 4096
ReadX 10390 2604 1024 1024
ReadX 10390 580 4096 4096
ReadX 10390 596 4096 4096
ReadX 10390 2752 4096 4096
ReadX 10390 2842 1024 1024
ReadX 10390 660 4096 4096
ReadX 10390 2720 4096 4096
ReadX 10390 2736 4096 4096
ReadX 10390 628 4096 4096
ReadX 10390 2704 4096 4096
ReadX 10390 1556 4096 4096
ReadX 10390 576 4096 4096
ReadX 10390 3168 1536 1536
ReadX 10390 832 4096 4096
ReadX 10390 1088 4096 4096
ReadX 10390 1344 4096 4096
ReadX 10390 1600 4096 4096
ReadX 10390 1856 4096 4096
ReadX 10390 2112 4096 4096
ReadX 10390 1892 4096 4096
ReadX 10390 820 4096 4096
ReadX 10390 788 4096 4096
ReadX 10390 1604 4096 4096
ReadX 10390 3648 4096 4096
ReadX 10390 2608 4096 4096
ReadX 10390 548 4096 4096
ReadX 10390 740 4096 4096
ReadX 10390 1344 4096 4096
ReadX 10390 3392 4096 4096
ReadX 10390 3904 4096 4096
ReadX 10390 644 4096 4096
ReadX 10390 676 4096 4096
ReadX 10390 2688 4096 4096
ReadX 10390 320 4096 4096
ReadX 10390 900 4096 4096
ReadX 10390 1908 4096 4096
ReadX 10390 852 4096 4096
ReadX 10390 724 4096 4096
ReadX 10390 2292 4096 4096
ReadX 10390 612 4096 4096
ReadX 10390 388 4096 4096
ReadX 10390 2368 4096 4096
ReadX 10390 2624 4096 4096
ReadX 10390 500 4096 4096
ReadX 10390 356 4096 4096
ReadX 10390 1024 4096 4096
ReadX 10390 576 4096 4096
ReadX 10390 340 4096 4096
ReadX 10390 420 4096 4096
ReadX 10390 1600 4096 4096
ReadX 10390 404 4096 4096
ReadX 10390 1428 4096 4096
ReadX 10390 2656 4096 4096
ReadX 10390 2624 4096 4096
ReadX 10390 452 4096 4096
ReadX 10390 692 4096 4096
ReadX 10390 564 4096 4096
ReadX 10390 372 4096 4096
ReadX 10390 468 4096 4096
ReadX 10390 484 4096 4096
ReadX 10390 1088 4096 4096
ReadX 10390 1924 4096 4096
ReadX 10390 2768 4096 4096
ReadX 10390 832 4096 4096
ReadX 10390 836 4096 4096
ReadX 10390 1856 4096 4096
ReadX 10390 2640 4096 4096
ReadX 10390 436 4096 4096
ReadX 10390 1828 4096 4096
ReadX 10390 804 4096 4096
ReadX 10390 1860 4096 4096
ReadX 10390 1812 4096 4096
ReadX 10390 756 4096 4096
ReadX 10390 1636 4096 4096
ReadX 10390 772 4096 4096
ReadX 10390 2036 4096 4096
ReadX 10390 1220 4096 4096
ReadX 10390 1652 4096 4096
ReadX 10390 2588 4096 4096
ReadX 10390 916 4096 4096
ReadX 10390 260 4096 4096
ReadX 10390 932 4096 4096
ReadX 10390 2624 4096 4096
ReadX 10390 308 4096 4096
ReadX 10390 292 4096 4096
ReadX 10390 1140 4096 4096
ReadX 10390 276 4096 4096
ReadX 10390 2020 4096 4096
ReadX 10390 2880 4096 4096
ReadX 10390 516 4096 4096
ReadX 10390 1844 4096 4096
ReadX 10390 1124 4096 4096
ReadX 10390 3136 4096 4096
ReadX 10390 324 4096 4096
ReadX 10390 1156 4096 4096
ReadX 10390 1172 4096 4096
ReadX 10390 2112 4096 4096
ReadX 10390 2368 4096 4096
ReadX 10390 964 4096 4096
ReadX 10390 980 4096 4096
ReadX 10390 1012 4096 4096
ReadX 10390 532 4096 4096
ReadX 10390 1876 4096 4096
QUERY_FS_INFORMATION 259
ReadX 10390 1620 4096 4096
ReadX 10390 1604 4096 4096
ReadX 10390 2116 4096 4096
ReadX 10390 2132 4096 4096
ReadX 10390 2148 4096 4096
ReadX 10390 2276 4096 4096
ReadX 10390 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 10407
Close 10407
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 10409
QUERY_FILE_INFORMATION 10374
WriteX 10409 4088 1 1
QUERY_FILE_INFORMATION 10409
QUERY_FILE_INFORMATION 10374
Close 10374
WriteX 10409 0 65471 65471
WriteX 10409 65471 65 65
WriteX 10409 65536 64850 64850
Close 10409
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 10411
WriteX 10411 15 1 1
QUERY_FILE_INFORMATION 10411
ReadX 10390 2068 4096 4096
ReadX 10390 1588 4096 4096
ReadX 10390 1572 4096 4096
WriteX 10411 0 18630 18630
Flush 10411
Close 10411
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Close 10401
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 10412
Close 10412
Rename \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 10413
QUERY_FILE_INFORMATION 10413
QUERY_FILE_INFORMATION 10413
QUERY_FILE_INFORMATION 10413
ReadX 10413 661 24 24
ReadX 10413 659 356 356
ReadX 10413 659 14 14
ReadX 10413 659 7 7
ReadX 10413 659 12 12
ReadX 10413 659 8 8
ReadX 10413 659 15 15
ReadX 10413 659 16 16
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
ReadX 10390 612 4096 4096
ReadX 10390 564 4096 4096
ReadX 10390 1876 4096 4096
ReadX 10390 628 4096 4096
ReadX 10390 740 4096 4096
ReadX 10390 724 4096 4096
ReadX 10390 644 4096 4096
ReadX 10390 2324 4096 4096
ReadX 10390 660 4096 4096
ReadX 10390 852 4096 4096
ReadX 10390 868 4096 4096
Close 10413
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.~TS
Close 10388
ReadX 10390 2368 4096 4096
ReadX 10390 1024 4096 4096
ReadX 10390 320 4096 4096
ReadX 10390 580 4096 4096
ReadX 10390 3136 512 512
ReadX 10390 2880 4096 4096
Close 10390
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10414
WriteX 10414 0 65471 65471
WriteX 10414 65471 63 63
WriteX 10414 65534 65471 65471
WriteX 10414 131005 63 63
Close 10414
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10415
WriteX 10415 0 65471 65471
WriteX 10415 65471 63 63
WriteX 10415 65534 65471 65471
WriteX 10415 131005 63 63
WriteX 10415 131068 65471 65471
WriteX 10415 196539 63 63
WriteX 10415 196602 65471 65471
WriteX 10415 262073 63 63
Close 10415
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10416
WriteX 10416 0 65471 65471
WriteX 10416 65471 63 63
WriteX 10416 65534 65471 65471
WriteX 10416 131005 63 63
WriteX 10416 131068 65471 65471
WriteX 10416 196539 63 63
WriteX 10416 196602 65471 65471
WriteX 10416 262073 63 63
WriteX 10416 262136 65471 65471
WriteX 10416 327607 63 63
WriteX 10416 327670 65471 65471
WriteX 10416 393141 63 63
WriteX 10416 393204 65471 65471
WriteX 10416 458675 63 63
WriteX 10416 458738 65471 65471
WriteX 10416 524209 63 63
Close 10416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10417
Close 10417
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10418
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10418 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10419
ReadX 10419 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10420
ReadX 10420 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10421
ReadX 10421 0 511 511
ReadX 10418 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 10418
Close 10419
Close 10420
Close 10421
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10422
ReadX 10422 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10423
ReadX 10423 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10424
ReadX 10424 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10425
ReadX 10425 0 511 511
ReadX 10422 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 10426
FIND_FIRST \clients\client1\~dmtmp\*
Close 10426
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x1 10427
QUERY_FILE_INFORMATION 10427
WriteX 10427 2047 1 1
QUERY_FILE_INFORMATION 10427
WriteX 10427 0 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x2 10428
Close 10428
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 10429
WriteX 10429 52 1 1
QUERY_FILE_INFORMATION 10429
WriteX 10429 0 53 53
WriteX 10429 53 28 28
WriteX 10429 81 4 4
WriteX 10429 85 28 28
WriteX 10429 113 38 38
WriteX 10429 151 28 28
WriteX 10429 179 2 2
WriteX 10429 181 28 28
WriteX 10429 209 3 3
WriteX 10429 212 279 279
WriteX 10429 9 4 4
Close 10429
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.VAL 0x40 0x1 10430
ReadX 10430 0 53 53
ReadX 10430 53 28 28
ReadX 10430 81 4 4
ReadX 10430 85 28 28
ReadX 10430 113 38 38
ReadX 10430 151 28 28
ReadX 10430 179 2 2
ReadX 10430 181 28 28
ReadX 10430 209 3 3
Close 10430
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Close 10422
Close 10423
Close 10424
Close 10425
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10431
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10431 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10432
ReadX 10432 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10433
ReadX 10433 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10434
ReadX 10434 0 511 511
ReadX 10431 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x2 10436
Close 10436
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10437
WriteX 10437 52 1 1
QUERY_FILE_INFORMATION 10437
WriteX 10437 0 53 53
WriteX 10437 53 28 28
WriteX 10437 81 28 28
WriteX 10437 109 28 28
WriteX 10437 137 28 28
WriteX 10437 165 28 28
WriteX 10437 193 28 28
WriteX 10437 221 28 28
WriteX 10437 249 4 4
WriteX 10437 253 4 4
WriteX 10437 257 4 4
WriteX 10437 261 28 28
WriteX 10437 289 2 2
WriteX 10437 291 2 2
WriteX 10437 293 2 2
WriteX 10437 295 248 248
WriteX 10437 9 4 4
Close 10437
Close 10431
Close 10432
Close 10433
Close 10434
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10438
ReadX 10438 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10439
ReadX 10439 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10440
ReadX 10440 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10441
ReadX 10441 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10442
ReadX 10442 0 53 53
ReadX 10442 53 28 28
ReadX 10442 81 28 28
ReadX 10442 109 28 28
ReadX 10442 137 28 28
ReadX 10442 165 28 28
ReadX 10442 193 28 28
ReadX 10442 221 28 28
ReadX 10442 249 4 4
ReadX 10442 253 4 4
ReadX 10442 257 4 4
ReadX 10442 261 28 28
ReadX 10442 289 2 2
ReadX 10442 291 2 2
ReadX 10442 293 2 2
Close 10442
ReadX 10438 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 10438
Close 10439
Close 10440
Close 10441
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.VAL
Unlink \clients\client1\~dmtmp\PARADOX\__S31.VAL
Close 10427
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10443
Close 10443
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10444
ReadX 10444 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10445
ReadX 10445 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10446
ReadX 10446 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10447
ReadX 10447 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10448
ReadX 10448 0 53 53
ReadX 10448 53 28 28
ReadX 10448 81 28 28
ReadX 10448 109 28 28
ReadX 10448 137 28 28
ReadX 10448 165 28 28
ReadX 10448 193 28 28
ReadX 10448 221 28 28
ReadX 10448 249 4 4
ReadX 10448 253 4 4
ReadX 10448 257 4 4
ReadX 10448 261 28 28
ReadX 10448 289 2 2
ReadX 10448 291 2 2
ReadX 10448 293 2 2
Close 10448
ReadX 10444 2048 2048 2048
Close 10444
Close 10445
Close 10446
Close 10447
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10449
ReadX 10449 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10450
ReadX 10450 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10451
ReadX 10451 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10452
ReadX 10452 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10453
ReadX 10453 0 53 53
ReadX 10453 53 28 28
ReadX 10453 81 28 28
ReadX 10453 109 28 28
ReadX 10453 137 28 28
ReadX 10453 165 28 28
ReadX 10453 193 28 28
ReadX 10453 221 28 28
ReadX 10453 249 4 4
ReadX 10453 253 4 4
ReadX 10453 257 4 4
ReadX 10453 261 28 28
ReadX 10453 289 2 2
ReadX 10453 291 2 2
ReadX 10453 293 2 2
Close 10453
ReadX 10449 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x2 10457
FIND_FIRST \clients\client1\~dmtmp\*
Close 10457
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 10458
QUERY_FILE_INFORMATION 10458
WriteX 10458 2047 1 1
QUERY_FILE_INFORMATION 10458
WriteX 10458 0 2048 2048
Close 10458
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 10459
ReadX 10459 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Close 10459
Close 10449
Close 10450
Close 10451
Close 10452
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 10460
ReadX 10460 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
WriteX 10460 4095 1 1
QUERY_FILE_INFORMATION 10460
WriteX 10460 2048 2048 2048
QUERY_FILE_INFORMATION 10460
Flush 10460
WriteX 10460 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10461
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10461 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10462
ReadX 10462 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10463
ReadX 10463 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10464
ReadX 10464 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10465
ReadX 10465 0 53 53
ReadX 10465 53 28 28
ReadX 10465 81 28 28
ReadX 10465 109 28 28
ReadX 10465 137 28 28
ReadX 10465 165 28 28
ReadX 10465 193 28 28
ReadX 10465 221 28 28
ReadX 10465 249 4 4
ReadX 10465 253 4 4
ReadX 10465 257 4 4
ReadX 10465 261 28 28
ReadX 10465 289 2 2
ReadX 10465 291 2 2
ReadX 10465 293 2 2
Close 10465
ReadX 10461 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x2 10469
FIND_FIRST \clients\client1\~dmtmp\*
Close 10469
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 10470
QUERY_FILE_INFORMATION 10470
WriteX 10470 2047 1 1
QUERY_FILE_INFORMATION 10470
WriteX 10470 0 2048 2048
Close 10470
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 10471
ReadX 10471 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x2 10475
Close 10475
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 10476
QUERY_FILE_INFORMATION 10476
WriteX 10476 2047 1 1
QUERY_FILE_INFORMATION 10476
WriteX 10476 0 2048 2048
Close 10476
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 10477
ReadX 10477 0 511 511
ReadX 10461 384 2048 2048
ReadX 10461 768 16384 16384
ReadX 10461 1792 14336 14336
Close 10477
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 10478
ReadX 10478 0 511 511
Close 10478
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB 0x40 0x1 10480
Close 10480
Unlink \clients\client1\~dmtmp\PARADOX\ERRORCHG.DB
WriteX 10471 4095 1 1
QUERY_FILE_INFORMATION 10471
WriteX 10471 2048 2048 2048
WriteX 10471 0 88 88
Close 10471
WriteX 10461 1152 2048 2048
WriteX 10461 1408 6144 6144
WriteX 10461 1920 2048 2048
WriteX 10461 0 88 88
Close 10461
WriteX 10462 0 88 88
Close 10462
WriteX 10463 0 88 88
Close 10463
Close 10464
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 10481
ReadX 10481 0 511 511
ReadX 10481 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 10481
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10482
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10482 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10483
ReadX 10483 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10484
ReadX 10484 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10485
ReadX 10485 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10486
ReadX 10486 0 53 53
ReadX 10486 53 28 28
ReadX 10486 81 28 28
ReadX 10486 109 28 28
ReadX 10486 137 28 28
ReadX 10486 165 28 28
ReadX 10486 193 28 28
ReadX 10486 221 28 28
ReadX 10486 249 4 4
ReadX 10486 253 4 4
ReadX 10486 257 4 4
ReadX 10486 261 28 28
ReadX 10486 289 2 2
ReadX 10486 291 2 2
ReadX 10486 293 2 2
Close 10486
ReadX 10482 2048 2048 2048
Close 10482
Close 10483
Close 10484
Close 10485
Close 10460
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 10487
QUERY_FILE_INFORMATION 10487
Close 10487
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10488
Close 10488
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10489
ReadX 10489 0 511 511
ReadX 10489 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10490
ReadX 10490 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10491
ReadX 10491 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10492
ReadX 10492 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10493
ReadX 10493 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10494
ReadX 10494 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10495
ReadX 10495 0 53 53
ReadX 10495 53 2 2
ReadX 10495 55 2 2
ReadX 10495 57 184 184
ReadX 10495 241 298 298
Close 10495
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10496
ReadX 10496 0 41 41
ReadX 10489 2048 2048 2048
Close 10496
Close 10489
Close 10490
Close 10493
Close 10494
Close 10491
Close 10492
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10497
ReadX 10497 0 511 511
ReadX 10497 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10498
ReadX 10498 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10499
ReadX 10499 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10500
ReadX 10500 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10501
ReadX 10501 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10502
ReadX 10502 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10503
ReadX 10503 0 53 53
ReadX 10503 53 2 2
ReadX 10503 55 2 2
ReadX 10503 57 184 184
ReadX 10503 241 298 298
Close 10503
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10504
ReadX 10504 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10505
ReadX 10505 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10506
ReadX 10506 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10507
ReadX 10507 0 511 511
ReadX 10506 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10508
ReadX 10508 0 53 53
ReadX 10508 53 2 2
ReadX 10508 55 480 480
ReadX 10508 535 2 2
Close 10508
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10509
ReadX 10509 0 41 41
ReadX 10497 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x2 10513
FIND_FIRST \clients\client1\~dmtmp\*
Close 10513
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 10514
QUERY_FILE_INFORMATION 10514
WriteX 10514 2047 1 1
QUERY_FILE_INFORMATION 10514
WriteX 10514 0 2048 2048
Close 10514
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 10515
ReadX 10515 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 10515
Close 10504
Close 10505
Close 10506
Close 10507
Close 10509
Close 10497
Close 10498
Close 10501
Close 10502
Close 10499
Close 10500
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 10516
ReadX 10516 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10517
Close 10517
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10518
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10518 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10519
ReadX 10519 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10520
ReadX 10520 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10521
ReadX 10521 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10522
ReadX 10522 0 53 53
ReadX 10522 53 2 2
ReadX 10522 55 480 480
ReadX 10522 535 2 2
Close 10522
ReadX 10518 2048 2048 2048
Close 10518
Close 10519
Close 10520
Close 10521
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10523
ReadX 10523 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10524
ReadX 10524 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10525
ReadX 10525 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10526
ReadX 10526 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10527
ReadX 10527 0 53 53
ReadX 10527 53 2 2
ReadX 10527 55 480 480
ReadX 10527 535 2 2
Close 10527
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10528
ReadX 10528 0 511 511
ReadX 10528 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10529
ReadX 10529 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10530
ReadX 10530 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10531
ReadX 10531 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10532
ReadX 10532 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10533
ReadX 10533 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10534
ReadX 10534 0 41 41
ReadX 10528 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10535
ReadX 10535 0 53 53
ReadX 10535 53 2 2
ReadX 10535 55 2 2
ReadX 10535 57 184 184
ReadX 10535 241 298 298
Close 10535
ReadX 10523 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x2 10539
FIND_FIRST \clients\client1\~dmtmp\*
Close 10539
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 10540
QUERY_FILE_INFORMATION 10540
WriteX 10540 2047 1 1
QUERY_FILE_INFORMATION 10540
WriteX 10540 0 2048 2048
Close 10540
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 10541
ReadX 10541 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Close 10541
Close 10534
Close 10528
Close 10529
Close 10532
Close 10533
Close 10530
Close 10531
Close 10523
Close 10524
Close 10525
Close 10526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 10542
ReadX 10542 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
WriteX 10516 4095 1 1
QUERY_FILE_INFORMATION 10516
WriteX 10516 2048 2048 2048
QUERY_FILE_INFORMATION 10516
Flush 10516
WriteX 10516 0 88 88
WriteX 10542 4095 1 1
QUERY_FILE_INFORMATION 10542
WriteX 10542 2048 2048 2048
QUERY_FILE_INFORMATION 10542
Flush 10542
WriteX 10542 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10543
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10543 0 511 511
ReadX 10543 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10544
ReadX 10544 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10545
ReadX 10545 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10546
ReadX 10546 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10547
ReadX 10547 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10548
ReadX 10548 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10549
ReadX 10549 0 53 53
ReadX 10549 53 2 2
ReadX 10549 55 2 2
ReadX 10549 57 184 184
ReadX 10549 241 298 298
Close 10549
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10550
ReadX 10550 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10551
ReadX 10551 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10552
ReadX 10552 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10553
ReadX 10553 0 511 511
ReadX 10552 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10554
ReadX 10554 0 53 53
ReadX 10554 53 2 2
ReadX 10554 55 480 480
ReadX 10554 535 2 2
Close 10554
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10555
ReadX 10555 0 41 41
ReadX 10543 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10556
ReadX 10556 0 53 53
ReadX 10556 53 2 2
ReadX 10556 55 480 480
ReadX 10556 535 2 2
Close 10556
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10557
ReadX 10557 0 53 53
ReadX 10557 53 2 2
ReadX 10557 55 2 2
ReadX 10557 57 184 184
ReadX 10557 241 298 298
Close 10557
ReadX 10550 2048 2048 2048
ReadX 10551 2048 2048 2048
ReadX 10550 320 16384 16384
ReadX 10550 384 16384 16384
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x2 10558
FIND_FIRST \clients\client1\~dmtmp\*
Close 10558
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 10559
QUERY_FILE_INFORMATION 10559
WriteX 10559 4095 1 1
QUERY_FILE_INFORMATION 10559
WriteX 10559 0 4096 4096
Close 10559
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.MB 0x40 0x1 10560
ReadX 10560 0 41 41
Close 10550
Close 10551
Close 10552
Close 10553
Close 10555
Close 10543
Close 10544
Close 10547
Close 10548
Close 10545
Close 10546
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x2 10561
Close 10561
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 10562
QUERY_FILE_INFORMATION 10562
WriteX 10562 4095 1 1
QUERY_FILE_INFORMATION 10562
WriteX 10562 0 4096 4096
Close 10562
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 10563
ReadX 10563 0 41 41
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB4.FAM 0x40 0x1 -1
QUERY_FILE_INFORMATION 10560
ReadX 10560 0 4096 4096
WriteX 10563 0 4096 4096
Close 10563
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x40 0x1 10565
ReadX 10565 0 41 41
Close 10560
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB4.MB
Unlink \clients\client1\~dmtmp\PARADOX\__QB4.MB
Close 10565
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__QB5.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\__QB5.MB 0x200000 0x1 10566
Close 10566
Rename \clients\client1\~dmtmp\PARADOX\__QB5.MB \clients\client1\~dmtmp\PARADOX\ANSWER.MB
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 10567
ReadX 10567 0 41 41
Close 10567
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x2 10568
Close 10568
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10569
QUERY_FILE_INFORMATION 10569
WriteX 10569 2047 1 1
QUERY_FILE_INFORMATION 10569
WriteX 10569 0 2048 2048
Close 10569
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10570
ReadX 10570 0 511 511
ReadX 10570 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 10571
ReadX 10571 0 41 41
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 10571
Close 10570
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10572
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10572 0 511 511
ReadX 10572 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10573
ReadX 10573 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10574
ReadX 10574 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10575
ReadX 10575 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10576
ReadX 10576 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10577
ReadX 10577 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10578
ReadX 10578 0 53 53
ReadX 10578 53 2 2
ReadX 10578 55 2 2
ReadX 10578 57 184 184
ReadX 10578 241 298 298
Close 10578
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10579
ReadX 10579 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10580
ReadX 10580 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10581
ReadX 10581 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10582
ReadX 10582 0 511 511
ReadX 10581 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10583
ReadX 10583 0 53 53
ReadX 10583 53 2 2
ReadX 10583 55 480 480
ReadX 10583 535 2 2
Close 10583
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10584
ReadX 10584 0 41 41
ReadX 10572 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10585
ReadX 10585 0 53 53
ReadX 10585 53 2 2
ReadX 10585 55 480 480
ReadX 10585 535 2 2
Close 10585
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10586
ReadX 10586 0 53 53
ReadX 10586 53 2 2
ReadX 10586 55 2 2
ReadX 10586 57 184 184
ReadX 10586 241 298 298
Close 10586
ReadX 10579 2048 2048 2048
Close 10579
Close 10580
Close 10581
Close 10582
Close 10584
Close 10572
Close 10573
Close 10576
Close 10577
Close 10574
Close 10575
Close 10516
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 10587
QUERY_FILE_INFORMATION 10587
Close 10587
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__40D6B.DB
Close 10542
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 10588
QUERY_FILE_INFORMATION 10588
Close 10588
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10589
Close 10589
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10590
ReadX 10590 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10591
ReadX 10591 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10592
ReadX 10592 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10593
ReadX 10593 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10594
ReadX 10594 0 53 53
ReadX 10594 53 2 2
ReadX 10594 55 480 480
ReadX 10594 535 2 2
Close 10594
ReadX 10590 2048 2048 2048
Close 10590
Close 10591
Close 10592
Close 10593
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10595
ReadX 10595 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10596
ReadX 10596 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10597
ReadX 10597 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10598
ReadX 10598 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10599
ReadX 10599 0 53 53
ReadX 10599 53 2 2
ReadX 10599 55 480 480
ReadX 10599 535 2 2
Close 10599
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10600
ReadX 10600 0 511 511
ReadX 10600 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10601
ReadX 10601 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10602
ReadX 10602 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10603
ReadX 10603 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10604
ReadX 10604 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10605
ReadX 10605 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10606
ReadX 10606 0 41 41
ReadX 10600 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10607
ReadX 10607 0 53 53
ReadX 10607 53 2 2
ReadX 10607 55 2 2
ReadX 10607 57 184 184
ReadX 10607 241 298 298
Close 10607
ReadX 10595 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x2 10611
FIND_FIRST \clients\client1\~dmtmp\*
Close 10611
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 10612
QUERY_FILE_INFORMATION 10612
WriteX 10612 2047 1 1
QUERY_FILE_INFORMATION 10612
WriteX 10612 0 2048 2048
Close 10612
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 10613
ReadX 10613 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 10613
Close 10606
Close 10600
Close 10601
Close 10604
Close 10605
Close 10602
Close 10603
Close 10595
Close 10596
Close 10597
Close 10598
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 10614
ReadX 10614 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10615
Close 10615
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10616
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10616 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10617
ReadX 10617 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10618
ReadX 10618 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10619
ReadX 10619 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10620
ReadX 10620 0 53 53
ReadX 10620 53 28 28
ReadX 10620 81 28 28
ReadX 10620 109 28 28
ReadX 10620 137 28 28
ReadX 10620 165 28 28
ReadX 10620 193 28 28
ReadX 10620 221 28 28
ReadX 10620 249 4 4
ReadX 10620 253 4 4
ReadX 10620 257 4 4
ReadX 10620 261 28 28
ReadX 10620 289 2 2
ReadX 10620 291 2 2
ReadX 10620 293 2 2
Close 10620
ReadX 10616 2048 2048 2048
Close 10616
Close 10617
Close 10618
Close 10619
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10621
ReadX 10621 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10622
ReadX 10622 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10623
ReadX 10623 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10624
ReadX 10624 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10625
ReadX 10625 0 53 53
ReadX 10625 53 28 28
ReadX 10625 81 28 28
ReadX 10625 109 28 28
ReadX 10625 137 28 28
ReadX 10625 165 28 28
ReadX 10625 193 28 28
ReadX 10625 221 28 28
ReadX 10625 249 4 4
ReadX 10625 253 4 4
ReadX 10625 257 4 4
ReadX 10625 261 28 28
ReadX 10625 289 2 2
ReadX 10625 291 2 2
ReadX 10625 293 2 2
Close 10625
ReadX 10621 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x2 10629
FIND_FIRST \clients\client1\~dmtmp\*
Close 10629
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 10630
QUERY_FILE_INFORMATION 10630
WriteX 10630 2047 1 1
QUERY_FILE_INFORMATION 10630
WriteX 10630 0 2048 2048
Close 10630
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 10631
ReadX 10631 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 10631
Close 10621
Close 10622
Close 10623
Close 10624
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 10632
ReadX 10632 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10633
Close 10633
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10634
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10634 0 511 511
ReadX 10634 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10635
ReadX 10635 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10636
ReadX 10636 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10637
ReadX 10637 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10638
ReadX 10638 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10639
ReadX 10639 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10640
ReadX 10640 0 53 53
ReadX 10640 53 2 2
ReadX 10640 55 2 2
ReadX 10640 57 184 184
ReadX 10640 241 298 298
Close 10640
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10641
ReadX 10641 0 41 41
ReadX 10634 2048 2048 2048
Close 10641
Close 10634
Close 10635
Close 10638
Close 10639
Close 10636
Close 10637
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10642
ReadX 10642 0 511 511
ReadX 10642 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10643
ReadX 10643 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10644
ReadX 10644 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10645
ReadX 10645 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10646
ReadX 10646 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10647
ReadX 10647 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10648
ReadX 10648 0 53 53
ReadX 10648 53 2 2
ReadX 10648 55 2 2
ReadX 10648 57 184 184
ReadX 10648 241 298 298
Close 10648
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10649
ReadX 10649 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10650
ReadX 10650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10651
ReadX 10651 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10652
ReadX 10652 0 511 511
ReadX 10651 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10653
ReadX 10653 0 53 53
ReadX 10653 53 2 2
ReadX 10653 55 480 480
ReadX 10653 535 2 2
Close 10653
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10654
ReadX 10654 0 41 41
ReadX 10642 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x2 10658
FIND_FIRST \clients\client1\~dmtmp\*
Close 10658
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 10659
QUERY_FILE_INFORMATION 10659
WriteX 10659 2047 1 1
QUERY_FILE_INFORMATION 10659
WriteX 10659 0 2048 2048
Close 10659
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 10660
ReadX 10660 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Close 10660
Close 10649
Close 10650
Close 10651
Close 10652
Close 10654
Close 10642
Close 10643
Close 10646
Close 10647
Close 10644
Close 10645
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 10661
ReadX 10661 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
WriteX 10614 4095 1 1
QUERY_FILE_INFORMATION 10614
WriteX 10614 2048 2048 2048
QUERY_FILE_INFORMATION 10614
Flush 10614
WriteX 10614 0 88 88
WriteX 10632 4095 1 1
QUERY_FILE_INFORMATION 10632
WriteX 10632 2048 2048 2048
QUERY_FILE_INFORMATION 10632
Flush 10632
WriteX 10632 0 88 88
WriteX 10661 4095 1 1
QUERY_FILE_INFORMATION 10661
WriteX 10661 2048 2048 2048
QUERY_FILE_INFORMATION 10661
Flush 10661
WriteX 10661 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10662
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10662 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10663
ReadX 10663 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10664
ReadX 10664 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10665
ReadX 10665 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10666
ReadX 10666 0 53 53
ReadX 10666 53 2 2
ReadX 10666 55 480 480
ReadX 10666 535 2 2
Close 10666
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10667
ReadX 10667 0 511 511
ReadX 10667 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10668
ReadX 10668 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10669
ReadX 10669 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10670
ReadX 10670 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10671
ReadX 10671 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10672
ReadX 10672 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10673
ReadX 10673 0 41 41
ReadX 10667 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10674
ReadX 10674 0 53 53
ReadX 10674 53 2 2
ReadX 10674 55 2 2
ReadX 10674 57 184 184
ReadX 10674 241 298 298
Close 10674
ReadX 10662 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10675
ReadX 10675 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10676
ReadX 10676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10677
ReadX 10677 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10678
ReadX 10678 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10679
ReadX 10679 0 53 53
ReadX 10679 53 28 28
ReadX 10679 81 28 28
ReadX 10679 109 28 28
ReadX 10679 137 28 28
ReadX 10679 165 28 28
ReadX 10679 193 28 28
ReadX 10679 221 28 28
ReadX 10679 249 4 4
ReadX 10679 253 4 4
ReadX 10679 257 4 4
ReadX 10679 261 28 28
ReadX 10679 289 2 2
ReadX 10679 291 2 2
ReadX 10679 293 2 2
Close 10679
ReadX 10675 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10680
ReadX 10680 0 53 53
ReadX 10680 53 2 2
ReadX 10680 55 2 2
ReadX 10680 57 184 184
ReadX 10680 241 298 298
Close 10680
ReadX 10664 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10681
ReadX 10681 0 53 53
ReadX 10681 53 2 2
ReadX 10681 55 480 480
ReadX 10681 535 2 2
Close 10681
ReadX 10675 4096 16384 16384
ReadX 10675 1280 16384 16384
ReadX 10675 2304 6144 6144
ReadX 10675 2688 2048 2048
ReadX 10662 4096 16384 16384
ReadX 10662 1280 16384 16384
ReadX 10662 2304 16384 16384
ReadX 10662 3328 16384 16384
ReadX 10662 272 16384 16384
ReadX 10662 336 16384 16384
ReadX 10662 400 16384 16384
ReadX 10662 464 16384 16384
ReadX 10662 528 16384 16384
ReadX 10662 592 16384 16384
ReadX 10662 656 16384 16384
ReadX 10662 720 16384 16384
ReadX 10662 784 16384 16384
ReadX 10662 848 16384 16384
ReadX 10662 912 16384 16384
ReadX 10668 2048 2048 2048
ReadX 10667 760 2048 2048
ReadX 10667 1144 2048 2048
ReadX 10667 408 2048 2048
ReadX 10667 912 2048 2048
ReadX 10667 1096 2048 2048
ReadX 10667 776 2048 2048
ReadX 10667 560 2048 2048
ReadX 10667 376 2048 2048
ReadX 10667 320 2048 2048
ReadX 10667 3072 2048 2048
ReadX 10667 784 2048 2048
ReadX 10667 2176 2048 2048
ReadX 10667 792 2048 2048
ReadX 10667 576 2048 2048
ReadX 10667 600 2048 2048
ReadX 10667 728 2048 2048
ReadX 10667 1112 2048 2048
ReadX 10667 664 2048 2048
ReadX 10667 976 2048 2048
ReadX 10667 3840 2048 2048
ReadX 10667 296 2048 2048
ReadX 10667 480 2048 2048
ReadX 10667 680 2048 2048
ReadX 10667 696 2048 2048
ReadX 10667 832 2048 2048
ReadX 10667 1016 2048 2048
ReadX 10667 1104 2048 2048
ReadX 10667 3200 2048 2048
ReadX 10667 264 2048 2048
ReadX 10667 448 2048 2048
ReadX 10667 648 2048 2048
ReadX 10667 1136 2048 2048
ReadX 10667 288 2048 2048
ReadX 10667 352 2048 2048
ReadX 10667 536 2048 2048
ReadX 10667 800 2048 2048
ReadX 10667 736 2048 2048
ReadX 10667 392 2048 2048
ReadX 10667 752 2048 2048
ReadX 10667 880 2048 2048
ReadX 10667 1064 2048 2048
ReadX 10667 1128 2048 2048
ReadX 10667 1536 2048 2048
ReadX 10667 2432 2048 2048
ReadX 10667 688 2048 2048
ReadX 10667 872 2048 2048
ReadX 10667 1072 2048 2048
ReadX 10667 984 2048 2048
ReadX 10667 704 2048 2048
ReadX 10667 3328 2048 2048
ReadX 10667 888 2048 2048
ReadX 10667 496 2048 2048
ReadX 10667 624 2048 2048
ReadX 10667 808 2048 2048
ReadX 10667 1008 2048 2048
ReadX 10667 1152 2048 2048
ReadX 10667 416 2048 2048
ReadX 10667 584 2048 2048
ReadX 10667 384 2048 2048
ReadX 10667 568 2048 2048
ReadX 10667 512 2048 2048
ReadX 10667 1408 2048 2048
ReadX 10667 472 2048 2048
ReadX 10667 672 2048 2048
ReadX 10667 2560 2048 2048
ReadX 10667 544 2048 2048
ReadX 10667 920 2048 2048
ReadX 10667 1120 2048 2048
ReadX 10667 2304 2048 2048
ReadX 10667 1080 2048 2048
ReadX 10667 1664 2048 2048
ReadX 10667 608 2048 2048
ReadX 10667 2688 2048 2048
ReadX 10667 3712 2048 2048
ReadX 10667 616 2048 2048
ReadX 10667 632 2048 2048
ReadX 10667 944 2048 2048
ReadX 10667 856 2048 2048
ReadX 10667 768 2048 2048
ReadX 10667 720 2048 2048
ReadX 10667 640 2048 2048
ReadX 10667 1048 2048 2048
ReadX 10667 1040 2048 2048
ReadX 10667 1032 2048 2048
ReadX 10667 1000 2048 2048
ReadX 10667 992 2048 2048
ReadX 10667 968 2048 2048
ReadX 10667 952 2048 2048
ReadX 10667 1056 2048 2048
ReadX 10667 816 2048 2048
ReadX 10667 864 2048 2048
ReadX 10667 2816 2048 2048
ReadX 10667 640 2048 2048
ReadX 10667 1024 2048 2048
ReadX 10667 504 2048 2048
ReadX 10667 424 2048 2048
ReadX 10667 840 2048 2048
ReadX 10667 896 2048 2048
ReadX 10667 520 2048 2048
ReadX 10667 960 2048 2048
ReadX 10667 552 2048 2048
ReadX 10667 488 2048 2048
ReadX 10667 824 2048 2048
ReadX 10667 304 2048 2048
ReadX 10667 768 2048 2048
ReadX 10667 712 2048 2048
ReadX 10667 512 2048 2048
ReadX 10667 432 2048 2048
ReadX 10667 384 2048 2048
ReadX 10667 2944 2048 2048
ReadX 10667 1088 2048 2048
ReadX 10667 928 2048 2048
ReadX 10667 280 2048 2048
ReadX 10667 744 2048 2048
ReadX 10667 3968 2048 2048
ReadX 10667 336 2048 2048
ReadX 10667 592 2048 2048
ReadX 10667 312 2048 2048
ReadX 10667 400 2048 2048
ReadX 10667 904 2048 2048
ReadX 10667 464 2048 2048
ReadX 10667 3456 2048 2048
ReadX 10667 848 2048 2048
ReadX 10667 936 2048 2048
ReadX 10667 656 2048 2048
ReadX 10667 344 2048 2048
ReadX 10667 440 2048 2048
ReadX 10667 4096 2048 2048
ReadX 10667 528 2048 2048
ReadX 10667 2048 2048 2048
ReadX 10667 1024 2048 2048
ReadX 10667 456 2048 2048
ReadX 10667 1792 2048 2048
ReadX 10667 1152 2048 2048
ReadX 10667 3584 2048 2048
ReadX 10667 1920 2048 2048
ReadX 10667 1280 2048 2048
ReadX 10667 896 2048 2048
ReadX 10667 328 2048 2048
Close 10675
Close 10676
Close 10677
Close 10678
Close 10673
Close 10667
Close 10668
Close 10671
Close 10672
Close 10669
Close 10670
Close 10662
Close 10663
Close 10664
Close 10665
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10682
FIND_FIRST \clients\client1\~dmtmp\*
Close 10682
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10683
QUERY_FILE_INFORMATION 10683
WriteX 10683 0 2048 2048
WriteX 10683 18431 1 1
QUERY_FILE_INFORMATION 10683
WriteX 10683 2048 16384 16384
WriteX 10683 1152 16384 16384
WriteX 10683 2176 16384 16384
WriteX 10683 3200 16384 16384
WriteX 10683 264 16384 16384
WriteX 10683 328 16384 16384
WriteX 10683 392 16384 16384
WriteX 10683 456 16384 16384
WriteX 10683 520 16384 16384
WriteX 10683 584 16384 16384
WriteX 10683 648 16384 16384
WriteX 10683 712 16384 16384
WriteX 10683 776 16384 16384
WriteX 10683 840 16384 16384
WriteX 10683 904 16384 16384
WriteX 10683 968 16384 16384
WriteX 10683 1032 16384 16384
WriteX 10683 1096 16384 16384
WriteX 10683 1160 16384 16384
WriteX 10683 1224 16384 16384
WriteX 10683 1288 16384 16384
WriteX 10683 1352 16384 16384
WriteX 10683 1416 16384 16384
WriteX 10683 1480 16384 16384
WriteX 10683 1544 16384 16384
WriteX 10683 1608 16384 16384
WriteX 10683 1672 16384 16384
WriteX 10683 1736 16384 16384
WriteX 10683 1800 16384 16384
WriteX 10683 1864 16384 16384
WriteX 10683 1928 16384 16384
WriteX 10683 1992 16384 16384
WriteX 10683 2056 16384 16384
WriteX 10683 2120 16384 16384
WriteX 10683 2184 16384 16384
WriteX 10683 2248 16384 16384
WriteX 10683 2312 16384 16384
WriteX 10683 2376 16384 16384
WriteX 10683 2440 16384 16384
WriteX 10683 0 88 88
Close 10683
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10684
ReadX 10684 0 511 511
ReadX 10684 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 10684
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10685
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10685 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10686
ReadX 10686 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10687
ReadX 10687 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10688
ReadX 10688 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10689
ReadX 10689 0 53 53
ReadX 10689 53 2 2
ReadX 10689 55 480 480
ReadX 10689 535 2 2
Close 10689
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10690
ReadX 10690 0 511 511
ReadX 10690 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10691
ReadX 10691 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10692
ReadX 10692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10693
ReadX 10693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10694
ReadX 10694 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10695
ReadX 10695 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10696
ReadX 10696 0 41 41
ReadX 10690 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10697
ReadX 10697 0 53 53
ReadX 10697 53 2 2
ReadX 10697 55 2 2
ReadX 10697 57 184 184
ReadX 10697 241 298 298
Close 10697
ReadX 10685 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10698
ReadX 10698 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10699
ReadX 10699 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10700
ReadX 10700 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10701
ReadX 10701 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10702
ReadX 10702 0 53 53
ReadX 10702 53 28 28
ReadX 10702 81 28 28
ReadX 10702 109 28 28
ReadX 10702 137 28 28
ReadX 10702 165 28 28
ReadX 10702 193 28 28
ReadX 10702 221 28 28
ReadX 10702 249 4 4
ReadX 10702 253 4 4
ReadX 10702 257 4 4
ReadX 10702 261 28 28
ReadX 10702 289 2 2
ReadX 10702 291 2 2
ReadX 10702 293 2 2
Close 10702
ReadX 10698 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10703
ReadX 10703 0 53 53
ReadX 10703 53 2 2
ReadX 10703 55 2 2
ReadX 10703 57 184 184
ReadX 10703 241 298 298
Close 10703
ReadX 10687 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10704
ReadX 10704 0 53 53
ReadX 10704 53 2 2
ReadX 10704 55 480 480
ReadX 10704 535 2 2
Close 10704
Close 10698
Close 10699
Close 10700
Close 10701
Close 10696
Close 10690
Close 10691
Close 10694
Close 10695
Close 10692
Close 10693
Close 10685
Close 10686
Close 10687
Close 10688
Close 10614
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 10705
QUERY_FILE_INFORMATION 10705
Close 10705
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
Unlink \clients\client1\~dmtmp\PARADOX\__42B96.DB
Close 10632
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 10706
QUERY_FILE_INFORMATION 10706
Close 10706
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43212.DB
Close 10661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 10707
QUERY_FILE_INFORMATION 10707
Close 10707
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10708
Close 10708
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10709
ReadX 10709 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10710
ReadX 10710 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10711
ReadX 10711 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10712
ReadX 10712 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10713
ReadX 10713 0 53 53
ReadX 10713 53 28 28
ReadX 10713 81 28 28
ReadX 10713 109 28 28
ReadX 10713 137 28 28
ReadX 10713 165 28 28
ReadX 10713 193 28 28
ReadX 10713 221 28 28
ReadX 10713 249 4 4
ReadX 10713 253 4 4
ReadX 10713 257 4 4
ReadX 10713 261 28 28
ReadX 10713 289 2 2
ReadX 10713 291 2 2
ReadX 10713 293 2 2
Close 10713
ReadX 10709 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
ReadX 10709 384 2048 2048
ReadX 10709 768 16384 16384
ReadX 10709 1792 14336 14336
ReadX 10712 2048 2048 2048
ReadX 10711 2048 2048 2048
WriteX 10709 1152 2048 2048
WriteX 10712 2048 2048 2048
WriteX 10711 2048 2048 2048
WriteX 10709 0 88 88
WriteX 10710 0 88 88
WriteX 10711 0 88 88
WriteX 10712 0 88 88
Close 10709
Close 10710
Close 10711
Close 10712
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10714
Close 10714
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10715
ReadX 10715 0 511 511
ReadX 10715 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10716
ReadX 10716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10717
ReadX 10717 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10718
ReadX 10718 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10719
ReadX 10719 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10720
ReadX 10720 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10721
ReadX 10721 0 53 53
ReadX 10721 53 2 2
ReadX 10721 55 2 2
ReadX 10721 57 184 184
ReadX 10721 241 298 298
Close 10721
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10722
ReadX 10722 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10723
ReadX 10723 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10724
ReadX 10724 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10725
ReadX 10725 0 511 511
ReadX 10724 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10726
ReadX 10726 0 53 53
ReadX 10726 53 2 2
ReadX 10726 55 480 480
ReadX 10726 535 2 2
Close 10726
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10727
ReadX 10727 0 41 41
ReadX 10715 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.TV 0x40 0x1 10728
QUERY_FILE_INFORMATION 10728
QUERY_FILE_INFORMATION 10728
ReadX 10728 0 8192 8192
Close 10728
ReadX 10715 1152 2048 2048
ReadX 10715 4096 16384 16384
Close 10722
Close 10723
Close 10724
Close 10725
Close 10727
Close 10715
Close 10716
Close 10719
Close 10720
Close 10717
Close 10718
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10729
Close 10729
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10730
QUERY_FILE_INFORMATION 10730
ReadX 10730 0 64 64
ReadX 10730 144 64 64
ReadX 10730 224 156 156
ReadX 10730 1193 128 128
ReadX 10730 1201 128 128
ReadX 10730 1072 4 4
ReadX 10730 1076 1925 1925
ReadX 10730 758 4 4
ReadX 10730 762 4557 4557
ReadX 10730 1052 4 4
ReadX 10730 1056 314 314
ReadX 10730 1056 11056 11056
Close 10730
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10731
ReadX 10731 0 511 511
ReadX 10731 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10732
ReadX 10732 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10733
ReadX 10733 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10734
ReadX 10734 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10735
ReadX 10735 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10736
ReadX 10736 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10737
ReadX 10737 0 53 53
ReadX 10737 53 2 2
ReadX 10737 55 2 2
ReadX 10737 57 184 184
ReadX 10737 241 298 298
Close 10737
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10738
ReadX 10738 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10739
ReadX 10739 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10740
ReadX 10740 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10741
ReadX 10741 0 511 511
ReadX 10740 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10742
ReadX 10742 0 53 53
ReadX 10742 53 2 2
ReadX 10742 55 480 480
ReadX 10742 535 2 2
Close 10742
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10743
ReadX 10743 0 41 41
ReadX 10731 2048 2048 2048
ReadX 10732 2048 2048 2048
ReadX 10731 1144 2048 2048
ReadX 10731 1152 2048 2048
ReadX 10731 4096 16384 16384
WriteX 10731 2048 2048 2048
WriteX 10732 2048 2048 2048
WriteX 10731 0 88 88
WriteX 10732 0 88 88
Close 10738
Close 10739
Close 10740
Close 10741
Close 10743
Close 10731
Close 10732
Close 10735
Close 10736
Close 10733
Close 10734
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 10744
Close 10744
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.FSL 0x40 0x1 10745
QUERY_FILE_INFORMATION 10745
ReadX 10745 0 64 64
ReadX 10745 144 64 64
ReadX 10745 224 84 84
ReadX 10745 478 16 16
ReadX 10745 1056 6176 6176
Close 10745
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10746
ReadX 10746 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10747
ReadX 10747 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.X04 0x40 0x1 10748
ReadX 10748 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10749
ReadX 10749 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.VAL 0x40 0x1 10750
ReadX 10750 0 53 53
ReadX 10750 53 28 28
ReadX 10750 81 28 28
ReadX 10750 109 28 28
ReadX 10750 137 28 28
ReadX 10750 165 28 28
ReadX 10750 193 28 28
ReadX 10750 221 28 28
ReadX 10750 249 4 4
ReadX 10750 253 4 4
ReadX 10750 257 4 4
ReadX 10750 261 28 28
ReadX 10750 289 2 2
ReadX 10750 291 2 2
ReadX 10750 293 2 2
Close 10750
ReadX 10746 2048 2048 2048
ReadX 10747 2048 2048 2048
ReadX 10746 1280 2048 2048
ReadX 10749 2048 2048 2048
ReadX 10748 2048 2048 2048
WriteX 10746 1280 2048 2048
WriteX 10749 2048 2048 2048
WriteX 10748 2048 2048 2048
WriteX 10747 2048 2048 2048
WriteX 10746 0 88 88
WriteX 10747 0 88 88
WriteX 10748 0 88 88
WriteX 10749 0 88 88
WriteX 10746 1280 2048 2048
WriteX 10749 2048 2048 2048
WriteX 10748 2048 2048 2048
WriteX 10747 2048 2048 2048
WriteX 10746 0 88 88
WriteX 10747 0 88 88
WriteX 10748 0 88 88
WriteX 10749 0 88 88
WriteX 10746 1280 2048 2048
WriteX 10749 2048 2048 2048
WriteX 10748 2048 2048 2048
WriteX 10747 2048 2048 2048
WriteX 10746 0 88 88
WriteX 10747 0 88 88
WriteX 10748 0 88 88
WriteX 10749 0 88 88
Close 10746
Close 10747
Close 10748
Close 10749
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10751
ReadX 10751 0 511 511
ReadX 10751 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10752
ReadX 10752 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10753
ReadX 10753 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10754
ReadX 10754 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10755
ReadX 10755 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10756
ReadX 10756 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10757
ReadX 10757 0 53 53
ReadX 10757 53 2 2
ReadX 10757 55 2 2
ReadX 10757 57 184 184
ReadX 10757 241 298 298
Close 10757
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10758
ReadX 10758 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10759
ReadX 10759 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10760
ReadX 10760 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10761
ReadX 10761 0 511 511
ReadX 10760 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10762
ReadX 10762 0 53 53
ReadX 10762 53 2 2
ReadX 10762 55 480 480
ReadX 10762 535 2 2
Close 10762
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10763
ReadX 10763 0 41 41
ReadX 10751 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x2 10767
FIND_FIRST \clients\client1\~dmtmp\*
Close 10767
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 10768
QUERY_FILE_INFORMATION 10768
WriteX 10768 2047 1 1
QUERY_FILE_INFORMATION 10768
WriteX 10768 0 2048 2048
Close 10768
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 10769
ReadX 10769 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
WriteX 10769 4095 1 1
QUERY_FILE_INFORMATION 10769
WriteX 10769 2048 2048 2048
WriteX 10769 0 88 88
Close 10769
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 10770
ReadX 10770 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
ReadX 10770 2048 2048 2048
Close 10758
Close 10759
Close 10760
Close 10761
Close 10763
Close 10751
Close 10752
Close 10755
Close 10756
Close 10753
Close 10754
WriteX 10770 2048 2048 2048
WriteX 10770 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10771
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10771 0 511 511
ReadX 10771 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10772
ReadX 10772 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10773
ReadX 10773 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10774
ReadX 10774 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10775
ReadX 10775 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10776
ReadX 10776 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10777
ReadX 10777 0 53 53
ReadX 10777 53 2 2
ReadX 10777 55 2 2
ReadX 10777 57 184 184
ReadX 10777 241 298 298
Close 10777
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10778
ReadX 10778 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10779
ReadX 10779 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10780
ReadX 10780 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10781
ReadX 10781 0 511 511
ReadX 10780 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10782
ReadX 10782 0 53 53
ReadX 10782 53 2 2
ReadX 10782 55 480 480
ReadX 10782 535 2 2
Close 10782
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10783
ReadX 10783 0 41 41
ReadX 10771 2048 2048 2048
ReadX 10771 1152 2048 2048
ReadX 10771 4096 16384 16384
ReadX 10771 1280 16384 16384
ReadX 10771 2304 16384 16384
ReadX 10771 3328 16384 16384
ReadX 10771 272 16384 16384
ReadX 10771 336 16384 16384
ReadX 10771 400 16384 16384
ReadX 10771 464 16384 16384
ReadX 10771 528 16384 16384
ReadX 10771 592 16384 16384
ReadX 10771 656 16384 16384
ReadX 10771 720 16384 16384
ReadX 10771 784 16384 16384
ReadX 10771 848 16384 16384
ReadX 10771 912 16384 16384
ReadX 10771 976 16384 16384
ReadX 10771 1040 16384 16384
ReadX 10771 1104 12288 12288
Close 10778
Close 10779
Close 10780
Close 10781
Close 10783
Close 10771
Close 10772
Close 10775
Close 10776
Close 10773
Close 10774
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10784
FIND_FIRST \clients\client1\~dmtmp\*
Close 10784
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10785
QUERY_FILE_INFORMATION 10785
WriteX 10785 0 2048 2048
WriteX 10785 2048 4096 4096
WriteX 10785 0 88 88
Close 10785
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10786
ReadX 10786 0 511 511
ReadX 10786 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 10786
WriteX 10770 2048 2048 2048
WriteX 10770 0 88 88
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10787
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10787 0 511 511
ReadX 10787 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10788
ReadX 10788 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10789
ReadX 10789 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10790
ReadX 10790 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10791
ReadX 10791 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10792
ReadX 10792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10793
ReadX 10793 0 53 53
ReadX 10793 53 2 2
ReadX 10793 55 2 2
ReadX 10793 57 184 184
ReadX 10793 241 298 298
Close 10793
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10794
ReadX 10794 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10795
ReadX 10795 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10796
ReadX 10796 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10797
ReadX 10797 0 511 511
ReadX 10796 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10798
ReadX 10798 0 53 53
ReadX 10798 53 2 2
ReadX 10798 55 480 480
ReadX 10798 535 2 2
Close 10798
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10799
ReadX 10799 0 41 41
ReadX 10787 2048 2048 2048
ReadX 10787 1152 2048 2048
ReadX 10787 4096 16384 16384
ReadX 10787 1280 16384 16384
ReadX 10787 2304 16384 16384
ReadX 10787 3328 16384 16384
ReadX 10787 272 16384 16384
ReadX 10787 336 16384 16384
ReadX 10787 400 16384 16384
ReadX 10787 464 16384 16384
ReadX 10787 528 16384 16384
ReadX 10787 592 16384 16384
ReadX 10787 656 16384 16384
ReadX 10787 720 16384 16384
ReadX 10787 784 16384 16384
ReadX 10787 848 16384 16384
ReadX 10787 912 16384 16384
ReadX 10787 976 16384 16384
ReadX 10787 1040 16384 16384
ReadX 10787 1104 12288 12288
Close 10794
Close 10795
Close 10796
Close 10797
Close 10799
Close 10787
Close 10788
Close 10791
Close 10792
Close 10789
Close 10790
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10800
FIND_FIRST \clients\client1\~dmtmp\*
Close 10800
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10801
QUERY_FILE_INFORMATION 10801
WriteX 10801 0 2048 2048
WriteX 10801 2048 4096 4096
WriteX 10801 0 88 88
Close 10801
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10802
ReadX 10802 0 511 511
ReadX 10802 2048 4096 4096
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
Close 10802
Close 10770
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 10803
QUERY_FILE_INFORMATION 10803
Close 10803
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10804
Close 10804
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10805
QUERY_FILE_INFORMATION 10805
ReadX 10805 0 64 64
ReadX 10805 144 64 64
ReadX 10805 224 156 156
ReadX 10805 1193 128 128
ReadX 10805 1201 128 128
ReadX 10805 1072 4 4
ReadX 10805 1076 1925 1925
ReadX 10805 758 4 4
ReadX 10805 762 4557 4557
ReadX 10805 1052 4 4
ReadX 10805 1056 314 314
ReadX 10805 1056 11056 11056
Close 10805
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10806
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10806 0 511 511
ReadX 10806 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10807
ReadX 10807 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10808
ReadX 10808 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10809
ReadX 10809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10810
ReadX 10810 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10811
ReadX 10811 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10812
ReadX 10812 0 53 53
ReadX 10812 53 2 2
ReadX 10812 55 2 2
ReadX 10812 57 184 184
ReadX 10812 241 298 298
Close 10812
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10813
ReadX 10813 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10814
ReadX 10814 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10815
ReadX 10815 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10816
ReadX 10816 0 511 511
ReadX 10815 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10817
ReadX 10817 0 53 53
ReadX 10817 53 2 2
ReadX 10817 55 480 480
ReadX 10817 535 2 2
Close 10817
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10818
ReadX 10818 0 41 41
ReadX 10806 2048 2048 2048
ReadX 10806 1152 2048 2048
ReadX 10806 4096 16384 16384
Close 10813
Close 10814
Close 10815
Close 10816
Close 10818
Close 10806
Close 10807
Close 10810
Close 10811
Close 10808
Close 10809
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10819
ReadX 10819 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10820
ReadX 10820 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10821
ReadX 10821 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10822
ReadX 10822 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10823
ReadX 10823 0 53 53
ReadX 10823 53 2 2
ReadX 10823 55 480 480
ReadX 10823 535 2 2
Close 10823
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10824
ReadX 10824 0 511 511
ReadX 10824 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10825
ReadX 10825 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10826
ReadX 10826 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10827
ReadX 10827 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10828
ReadX 10828 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10829
ReadX 10829 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10830
ReadX 10830 0 41 41
ReadX 10824 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10831
ReadX 10831 0 53 53
ReadX 10831 53 2 2
ReadX 10831 55 2 2
ReadX 10831 57 184 184
ReadX 10831 241 298 298
Close 10831
ReadX 10819 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x2 10835
FIND_FIRST \clients\client1\~dmtmp\*
Close 10835
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 10836
QUERY_FILE_INFORMATION 10836
WriteX 10836 2047 1 1
QUERY_FILE_INFORMATION 10836
WriteX 10836 0 2048 2048
Close 10836
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 10837
ReadX 10837 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
WriteX 10837 4095 1 1
QUERY_FILE_INFORMATION 10837
WriteX 10837 2048 2048 2048
WriteX 10837 0 88 88
Close 10837
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 10838
ReadX 10838 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 10838 2048 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x2 10842
Close 10842
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 10843
QUERY_FILE_INFORMATION 10843
WriteX 10843 2047 1 1
QUERY_FILE_INFORMATION 10843
WriteX 10843 0 2048 2048
Close 10843
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 10844
ReadX 10844 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
WriteX 10844 4095 1 1
QUERY_FILE_INFORMATION 10844
WriteX 10844 2048 2048 2048
WriteX 10844 0 88 88
Close 10844
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 10845
ReadX 10845 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
ReadX 10845 2048 2048 2048
Close 10830
Close 10824
Close 10825
Close 10828
Close 10829
Close 10826
Close 10827
Close 10819
Close 10820
Close 10821
Close 10822
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10846
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10846 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10847
ReadX 10847 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.X03 0x40 0x1 10848
ReadX 10848 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.Y03 0x40 0x1 10849
ReadX 10849 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.VAL 0x40 0x1 10850
ReadX 10850 0 53 53
ReadX 10850 53 2 2
ReadX 10850 55 480 480
ReadX 10850 535 2 2
Close 10850
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10851
ReadX 10851 0 511 511
ReadX 10851 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.PX 0x40 0x1 10852
ReadX 10852 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0 0x40 0x1 10853
ReadX 10853 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0 0x40 0x1 10854
ReadX 10854 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1 0x40 0x1 10855
ReadX 10855 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1 0x40 0x1 10856
ReadX 10856 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10857
ReadX 10857 0 41 41
ReadX 10851 2048 2048 2048
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL 0x40 0x1 10858
ReadX 10858 0 53 53
ReadX 10858 53 2 2
ReadX 10858 55 2 2
ReadX 10858 57 184 184
ReadX 10858 241 298 298
Close 10858
ReadX 10846 2048 2048 2048
ReadX 10846 384 16384 16384
ReadX 10846 1408 16384 16384
ReadX 10846 2560 16384 16384
ReadX 10846 3584 16384 16384
ReadX 10846 288 16384 16384
ReadX 10846 352 16384 16384
ReadX 10846 416 16384 16384
ReadX 10846 480 16384 16384
ReadX 10846 552 16384 16384
ReadX 10846 616 16384 16384
ReadX 10846 680 16384 16384
ReadX 10846 744 16384 16384
ReadX 10846 808 16384 16384
ReadX 10846 872 16384 16384
ReadX 10846 936 10240 10240
Close 10857
Close 10851
Close 10852
Close 10855
Close 10856
Close 10853
Close 10854
Close 10846
Close 10847
Close 10848
Close 10849
Close 10838
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 10859
QUERY_FILE_INFORMATION 10859
Close 10859
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52E2B.DB
Close 10845
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 10860
QUERY_FILE_INFORMATION 10860
Close 10860
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
Unlink \clients\client1\~dmtmp\PARADOX\__52EF7.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10861
ReadX 10861 0 65471 65471
ReadX 10861 65471 63 63
ReadX 10861 65534 65471 65471
ReadX 10861 131005 63 63
ReadX 10861 131068 65471 65471
ReadX 10861 196539 63 63
ReadX 10861 196602 65471 65471
ReadX 10861 262073 63 63
ReadX 10861 262136 65471 65471
ReadX 10861 327607 63 63
ReadX 10861 327670 10 10
Close 10861
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10862
ReadX 10862 0 65471 65471
ReadX 10862 65471 63 63
ReadX 10862 65534 65471 65471
ReadX 10862 131005 63 63
ReadX 10862 131068 65471 65471
ReadX 10862 196539 63 63
ReadX 10862 196602 65471 65471
ReadX 10862 262073 63 63
ReadX 10862 262136 65471 65471
ReadX 10862 327607 63 63
ReadX 10862 327670 65471 65471
ReadX 10862 393141 63 63
ReadX 10862 393204 65471 65471
ReadX 10862 458675 63 63
ReadX 10862 458738 65471 65471
ReadX 10862 524209 63 63
ReadX 10862 524272 65471 65471
ReadX 10862 589743 63 63
ReadX 10862 589806 65471 65471
ReadX 10862 655277 63 63
ReadX 10862 655340 32 32
Close 10862
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10863
ReadX 10863 0 65471 65471
ReadX 10863 65471 63 63
ReadX 10863 65534 65471 65471
ReadX 10863 131005 63 63
ReadX 10863 131068 65471 65471
ReadX 10863 196539 63 63
ReadX 10863 196602 65471 65471
ReadX 10863 262073 63 63
ReadX 10863 262136 65471 65471
ReadX 10863 327607 63 63
ReadX 10863 327670 65471 65471
ReadX 10863 393141 63 63
ReadX 10863 393204 65471 65471
ReadX 10863 458675 63 63
ReadX 10863 458738 65471 65471
ReadX 10863 524209 63 63
ReadX 10863 524272 65471 65471
ReadX 10863 589743 63 63
ReadX 10863 589806 65471 65471
ReadX 10863 655277 63 63
ReadX 10863 655340 65471 65471
ReadX 10863 720811 63 63
ReadX 10863 720874 65471 65471
ReadX 10863 786345 63 63
ReadX 10863 786408 65471 65471
ReadX 10863 851879 63 63
ReadX 10863 851942 65471 65471
ReadX 10863 917413 63 63
ReadX 10863 917476 65471 65471
ReadX 10863 982947 63 63
ReadX 10863 983010 65471 65471
ReadX 10863 1048481 63 63
ReadX 10863 1048544 65471 65471
ReadX 10863 1114015 63 63
ReadX 10863 1114078 65471 65471
ReadX 10863 1179549 63 63
ReadX 10863 1179612 65471 65471
ReadX 10863 1245083 63 63
ReadX 10863 1245146 65471 65471
ReadX 10863 1310617 63 63
ReadX 10863 1310680 65471 65471
ReadX 10863 1376151 63 63
ReadX 10863 1376214 65471 65471
ReadX 10863 1441685 63 63
ReadX 10863 1441748 65471 65471
ReadX 10863 1507219 63 63
ReadX 10863 1507282 65471 65471
ReadX 10863 1572753 63 63
ReadX 10863 1572816 65471 65471
ReadX 10863 1638287 63 63
ReadX 10863 1638350 65471 65471
ReadX 10863 1703821 63 63
ReadX 10863 1703884 65471 65471
ReadX 10863 1769355 63 63
ReadX 10863 1769418 65471 65471
ReadX 10863 1834889 63 63
ReadX 10863 1834952 32824 32824
Close 10863
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 10864
QUERY_FILE_INFORMATION 10864
ReadX 10864 0 512 512
ReadX 10864 512 512 512
ReadX 10864 1024 512 512
QUERY_FILE_INFORMATION 10864
QUERY_FILE_INFORMATION 10864
ReadX 10864 2560 2048 2048
ReadX 10864 1984 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x2 10865
WriteX 10865 52 1 1
QUERY_FILE_INFORMATION 10865
WriteX 10865 0 53 53
Close 10865
ReadX 10864 2208 650 650
ReadX 10864 1920 2048 2048
ReadX 10864 2112 2048 2048
ReadX 10864 1856 2048 2048
ReadX 10864 1824 2048 2048
ReadX 10864 1536 512 512
ReadX 10864 1632 1536 1536
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 10866
Close 10866
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 10864 1568 512 512
ReadX 10864 1536 512 512
ReadX 10864 2176 384 384
ReadX 10864 1600 416 416
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 10867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
ReadX 10864 288 2048 2048
ReadX 10864 2336 2048 2048
ReadX 10864 4384 2048 2048
ReadX 10864 6432 2048 2048
ReadX 10864 8480 2048 2048
ReadX 10864 10528 2048 2048
ReadX 10864 12576 2048 2048
WriteX 10867 15359 1 1
QUERY_FILE_INFORMATION 10867
ReadX 10864 14624 2048 2048
ReadX 10864 16672 2048 2048
ReadX 10864 18720 2048 2048
ReadX 10864 1728 2048 2048
WriteX 10867 0 15360 15360
Close 10867
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x1 10868
QUERY_FILE_INFORMATION 10868
ReadX 10868 0 512 512
ReadX 10868 2048 512 512
ReadX 10868 2560 512 512
QUERY_FILE_INFORMATION 10868
QUERY_FILE_INFORMATION 10868
QUERY_FILE_INFORMATION 10868
QUERY_FILE_INFORMATION 10868
QUERY_FILE_INFORMATION 10868
WriteX 10868 2152 384 384
QUERY_FILE_INFORMATION 10868
WriteX 10868 2150 22 22
WriteX 10868 2144 106 106
QUERY_FILE_INFORMATION 10868
WriteX 10868 2176 496 496
ReadX 10868 2176 496 496
QUERY_FILE_INFORMATION 10868
WriteX 10868 2440 384 384
QUERY_FILE_INFORMATION 10868
WriteX 10868 2152 384 384
WriteX 10868 2432 112 112
QUERY_FILE_INFORMATION 10868
WriteX 10868 2439 16 16
QUERY_FILE_INFORMATION 10868
WriteX 10868 2208 220 220
ReadX 10868 2208 220 220
QUERY_FILE_INFORMATION 10868
QUERY_FILE_INFORMATION 10868
WriteX 10868 2440 220 220
QUERY_FILE_INFORMATION 10868
WriteX 10868 2453 36 36
WriteX 10868 2080 512 512
WriteX 10868 2176 512 512
WriteX 10868 2112 512 512
WriteX 10868 2048 512 512
WriteX 10868 0 512 512
QUERY_FILE_INFORMATION 10864
QUERY_FILE_INFORMATION 10864
WriteX 10868 2080 512 512
Close 10868
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x200000 0x1 10869
Close 10869
Rename \clients\client1\~dmtmp\WORD\~WRD0000.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 10870
QUERY_FILE_INFORMATION 10870
ReadX 10870 0 512 512
ReadX 10870 2048 512 512
ReadX 10870 2560 512 512
QUERY_FILE_INFORMATION 10870
QUERY_FILE_INFORMATION 10870
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$CHAP10.DOC 0x40 0x1 10871
Close 10871
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\~$CHAP10.DOC
Close 10864
ReadX 10870 1408 512 512
ReadX 10870 2048 512 512
ReadX 10870 1536 512 512
ReadX 10870 2560 512 512
ReadX 10870 3072 512 512
ReadX 10870 3584 512 512
ReadX 10870 4096 512 512
ReadX 10870 4608 512 512
ReadX 10870 5120 512 512
ReadX 10870 5632 512 512
ReadX 10870 6144 512 512
ReadX 10870 6656 512 512
ReadX 10870 7168 512 512
ReadX 10870 7680 512 512
ReadX 10870 8192 512 512
ReadX 10870 8704 512 512
ReadX 10870 9216 512 512
ReadX 10870 9728 512 512
ReadX 10870 10240 512 512
ReadX 10870 10752 512 512
ReadX 10870 11264 512 512
ReadX 10870 11776 512 512
ReadX 10870 12288 512 512
ReadX 10870 12800 512 512
ReadX 10870 13312 512 512
ReadX 10870 13824 512 512
ReadX 10870 14336 512 512
ReadX 10870 14848 512 512
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 15360 512 0
ReadX 10870 2560 2048 2048
ReadX 10870 4608 2048 2048
ReadX 10870 6656 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 10872
QUERY_FILE_INFORMATION 10872
ReadX 10872 0 512 512
ReadX 10872 512 512 512
ReadX 10872 1024 512 512
QUERY_FILE_INFORMATION 10872
QUERY_FILE_INFORMATION 10872
ReadX 10872 352 2048 2048
ReadX 10872 608 1097 1097
ReadX 10872 576 1609 1609
ReadX 10872 4096 512 512
ReadX 10872 1536 512 512
ReadX 10872 3840 256 256
ReadX 10872 288 576 576
ReadX 10872 512 512 512
ReadX 10872 480 512 512
ReadX 10872 544 512 512
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\WORD\BASEMACH.DOC 0x40 0x1 10873
ReadX 10873 0 4096 4096
ReadX 10873 4096 4096 4096
ReadX 10873 8192 4096 4096
Close 10872
Close 10873
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 10874
WriteX 10874 15359 1 1
QUERY_FILE_INFORMATION 10874
WriteX 10874 0 15360 15360
Close 10874
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x1 10875
QUERY_FILE_INFORMATION 10875
ReadX 10875 0 512 512
ReadX 10875 2048 512 512
ReadX 10875 2560 512 512
QUERY_FILE_INFORMATION 10875
QUERY_FILE_INFORMATION 10875
QUERY_FILE_INFORMATION 10875
QUERY_FILE_INFORMATION 10875
QUERY_FILE_INFORMATION 10875
WriteX 10875 2152 384 384
QUERY_FILE_INFORMATION 10875
WriteX 10875 2150 22 22
WriteX 10875 2144 106 106
QUERY_FILE_INFORMATION 10875
WriteX 10875 2176 476 476
ReadX 10875 2176 476 476
QUERY_FILE_INFORMATION 10875
WriteX 10875 2440 384 384
QUERY_FILE_INFORMATION 10875
WriteX 10875 2152 384 384
WriteX 10875 2432 92 92
QUERY_FILE_INFORMATION 10875
WriteX 10875 2437 36 36
QUERY_FILE_INFORMATION 10875
WriteX 10875 2208 220 220
ReadX 10875 2208 220 220
QUERY_FILE_INFORMATION 10875
QUERY_FILE_INFORMATION 10875
WriteX 10875 2440 220 220
QUERY_FILE_INFORMATION 10875
WriteX 10875 2453 36 36
WriteX 10875 2080 512 512
WriteX 10875 2176 512 512
WriteX 10875 2112 512 512
WriteX 10875 2048 512 512
WriteX 10875 0 512 512
QUERY_FILE_INFORMATION 10870
QUERY_FILE_INFORMATION 10870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
Close 10870
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 10876
Close 10876
Rename \clients\client1\~dmtmp\WORD\HANDOUT.DOC \clients\client1\~dmtmp\WORD\~WRL0004.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 10877
QUERY_FILE_INFORMATION 10877
ReadX 10877 0 512 512
ReadX 10877 2048 512 512
ReadX 10877 2560 512 512
QUERY_FILE_INFORMATION 10877
QUERY_FILE_INFORMATION 10877
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x200000 0x1 10878
Close 10878
WriteX 10875 2080 512 512
Close 10875
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x200000 0x1 10879
Close 10879
Rename \clients\client1\~dmtmp\WORD\~WRD0003.TMP \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x1 10880
QUERY_FILE_INFORMATION 10880
ReadX 10880 0 512 512
ReadX 10880 2048 512 512
ReadX 10880 2560 512 512
QUERY_FILE_INFORMATION 10880
QUERY_FILE_INFORMATION 10880
ReadX 10880 1312 512 512
ReadX 10880 1536 512 512
ReadX 10880 2048 512 512
ReadX 10880 576 512 512
ReadX 10880 1088 512 512
ReadX 10880 1056 512 512
ReadX 10880 1120 512 512
ReadX 10880 1184 512 512
ReadX 10880 2560 2048 2048
ReadX 10880 4608 2048 2048
ReadX 10880 6656 2048 2048
ReadX 10880 8704 2048 2048
ReadX 10880 10752 2048 2048
ReadX 10880 12800 2048 2048
ReadX 10880 14848 2048 512
ReadX 10880 15360 1536 0
ReadX 10880 1088 2048 2048
ReadX 10880 3136 2048 2048
ReadX 10880 1665 5835 5835
ReadX 10880 1856 2048 2048
ReadX 10880 2112 512 512
ReadX 10880 2152 384 384
ReadX 10880 2432 92 92
ReadX 10880 2176 512 512
ReadX 10880 2440 220 220
QUERY_FILE_INFORMATION 10880
QUERY_FILE_INFORMATION 10880
ReadX 10880 2432 512 512
WriteX 10880 2272 512 512
ReadX 10880 2144 512 512
WriteX 10880 2304 512 512
WriteX 10880 2272 92 92
WriteX 10880 2208 512 512
WriteX 10880 2720 512 512
WriteX 10880 0 512 512
QUERY_FILE_INFORMATION 10880
QUERY_FILE_INFORMATION 10880
ReadX 10880 1312 4096 4096
ReadX 10880 5408 4096 4096
ReadX 10880 9504 3305 3305
ReadX 10880 512 4096 4096
QUERY_FILE_INFORMATION 10880
QUERY_FILE_INFORMATION 10880
QUERY_FILE_INFORMATION 10880
WriteX 10880 3132 50 50
WriteX 10880 3182 4096 4096
WriteX 10880 7278 4096 4096
WriteX 10880 15469 1 1
QUERY_FILE_INFORMATION 10880
WriteX 10880 11374 4096 4096
WriteX 10880 15470 3584 3584
WriteX 10880 2144 512 512
WriteX 10880 2336 4096 4096
WriteX 10880 6432 4096 4096
WriteX 10880 10528 4096 4096
WriteX 10880 14624 462 462
WriteX 10880 2048 512 512
WriteX 10880 2560 512 512
WriteX 10880 0 512 512
QUERY_FILE_INFORMATION 10880
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 10881
QUERY_FILE_INFORMATION 10881
ReadX 10881 0 512 512
ReadX 10881 1152 512 512
ReadX 10881 1664 512 512
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
ReadX 10881 512 2048 2048
ReadX 10881 928 2048 2048
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x2 10882
WriteX 10882 52 1 1
QUERY_FILE_INFORMATION 10882
WriteX 10882 0 53 53
Close 10882
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
ReadX 10881 1120 504 504
ReadX 10881 896 2048 2048
ReadX 10881 1056 1528 1528
ReadX 10881 864 2048 2048
ReadX 10881 832 2048 2048
ReadX 10881 736 2048 2048
ReadX 10881 1216 512 512
ReadX 10881 1256 384 384
ReadX 10881 1536 140 140
ReadX 10881 1280 512 512
ReadX 10881 1548 252 252
ReadX 10880 1184 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 10883
Close 10883
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 10884
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 10881 2560 2048 2048
ReadX 10881 4608 2048 2048
ReadX 10881 6656 2048 2048
ReadX 10881 8704 2048 2048
ReadX 10881 10752 2048 2048
WriteX 10884 12005 1 1
QUERY_FILE_INFORMATION 10884
WriteX 10884 0 12006 12006
Close 10884
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x1 10885
QUERY_FILE_INFORMATION 10885
ReadX 10885 0 512 512
ReadX 10885 1152 512 512
ReadX 10885 1664 512 512
QUERY_FILE_INFORMATION 10885
QUERY_FILE_INFORMATION 10885
QUERY_FILE_INFORMATION 10885
QUERY_FILE_INFORMATION 10885
QUERY_FILE_INFORMATION 10885
QUERY_FILE_INFORMATION 10885
QUERY_FILE_INFORMATION 10885
WriteX 10885 1256 384 384
QUERY_FILE_INFORMATION 10885
WriteX 10885 1254 22 22
WriteX 10885 1248 106 106
QUERY_FILE_INFORMATION 10885
WriteX 10885 1280 508 508
ReadX 10885 1280 508 508
QUERY_FILE_INFORMATION 10885
WriteX 10885 1544 384 384
QUERY_FILE_INFORMATION 10885
WriteX 10885 1256 384 384
WriteX 10885 1536 124 124
QUERY_FILE_INFORMATION 10885
WriteX 10885 1543 4 4
QUERY_FILE_INFORMATION 10885
WriteX 10885 1312 252 252
ReadX 10885 1312 252 252
QUERY_FILE_INFORMATION 10885
QUERY_FILE_INFORMATION 10885
WriteX 10885 1544 252 252
QUERY_FILE_INFORMATION 10885
WriteX 10885 1559 4 4
WriteX 10885 1184 512 512
WriteX 10885 1280 512 512
WriteX 10885 1216 512 512
WriteX 10885 1152 512 512
WriteX 10885 0 512 512
QUERY_FILE_INFORMATION 10881
QUERY_FILE_INFORMATION 10881
WriteX 10885 1184 512 512
Close 10885
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x200000 0x1 10886
Close 10886
Rename \clients\client1\~dmtmp\WORD\~WRD3497.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 10887
QUERY_FILE_INFORMATION 10887
ReadX 10887 0 512 512
ReadX 10887 1152 512 512
ReadX 10887 1664 512 512
QUERY_FILE_INFORMATION 10887
QUERY_FILE_INFORMATION 10887
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\~$FACTS.DOC 0x40 0x1 10888
Close 10888
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Unlink \clients\client1\~dmtmp\WORD\~$FACTS.DOC
Close 10881
ReadX 10887 736 512 512
ReadX 10887 1536 2048 2048
ReadX 10887 3584 2048 2048
ReadX 10887 5632 2048 2048
ReadX 10887 7680 2048 2048
ReadX 10887 9728 2048 2048
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 10889
WriteX 10889 11990 1 1
QUERY_FILE_INFORMATION 10889
WriteX 10889 0 11991 11991
Close 10889
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x1 10890
QUERY_FILE_INFORMATION 10890
ReadX 10890 0 512 512
ReadX 10890 1184 512 512
ReadX 10890 1696 512 512
QUERY_FILE_INFORMATION 10890
QUERY_FILE_INFORMATION 10890
QUERY_FILE_INFORMATION 10890
QUERY_FILE_INFORMATION 10890
QUERY_FILE_INFORMATION 10890
QUERY_FILE_INFORMATION 10890
QUERY_FILE_INFORMATION 10890
WriteX 10890 1288 384 384
QUERY_FILE_INFORMATION 10890
WriteX 10890 1286 22 22
WriteX 10890 1280 106 106
QUERY_FILE_INFORMATION 10890
WriteX 10890 1312 508 508
ReadX 10890 1312 508 508
QUERY_FILE_INFORMATION 10890
WriteX 10890 1576 384 384
QUERY_FILE_INFORMATION 10890
WriteX 10890 1288 384 384
WriteX 10890 1568 124 124
QUERY_FILE_INFORMATION 10890
WriteX 10890 1575 4 4
QUERY_FILE_INFORMATION 10890
WriteX 10890 1344 252 252
ReadX 10890 1344 252 252
QUERY_FILE_INFORMATION 10890
QUERY_FILE_INFORMATION 10890
WriteX 10890 1576 252 252
QUERY_FILE_INFORMATION 10890
WriteX 10890 1591 4 4
WriteX 10890 1216 512 512
WriteX 10890 1312 512 512
WriteX 10890 1248 512 512
WriteX 10890 1184 512 512
WriteX 10890 0 512 512
QUERY_FILE_INFORMATION 10887
QUERY_FILE_INFORMATION 10887
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
Close 10887
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 10891
Close 10891
Rename \clients\client1\~dmtmp\WORD\TIPS.DOC \clients\client1\~dmtmp\WORD\~WRL1146.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 10892
QUERY_FILE_INFORMATION 10892
ReadX 10892 0 512 512
ReadX 10892 1152 512 512
ReadX 10892 1664 512 512
QUERY_FILE_INFORMATION 10892
QUERY_FILE_INFORMATION 10892
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x200000 0x1 10893
Close 10893
WriteX 10890 1216 512 512
Close 10890
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x200000 0x1 10894
Close 10894
Rename \clients\client1\~dmtmp\WORD\~WRD1119.TMP \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x1 10895
QUERY_FILE_INFORMATION 10895
ReadX 10895 0 512 512
ReadX 10895 1184 512 512
ReadX 10895 1696 512 512
QUERY_FILE_INFORMATION 10895
QUERY_FILE_INFORMATION 10895
ReadX 10895 1536 512 512
ReadX 10895 736 512 512
ReadX 10895 2048 512 512
ReadX 10895 2560 512 512
ReadX 10895 3072 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 10896
Close 10896
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
ReadX 10895 914 3899 3899
ReadX 10895 1248 512 512
ReadX 10895 1288 384 384
ReadX 10895 1568 124 124
ReadX 10895 1312 512 512
ReadX 10895 1576 252 252
QUERY_FILE_INFORMATION 10895
QUERY_FILE_INFORMATION 10895
ReadX 10895 1568 512 512
WriteX 10895 1408 512 512
ReadX 10895 1280 512 512
WriteX 10895 1440 512 512
WriteX 10895 1408 124 124
WriteX 10895 1344 512 512
WriteX 10895 1856 512 512
WriteX 10895 0 512 512
QUERY_FILE_INFORMATION 10895
QUERY_FILE_INFORMATION 10895
ReadX 10895 544 4096 4096
ReadX 10895 4640 4096 4096
ReadX 10895 8736 1637 1637
ReadX 10895 512 4096 4096
QUERY_FILE_INFORMATION 10895
QUERY_FILE_INFORMATION 10895
WriteX 10895 1280 512 512
WriteX 10895 1472 3584 3584
WriteX 10895 5056 4096 4096
WriteX 10895 13247 1 1
QUERY_FILE_INFORMATION 10895
WriteX 10895 9152 4096 4096
WriteX 10895 13248 1736 1736
WriteX 10895 1184 512 512
WriteX 10895 1696 512 512
WriteX 10895 0 512 512
QUERY_FILE_INFORMATION 10895
ReadX 10895 1632 1024 1024
ReadX 10895 288 1024 1024
ReadX 10895 1312 2048 2048
ReadX 10895 3360 1024 1024
ReadX 10895 1696 1024 1024
ReadX 10895 2720 512 512
ReadX 10895 3232 512 512
ReadX 10895 3744 512 512
ReadX 10895 4256 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
ReadX 10895 2066 3998 3998
ReadX 10895 1448 384 384
ReadX 10895 1408 124 124
ReadX 10895 1416 252 252
QUERY_FILE_INFORMATION 10895
QUERY_FILE_INFORMATION 10895
ReadX 10895 1408 512 512
WriteX 10895 1536 512 512
ReadX 10895 1440 512 512
WriteX 10895 2048 512 512
WriteX 10895 1536 124 124
WriteX 10895 512 512 512
WriteX 10895 1024 512 512
WriteX 10895 0 512 512
QUERY_FILE_INFORMATION 10895
ReadX 10895 1696 4096 4096
ReadX 10895 5792 4096 4096
ReadX 10895 9888 1736 1736
ReadX 10895 1280 512 512
ReadX 10895 1472 3584 3584
QUERY_FILE_INFORMATION 10895
QUERY_FILE_INFORMATION 10895
WriteX 10895 3940 156 156
WriteX 10895 4096 512 512
WriteX 10895 544 3584 3584
WriteX 10895 4128 4096 4096
WriteX 10895 8224 3584 3584
WriteX 10895 1344 512 512
WriteX 10895 1856 1536 1536
WriteX 10895 2336 512 512
WriteX 10895 3584 356 356
WriteX 10895 2560 512 512
WriteX 10895 3072 512 512
WriteX 10895 0 512 512
QUERY_FILE_INFORMATION 10895
Close 10877
Close 10880
Close 10895
Close 10892
NTCreateX \clients\client1\~dmtmp\WORD\~WRL0004.TMP 0x40 0x1 10897
Close 10897
Unlink \clients\client1\~dmtmp\WORD\~WRL0004.TMP
NTCreateX \clients\client1\~dmtmp\WORD\~WRL1146.TMP 0x40 0x1 10898
Close 10898
Unlink \clients\client1\~dmtmp\WORD\~WRL1146.TMP
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10899
WriteX 10899 0 65471 65471
WriteX 10899 65471 63 63
WriteX 10899 65534 65471 65471
WriteX 10899 131005 63 63
Close 10899
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10900
WriteX 10900 0 65471 65471
WriteX 10900 65471 63 63
WriteX 10900 65534 65471 65471
WriteX 10900 131005 63 63
WriteX 10900 131068 65471 65471
WriteX 10900 196539 63 63
WriteX 10900 196602 65471 65471
WriteX 10900 262073 63 63
Close 10900
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10901
WriteX 10901 0 65471 65471
WriteX 10901 65471 63 63
WriteX 10901 65534 65471 65471
WriteX 10901 131005 63 63
WriteX 10901 131068 65471 65471
WriteX 10901 196539 63 63
WriteX 10901 196602 65471 65471
WriteX 10901 262073 63 63
WriteX 10901 262136 65471 65471
WriteX 10901 327607 63 63
WriteX 10901 327670 65471 65471
WriteX 10901 393141 63 63
WriteX 10901 393204 65471 65471
WriteX 10901 458675 63 63
WriteX 10901 458738 65471 65471
WriteX 10901 524209 63 63
Close 10901
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 10902
QUERY_FILE_INFORMATION 10902
QUERY_FILE_INFORMATION 10902
ReadX 10902 0 16384 16384
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x2 10903
Close 10903
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.LDB 0x40 0x1 10904
WriteX 10904 63 1 1
QUERY_FILE_INFORMATION 10904
WriteX 10904 0 64 64
ReadX 10902 992 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 344 2048 2048
ReadX 10902 1344 2048 2048
ReadX 10902 1352 2048 2048
ReadX 10902 1320 2048 2048
ReadX 10902 1360 2048 2048
ReadX 10902 1344 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1376 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2304 2048 2048
ReadX 10902 1472 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 1480 2048 2048
ReadX 10902 1488 2048 2048
ReadX 10902 1496 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 1504 2048 2048
ReadX 10902 1464 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 1000 2048 2048
ReadX 10902 1416 2048 2048
ReadX 10902 1000 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10902 360 2048 2048
ReadX 10902 368 2048 2048
ReadX 10902 360 2048 2048
ReadX 10902 376 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 1232 2048 2048
ReadX 10902 2432 6144 6144
ReadX 10902 2376 2048 2048
ReadX 10902 2360 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 2376 2048 2048
ReadX 10902 2384 2048 2048
ReadX 10902 2368 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 1296 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 2392 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
ReadX 10902 0 2048 2048
ReadX 10902 2688 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 2688 2048 2048
WriteX 10902 2688 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 2688 2048 2048
ReadX 10902 2688 2048 2048
ReadX 10902 2688 2048 2048
WriteX 10902 2688 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 2688 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10902 2688 2048 2048
ReadX 10902 2688 2048 2048
WriteX 10902 2688 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 320 4096 4096
ReadX 10902 0 2048 2048
ReadX 10902 3584 2048 2048
ReadX 10902 3584 2048 2048
ReadX 10902 3584 2048 2048
ReadX 10902 0 2048 2048
WriteX 10902 3584 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2688 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 2688 2048 2048
ReadX 10902 2688 2048 2048
WriteX 10902 2688 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 3200 2048 2048
ReadX 10902 3200 2048 2048
ReadX 10902 3200 2048 2048
WriteX 10902 3200 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 3456 2048 2048
ReadX 10902 3456 2048 2048
ReadX 10902 3456 2048 2048
WriteX 10902 3456 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2496 2048 2048
ReadX 10902 2472 2048 2048
ReadX 10902 2456 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 2472 2048 2048
ReadX 10902 2480 2048 2048
ReadX 10902 2464 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 2488 2048 2048
ReadX 10902 2568 8192 8192
ReadX 10902 1000 2048 2048
ReadX 10902 328 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 2048 2048 2048
ReadX 10902 2560 2048 2048
ReadX 10902 920 2048 2048
WriteX 10902 2048 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 312 2048 2048
WriteX 10902 336 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 328 2048 2048
WriteX 10902 2560 2048 2048
WriteX 10902 3840 2048 2048
WriteX 10902 920 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2432 2048 2048
WriteX 10902 2432 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2456 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 328 2048 2048
ReadX 10902 2560 2048 2048
ReadX 10902 2048 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 336 2048 2048
ReadX 10902 920 2048 2048
WriteX 10902 1536 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 2048 2048 2048
WriteX 10902 2560 2048 2048
WriteX 10902 336 2048 2048
WriteX 10902 920 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2048 2048 2048
ReadX 10902 2432 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 2048 2048 2048
WriteX 10902 2432 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2456 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1536 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 336 2048 2048
ReadX 10902 920 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 1536 2048 2048
WriteX 10902 336 2048 2048
WriteX 10902 920 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2432 2048 2048
WriteX 10902 2432 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2456 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1536 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 336 2048 2048
ReadX 10902 920 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 1536 2048 2048
WriteX 10902 336 2048 2048
WriteX 10902 920 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2432 2048 2048
WriteX 10902 2432 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2456 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1536 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 336 2048 2048
ReadX 10902 920 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 1536 2048 2048
WriteX 10902 336 2048 2048
WriteX 10902 920 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2432 2048 2048
WriteX 10902 2432 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2456 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1536 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 336 2048 2048
ReadX 10902 920 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 1536 2048 2048
WriteX 10902 336 2048 2048
WriteX 10902 920 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2432 2048 2048
WriteX 10902 2432 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
Flush 10902
ReadX 10902 2456 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1536 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 336 2048 2048
ReadX 10902 920 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 1536 2048 2048
WriteX 10902 336 2048 2048
WriteX 10902 920 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2432 2048 2048
WriteX 10902 2432 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2624 6144 6144
ReadX 10902 2616 2048 2048
ReadX 10902 2688 2048 2048
ReadX 10902 2600 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 2616 2048 2048
ReadX 10902 2608 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 344 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 520 2048 2048
ReadX 10902 1392 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 400 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 536 2048 2048
ReadX 10902 824 2048 2048
ReadX 10902 832 2048 2048
ReadX 10902 384 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 408 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 552 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 824 2048 2048
ReadX 10902 840 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 768 2048 2048
ReadX 10902 2048 2048 2048
WriteX 10902 1415 1 1
WriteX 10902 352 2048 2048
WriteX 10902 1112 2048 2048
WriteX 10902 1400 2048 2048
WriteX 10902 1408 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 2048 2048 2048
WriteX 10902 768 2048 2048
WriteX 10902 344 2048 2048
WriteX 10902 1000 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 416 2048 2048
ReadX 10902 424 2048 2048
ReadX 10902 432 2048 2048
ReadX 10902 440 2048 2048
ReadX 10902 576 16384 16384
ReadX 10902 448 2048 2048
ReadX 10902 456 2048 2048
ReadX 10902 464 2048 2048
ReadX 10902 640 16384 16384
ReadX 10902 704 16384 16384
ReadX 10902 768 10240 10240
QUERY_FS_INFORMATION 259
ReadX 10902 848 2048 2048
ReadX 10902 560 2048 2048
ReadX 10902 808 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 2600 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 352 2048 2048
ReadX 10902 1928 8192 8192
ReadX 10902 528 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 824 2048 2048
ReadX 10902 0 2048 2048
Flush 10902
ReadX 10902 2600 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 352 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 824 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 856 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 392 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 472 2048 2048
ReadX 10902 480 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 488 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 928 2048 2048
ReadX 10902 936 2048 2048
ReadX 10902 976 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 392 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 952 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 528 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 528 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 816 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 1384 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10902 1336 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 528 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 528 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1240 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2200 4096 4096
ReadX 10902 2152 2048 2048
ReadX 10902 2160 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1312 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 1928 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 824 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1416 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 352 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 824 2048 2048
ReadX 10902 384 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 824 2048 2048
QUERY_FS_INFORMATION 259
ReadX 10902 352 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 768 2048 2048
ReadX 10902 2048 2048 2048
ReadX 10902 352 2048 2048
WriteX 10902 1551 1 1
WriteX 10902 1512 2048 2048
WriteX 10902 1520 2048 2048
WriteX 10902 1528 2048 2048
WriteX 10902 1544 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 2048 2048 2048
WriteX 10902 768 2048 2048
WriteX 10902 344 2048 2048
WriteX 10902 1000 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2048 2048 2048
WriteX 10902 2048 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 1000 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1240 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 344 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 384 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 768 2048 2048
WriteX 10902 1567 1 1
WriteX 10902 1552 2048 2048
WriteX 10902 1560 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 768 2048 2048
WriteX 10902 344 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 1328 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1240 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2200 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1240 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 344 2048 2048
ReadX 10902 384 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 2048 2048 2048
ReadX 10902 768 2048 2048
WriteX 10902 1583 1 1
WriteX 10902 1568 2048 2048
WriteX 10902 1576 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 2048 2048 2048
WriteX 10902 768 2048 2048
WriteX 10902 344 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 864 2048 2048
ReadX 10902 872 2048 2048
ReadX 10902 912 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 2688 2048 2048
ReadX 10902 1000 2048 2048
WriteX 10902 2688 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 2944 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 0 2048 2048
Flush 10902
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 2688 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 2688 2048 2048
WriteX 10902 2688 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 392 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 416 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 416 2048 2048
ReadX 10902 864 2048 2048
ReadX 10902 872 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 312 2048 2048
ReadX 10902 888 2048 2048
ReadX 10902 400 2048 2048
ReadX 10902 896 2048 2048
WriteX 10902 1584 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 400 2048 2048
WriteX 10902 416 2048 2048
WriteX 10902 864 2048 2048
WriteX 10902 872 2048 2048
WriteX 10902 888 2048 2048
WriteX 10902 896 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 584 2048 2048
ReadX 10902 392 2048 2048
WriteX 10902 392 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 1328 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 0 2048 2048
ReadX 10902 408 2048 2048
ReadX 10902 1328 2048 2048
ReadX 10902 864 2048 2048
ReadX 10902 912 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 3840 2048 2048
ReadX 10902 312 2048 2048
ReadX 10902 1584 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 408 2048 2048
WriteX 10902 912 2048 2048
WriteX 10902 1584 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 408 2048 2048
ReadX 10902 392 2048 2048
WriteX 10902 392 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 528 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 528 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 552 2048 2048
ReadX 10902 1336 2048 2048
WriteX 10902 552 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 0 2048 2048
ReadX 10902 552 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 2664 2048 2048
ReadX 10902 2648 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 2672 2048 2048
ReadX 10902 2656 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 1000 2048 2048
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10902 528 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 1336 2048 2048
ReadX 10902 2680 2048 2048
ReadX 10902 2760 8192 8192
ReadX 10902 544 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 568 2048 2048
ReadX 10902 544 2048 2048
ReadX 10902 0 2048 2048
Flush 10902
ReadX 10902 2816 6144 6144
ReadX 10902 2760 2048 2048
ReadX 10902 2744 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 2752 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 528 2048 2048
ReadX 10902 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 10906
Close 10906
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 10908
WriteX 10908 4065 1 1
QUERY_FILE_INFORMATION 10908
WriteX 10908 0 62591 62591
Close 10908
ReadX 10902 0 2048 2048
ReadX 10902 2808 2048 2048
ReadX 10902 2792 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 2800 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 384 2048 2048
ReadX 10902 392 2048 2048
ReadX 10902 1384 2048 2048
ReadX 10902 2432 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 10910
Close 10910
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 10912
WriteX 10912 4094 1 1
QUERY_FILE_INFORMATION 10912
WriteX 10912 0 10845 10845
Close 10912
ReadX 10902 1432 2048 2048
ReadX 10902 1304 2048 2048
ReadX 10902 1368 2048 2048
ReadX 10902 2304 2048 2048
ReadX 10902 1440 2048 2048
ReadX 10902 1424 2048 2048
ReadX 10902 1448 2048 2048
ReadX 10902 1456 2048 2048
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 10914
Close 10914
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 10916
ReadX 10902 0 2048 2048
WriteX 10916 4081 1 1
QUERY_FILE_INFORMATION 10916
WriteX 10916 0 30118 30118
Close 10916
ReadX 10902 1344 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1152 2048 2048
ReadX 10902 1152 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 1000 2048 2048
ReadX 10902 768 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 344 2048 2048
WriteX 10902 1000 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 1416 2048 2048
ReadX 10902 1416 2048 2048
ReadX 10902 344 2048 2048
ReadX 10902 896 2048 2048
WriteX 10902 1538 2 2
WriteX 10902 344 2048 2048
WriteX 10902 1416 2048 2048
WriteX 10902 1538 2 2
ReadX 10902 2048 2048 2048
WriteX 10902 2048 2048 2048
WriteX 10902 1538 2 2
Close 10902
Close 10904
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.LDB
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10917
ReadX 10917 0 65471 65471
ReadX 10917 65471 63 63
ReadX 10917 65534 65471 65471
ReadX 10917 131005 63 63
ReadX 10917 131068 65471 65471
ReadX 10917 196539 63 63
ReadX 10917 196602 65471 65471
ReadX 10917 262073 63 63
ReadX 10917 262136 65471 65471
ReadX 10917 327607 63 63
ReadX 10917 327670 10 10
Close 10917
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10918
ReadX 10918 0 65471 65471
ReadX 10918 65471 63 63
ReadX 10918 65534 65471 65471
ReadX 10918 131005 63 63
ReadX 10918 131068 65471 65471
ReadX 10918 196539 63 63
ReadX 10918 196602 65471 65471
ReadX 10918 262073 63 63
ReadX 10918 262136 65471 65471
ReadX 10918 327607 63 63
ReadX 10918 327670 65471 65471
ReadX 10918 393141 63 63
ReadX 10918 393204 65471 65471
ReadX 10918 458675 63 63
ReadX 10918 458738 65471 65471
ReadX 10918 524209 63 63
ReadX 10918 524272 65471 65471
ReadX 10918 589743 63 63
ReadX 10918 589806 65471 65471
ReadX 10918 655277 63 63
ReadX 10918 655340 32 32
Close 10918
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10919
ReadX 10919 0 65471 65471
ReadX 10919 65471 63 63
ReadX 10919 65534 65471 65471
ReadX 10919 131005 63 63
ReadX 10919 131068 65471 65471
ReadX 10919 196539 63 63
ReadX 10919 196602 65471 65471
ReadX 10919 262073 63 63
ReadX 10919 262136 65471 65471
ReadX 10919 327607 63 63
ReadX 10919 327670 65471 65471
ReadX 10919 393141 63 63
ReadX 10919 393204 65471 65471
ReadX 10919 458675 63 63
ReadX 10919 458738 65471 65471
ReadX 10919 524209 63 63
ReadX 10919 524272 65471 65471
ReadX 10919 589743 63 63
ReadX 10919 589806 65471 65471
ReadX 10919 655277 63 63
ReadX 10919 655340 65471 65471
ReadX 10919 720811 63 63
ReadX 10919 720874 65471 65471
ReadX 10919 786345 63 63
ReadX 10919 786408 65471 65471
ReadX 10919 851879 63 63
ReadX 10919 851942 65471 65471
ReadX 10919 917413 63 63
ReadX 10919 917476 65471 65471
ReadX 10919 982947 63 63
ReadX 10919 983010 65471 65471
ReadX 10919 1048481 63 63
ReadX 10919 1048544 65471 65471
ReadX 10919 1114015 63 63
ReadX 10919 1114078 65471 65471
ReadX 10919 1179549 63 63
ReadX 10919 1179612 65471 65471
ReadX 10919 1245083 63 63
ReadX 10919 1245146 65471 65471
ReadX 10919 1310617 63 63
ReadX 10919 1310680 65471 65471
ReadX 10919 1376151 63 63
ReadX 10919 1376214 65471 65471
ReadX 10919 1441685 63 63
ReadX 10919 1441748 65471 65471
ReadX 10919 1507219 63 63
ReadX 10919 1507282 65471 65471
ReadX 10919 1572753 63 63
ReadX 10919 1572816 65471 65471
ReadX 10919 1638287 63 63
ReadX 10919 1638350 65471 65471
ReadX 10919 1703821 63 63
ReadX 10919 1703884 65471 65471
ReadX 10919 1769355 63 63
ReadX 10919 1769418 65471 65471
ReadX 10919 1834889 63 63
ReadX 10919 1834952 32824 32824
Close 10919
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10920
Close 10920
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10921
ReadX 10921 0 24 24
Close 10921
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10922
QUERY_FILE_INFORMATION 10922
ReadX 10922 0 512 512
ReadX 10922 464 512 512
ReadX 10922 498 512 512
ReadX 10922 472 512 512
ReadX 10922 466 512 512
ReadX 10922 978 512 512
ReadX 10922 497 57 57
Close 10922
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10923
QUERY_FILE_INFORMATION 10923
ReadX 10923 0 512 512
ReadX 10923 464 512 512
ReadX 10923 498 512 512
ReadX 10923 472 512 512
ReadX 10923 462 512 512
ReadX 10923 468 512 512
ReadX 10923 466 512 512
QUERY_FILE_INFORMATION 10923
WriteX 10923 482 60 60
WriteX 10923 482 4 4
QUERY_FILE_INFORMATION 10923
WriteX 10923 482 11 11
ReadX 10923 497 57 57
ReadX 10923 497 57 57
ReadX 10923 368 4096 4096
ReadX 10923 460 512 512
ReadX 10923 512 4096 4096
ReadX 10923 4608 4096 4096
ReadX 10923 8704 4096 4096
ReadX 10923 12800 4096 4096
ReadX 10923 16896 4096 4096
ReadX 10923 20992 4096 4096
ReadX 10923 25088 4096 4096
ReadX 10923 29184 4096 4096
ReadX 10923 33280 4096 4096
ReadX 10923 37376 4096 4096
ReadX 10923 41472 4096 4096
ReadX 10923 45568 4096 4096
ReadX 10923 49664 4096 4096
ReadX 10923 53760 4096 4096
ReadX 10923 57856 4096 4096
ReadX 10923 61952 4096 4096
ReadX 10923 66048 4096 4096
ReadX 10923 70144 4096 4096
ReadX 10923 497 20 20
ReadX 10923 496 103 103
ReadX 10923 500 448 448
ReadX 10923 470 512 512
ReadX 10923 486 2692 2692
ReadX 10923 290 4096 4096
ReadX 10923 4386 4096 4096
ReadX 10923 8482 4096 4096
ReadX 10923 500 20 20
ReadX 10923 483 108 108
ReadX 10923 482 292 292
ReadX 10923 338 4096 4096
ReadX 10923 4434 3103 3103
ReadX 10923 384 28 28
ReadX 10923 412 20 20
ReadX 10923 432 8 8
ReadX 10923 440 136 136
ReadX 10923 576 8 8
ReadX 10923 584 4 4
ReadX 10923 588 4 4
ReadX 10923 592 39 39
ReadX 10923 384 4 4
ReadX 10923 388 4 4
ReadX 10923 392 23 23
ReadX 10923 385 4 4
ReadX 10923 389 4 4
ReadX 10923 393 12 12
ReadX 10923 405 4 4
ReadX 10923 409 4 4
ReadX 10923 413 1 1
ReadX 10923 385 4 4
ReadX 10923 389 4 4
ReadX 10923 393 1 1
ReadX 10923 385 4 4
ReadX 10923 389 4 4
ReadX 10923 393 12 12
ReadX 10923 405 4 4
ReadX 10923 409 4 4
ReadX 10923 413 2 2
ReadX 10923 385 4 4
ReadX 10923 389 4 4
ReadX 10923 393 25 25
ReadX 10923 385 4 4
ReadX 10923 389 8 8
ReadX 10923 397 4 4
ReadX 10923 401 8 8
ReadX 10923 409 4 4
ReadX 10923 413 8 8
ReadX 10923 421 4 4
ReadX 10923 425 8 8
ReadX 10923 433 4 4
ReadX 10923 437 4 4
ReadX 10923 441 4 4
ReadX 10923 445 4 4
ReadX 10923 449 4 4
ReadX 10923 453 4 4
ReadX 10923 457 4 4
ReadX 10923 461 4 4
ReadX 10923 465 10670 10670
ReadX 10923 428 4096 4096
WriteX 10923 498 512 512
WriteX 10923 472 512 512
WriteX 10923 462 512 512
WriteX 10923 468 512 512
Close 10923
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10924
Close 10924
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10925
QUERY_FILE_INFORMATION 10925
ReadX 10925 0 512 512
ReadX 10925 464 512 512
ReadX 10925 498 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10926
Close 10926
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10925
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10928
WriteX 10928 4607 1 1
QUERY_FILE_INFORMATION 10928
WriteX 10928 0 65471 65471
WriteX 10928 65471 65 65
WriteX 10928 65536 19979 19979
Close 10928
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10929
QUERY_FILE_INFORMATION 10929
ReadX 10929 0 512 512
ReadX 10929 462 512 512
ReadX 10929 974 512 512
ReadX 10929 1486 512 512
ReadX 10929 460 512 512
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
WriteX 10929 470 448 448
QUERY_FILE_INFORMATION 10929
WriteX 10929 470 60 60
WriteX 10929 470 4 4
QUERY_FILE_INFORMATION 10929
WriteX 10929 470 11 11
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
WriteX 10929 464 512 512
WriteX 10929 976 512 512
WriteX 10929 1488 512 512
WriteX 10929 462 512 512
WriteX 10929 0 512 512
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
ReadX 10929 470 512 512
WriteX 10929 482 512 512
WriteX 10929 482 292 292
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
WriteX 10929 483 20 20
WriteX 10929 483 108 108
QUERY_FILE_INFORMATION 10929
WriteX 10929 484 448 448
QUERY_FILE_INFORMATION 10929
WriteX 10929 484 44 44
WriteX 10929 484 20 20
WriteX 10929 480 512 512
WriteX 10929 472 512 512
WriteX 10929 476 512 512
WriteX 10929 988 512 512
WriteX 10929 474 512 512
Flush 10929
WriteX 10929 0 512 512
Flush 10929
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
WriteX 10929 480 512 512
WriteX 10929 472 512 512
WriteX 10929 476 512 512
QUERY_FILE_INFORMATION 10929
WriteX 10929 496 320 320
QUERY_FILE_INFORMATION 10929
WriteX 10929 496 60 60
ReadX 10929 484 512 512
WriteX 10929 500 512 512
WriteX 10929 470 512 512
WriteX 10929 486 2692 2692
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
WriteX 10929 497 25 25
WriteX 10929 496 103 103
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
WriteX 10929 497 44 44
WriteX 10929 497 20 20
WriteX 10929 498 512 512
WriteX 10929 462 512 512
WriteX 10929 466 512 512
WriteX 10929 978 512 512
WriteX 10929 464 512 512
Flush 10929
WriteX 10929 0 512 512
Flush 10929
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
QUERY_FILE_INFORMATION 10929
WriteX 10929 497 7 7
WriteX 10929 497 57 57
WriteX 10929 498 512 512
WriteX 10929 472 512 512
WriteX 10929 462 512 512
WriteX 10929 466 512 512
WriteX 10929 978 512 512
Flush 10929
WriteX 10929 498 512 512
Flush 10929
Close 10929
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10930
QUERY_FILE_INFORMATION 10930
ReadX 10930 0 512 512
ReadX 10930 464 512 512
ReadX 10930 498 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\ZD16.BMP 0x40 0x1 10931
ReadX 10931 0 20 20
ReadX 10931 14 40 40
ReadX 10931 54 64 64
ReadX 10931 118 1152 1152
Close 10931
Close 10930
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10932
Close 10932
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10933
ReadX 10933 0 24 24
Close 10933
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10934
QUERY_FILE_INFORMATION 10934
ReadX 10934 0 512 512
ReadX 10934 464 512 512
ReadX 10934 498 512 512
ReadX 10934 472 512 512
ReadX 10934 462 512 512
ReadX 10934 466 512 512
ReadX 10934 978 512 512
ReadX 10934 497 57 57
Close 10934
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10935
QUERY_FILE_INFORMATION 10935
ReadX 10935 0 512 512
ReadX 10935 464 512 512
ReadX 10935 498 512 512
ReadX 10935 472 512 512
ReadX 10935 468 512 512
ReadX 10935 462 512 512
ReadX 10935 466 512 512
QUERY_FILE_INFORMATION 10935
WriteX 10935 482 60 60
WriteX 10935 482 4 4
QUERY_FILE_INFORMATION 10935
WriteX 10935 482 11 11
WriteX 10935 498 512 512
WriteX 10935 472 512 512
WriteX 10935 462 512 512
WriteX 10935 466 512 512
WriteX 10935 978 512 512
Close 10935
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x2 10936
Close 10936
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 10937
Close 10937
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10939
WriteX 10939 4607 1 1
QUERY_FILE_INFORMATION 10939
WriteX 10939 0 65471 65471
WriteX 10939 65471 65 65
WriteX 10939 65536 17654 17654
Close 10939
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10940
QUERY_FILE_INFORMATION 10940
ReadX 10940 0 512 512
ReadX 10940 474 512 512
ReadX 10940 986 512 512
ReadX 10940 1498 512 512
ReadX 10940 472 512 512
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
WriteX 10940 482 448 448
QUERY_FILE_INFORMATION 10940
WriteX 10940 482 60 60
WriteX 10940 482 4 4
QUERY_FILE_INFORMATION 10940
WriteX 10940 482 11 11
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
WriteX 10940 476 512 512
WriteX 10940 988 512 512
WriteX 10940 1500 512 512
WriteX 10940 474 512 512
WriteX 10940 0 512 512
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
ReadX 10940 482 512 512
WriteX 10940 494 512 512
WriteX 10940 494 292 292
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
WriteX 10940 495 20 20
WriteX 10940 495 108 108
QUERY_FILE_INFORMATION 10940
WriteX 10940 496 448 448
QUERY_FILE_INFORMATION 10940
WriteX 10940 496 44 44
WriteX 10940 496 20 20
WriteX 10940 492 512 512
WriteX 10940 484 512 512
WriteX 10940 488 512 512
WriteX 10940 1000 512 512
WriteX 10940 486 512 512
Flush 10940
WriteX 10940 0 512 512
Flush 10940
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
WriteX 10940 492 512 512
WriteX 10940 484 512 512
WriteX 10940 488 512 512
QUERY_FILE_INFORMATION 10940
WriteX 10940 508 320 320
QUERY_FILE_INFORMATION 10940
WriteX 10940 508 60 60
ReadX 10940 496 512 512
WriteX 10940 512 512 512
WriteX 10940 482 512 512
WriteX 10940 498 2692 2692
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
WriteX 10940 509 25 25
WriteX 10940 508 103 103
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
WriteX 10940 509 44 44
WriteX 10940 509 20 20
WriteX 10940 510 512 512
WriteX 10940 474 512 512
WriteX 10940 478 512 512
WriteX 10940 990 512 512
WriteX 10940 476 512 512
Flush 10940
WriteX 10940 0 512 512
Flush 10940
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
QUERY_FILE_INFORMATION 10940
WriteX 10940 509 7 7
WriteX 10940 509 57 57
WriteX 10940 510 512 512
WriteX 10940 484 512 512
WriteX 10940 474 512 512
WriteX 10940 478 512 512
WriteX 10940 990 512 512
Flush 10940
WriteX 10940 510 512 512
Flush 10940
Close 10940
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10941
Close 10941
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10942
QUERY_FILE_INFORMATION 10942
ReadX 10942 0 512 512
ReadX 10942 476 512 512
ReadX 10942 510 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP 0x40 0x1 10943
Close 10943
Unlink \clients\client1\~dmtmp\PWRPNT\PPTB1E4.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA 0x40 0x1 10944
QUERY_FILE_INFORMATION 10944
ReadX 10944 0 512 512
ReadX 10944 512 512 512
ReadX 10944 770 512 512
ReadX 10944 1282 512 512
ReadX 10944 1794 512 512
ReadX 10944 2562 512 512
ReadX 10944 3586 512 512
ReadX 10944 3828 512 512
ReadX 10944 288 512 512
ReadX 10944 1024 512 512
ReadX 10944 954 512 512
ReadX 10944 295 512 512
ReadX 10944 320 512 512
ReadX 10944 322 512 512
ReadX 10944 834 512 512
ReadX 10944 1346 512 512
ReadX 10944 1858 512 512
ReadX 10944 323 512 512
ReadX 10944 835 512 512
ReadX 10944 1347 512 512
ReadX 10944 1859 512 512
ReadX 10944 2371 345 345
ReadX 10944 322 167 167
ReadX 10944 489 512 512
ReadX 10944 1001 512 512
ReadX 10944 1513 512 512
ReadX 10944 2025 512 512
ReadX 10944 2537 512 512
ReadX 10944 3049 512 512
ReadX 10944 3561 345 345
ReadX 10944 323 167 167
ReadX 10944 490 512 512
ReadX 10944 1002 512 512
ReadX 10944 1514 512 512
ReadX 10944 2026 512 512
ReadX 10944 2538 512 512
ReadX 10944 3050 512 512
ReadX 10944 3562 512 512
ReadX 10944 4074 512 512
ReadX 10944 4586 512 512
ReadX 10944 5098 512 512
ReadX 10944 5610 512 512
ReadX 10944 6122 512 512
ReadX 10944 6634 512 512
ReadX 10944 7146 512 512
ReadX 10944 7658 512 512
ReadX 10944 8170 512 512
ReadX 10944 8682 512 512
ReadX 10944 9194 512 512
ReadX 10944 9706 512 512
ReadX 10944 10218 512 512
ReadX 10944 10730 345 345
ReadX 10944 11075 512 512
ReadX 10944 11587 167 167
ReadX 10944 11754 512 512
ReadX 10944 12266 512 512
ReadX 10944 12778 512 512
ReadX 10944 13290 512 512
ReadX 10944 13802 512 512
ReadX 10944 14314 512 512
ReadX 10944 14826 512 512
ReadX 10944 15338 512 512
ReadX 10944 337 512 512
ReadX 10944 337 512 512
ReadX 10944 849 34 34
ReadX 10944 352 512 512
ReadX 10944 864 512 512
ReadX 10944 1376 512 512
ReadX 10944 1888 512 512
ReadX 10944 2400 512 512
ReadX 10944 2912 512 512
ReadX 10944 3424 512 512
ReadX 10944 3936 512 512
ReadX 10944 1632 512 512
ReadX 10944 2144 512 512
ReadX 10944 1682 512 512
ReadX 10944 258 512 512
ReadX 10944 360 144 144
ReadX 10944 2517 512 512
ReadX 10944 3029 512 512
ReadX 10944 1751 512 512
ReadX 10944 2263 512 512
ReadX 10944 2775 512 512
ReadX 10944 3287 512 512
ReadX 10944 3799 512 512
ReadX 10944 4311 512 512
ReadX 10944 4823 512 512
ReadX 10944 5335 512 512
ReadX 10944 5847 512 512
ReadX 10944 6359 512 512
ReadX 10944 6871 512 512
ReadX 10944 7383 512 512
ReadX 10944 7895 512 512
ReadX 10944 8407 512 512
ReadX 10944 8919 512 512
ReadX 10944 9431 512 512
ReadX 10944 9943 512 512
ReadX 10944 10455 512 512
ReadX 10944 10967 512 512
ReadX 10944 11479 512 512
ReadX 10944 2556 512 512
ReadX 10944 3068 512 512
ReadX 10944 3580 512 512
ReadX 10944 4092 512 512
ReadX 10944 4604 512 512
ReadX 10944 5116 512 512
ReadX 10944 5628 512 512
ReadX 10944 6140 512 512
ReadX 10944 6652 512 512
ReadX 10944 7164 512 512
ReadX 10944 7676 512 512
ReadX 10944 8188 512 512
ReadX 10944 8700 512 512
ReadX 10944 9212 512 512
ReadX 10944 9724 512 512
ReadX 10944 10236 512 512
ReadX 10944 10748 512 512
ReadX 10944 11260 512 512
ReadX 10944 11772 512 512
ReadX 10944 12284 512 512
ReadX 10944 12796 49 49
ReadX 10944 260 463 463
ReadX 10944 723 512 512
ReadX 10944 1235 512 512
ReadX 10944 1747 512 512
ReadX 10944 2259 512 512
ReadX 10944 2771 512 512
ReadX 10944 3283 512 512
ReadX 10944 3795 512 512
ReadX 10944 4307 512 512
ReadX 10944 4819 512 512
ReadX 10944 5331 512 512
ReadX 10944 5843 512 512
ReadX 10944 6355 512 512
ReadX 10944 6867 512 512
ReadX 10944 7379 512 512
ReadX 10944 7891 512 512
ReadX 10944 8403 512 512
ReadX 10944 8915 512 512
ReadX 10944 9427 512 512
ReadX 10944 9939 512 512
ReadX 10944 10451 512 512
ReadX 10944 10963 402 402
ReadX 10944 593 240 240
ReadX 10944 2048 272 272
ReadX 10944 2320 512 512
ReadX 10944 2832 512 512
ReadX 10944 3344 512 512
ReadX 10944 3856 512 512
ReadX 10944 4368 512 512
ReadX 10944 4880 512 512
ReadX 10944 5392 240 240
ReadX 10944 608 272 272
ReadX 10944 880 512 512
ReadX 10944 1392 512 512
ReadX 10944 1904 512 512
ReadX 10944 2416 512 512
ReadX 10944 2928 512 512
ReadX 10944 3440 512 512
ReadX 10944 3952 512 512
ReadX 10944 4464 512 512
ReadX 10944 4976 512 512
ReadX 10944 5488 512 512
ReadX 10944 6000 512 512
ReadX 10944 6512 512 512
ReadX 10944 7024 512 512
ReadX 10944 7536 512 512
ReadX 10944 8048 512 512
ReadX 10944 8560 512 512
ReadX 10944 9072 512 512
ReadX 10944 9584 512 512
ReadX 10944 10096 512 512
ReadX 10944 1683 512 512
ReadX 10944 514 512 512
ReadX 10944 620 512 512
ReadX 10944 770 512 512
ReadX 10944 1282 512 512
ReadX 10944 1794 512 512
ReadX 10944 2000 512 512
ReadX 10944 1434 512 512
ReadX 10944 2050 512 512
ReadX 10944 2118 512 512
ReadX 10944 1715 512 512
ReadX 10944 1024 512 512
ReadX 10944 954 512 512
ReadX 10944 1880 512 512
ReadX 10944 1286 512 512
ReadX 10944 1510 512 512
ReadX 10944 2562 512 512
ReadX 10944 2610 512 512
ReadX 10944 3586 512 512
ReadX 10944 3812 512 512
ReadX 10944 3828 512 512
ReadX 10944 4046 512 512
ReadX 10944 4066 512 512
ReadX 10944 1747 512 512
ReadX 10944 1026 512 512
ReadX 10944 1538 512 512
ReadX 10944 514 512 512
ReadX 10944 751 512 512
ReadX 10944 1263 512 512
ReadX 10944 620 512 512
ReadX 10944 1132 512 512
ReadX 10944 1644 512 512
ReadX 10944 2156 512 512
ReadX 10944 2668 512 512
ReadX 10944 3180 512 512
ReadX 10944 3692 512 512
ReadX 10944 4204 394 394
ReadX 10944 606 118 118
ReadX 10944 724 512 512
ReadX 10944 1236 512 512
ReadX 10944 1748 512 512
ReadX 10944 2260 512 512
ReadX 10944 2772 512 512
ReadX 10944 3284 512 512
ReadX 10944 3796 394 394
ReadX 10944 636 118 118
ReadX 10944 754 512 512
ReadX 10944 1266 512 512
ReadX 10944 1778 512 512
ReadX 10944 2290 512 512
ReadX 10944 2802 512 512
ReadX 10944 3314 512 512
ReadX 10944 3826 512 512
ReadX 10944 4338 512 512
ReadX 10944 4850 512 512
ReadX 10944 5362 512 512
ReadX 10944 5874 512 512
ReadX 10944 6386 512 512
ReadX 10944 6898 512 512
ReadX 10944 7410 512 512
ReadX 10944 7922 512 512
ReadX 10944 8434 512 512
ReadX 10944 8946 512 512
ReadX 10944 9458 512 512
ReadX 10944 9970 512 512
ReadX 10944 10482 512 512
ReadX 10944 723 512 512
ReadX 10944 1235 512 512
ReadX 10944 725 512 512
ReadX 10944 729 512 512
ReadX 10944 1241 512 512
ReadX 10944 1753 512 512
ReadX 10944 2265 512 512
ReadX 10944 2777 512 512
ReadX 10944 3289 512 512
ReadX 10944 3801 512 512
ReadX 10944 4313 512 512
ReadX 10944 4825 512 512
ReadX 10944 5337 512 512
ReadX 10944 5849 512 512
ReadX 10944 6361 512 512
ReadX 10944 755 512 512
ReadX 10944 1267 512 512
ReadX 10944 1779 512 512
ReadX 10944 2291 512 512
ReadX 10944 2803 512 512
ReadX 10944 3315 512 512
ReadX 10944 3827 512 512
ReadX 10944 4339 244 244
ReadX 10944 4583 512 512
ReadX 10944 5095 268 268
ReadX 10944 5363 512 512
ReadX 10944 5875 512 512
ReadX 10944 6387 512 512
ReadX 10944 6899 512 512
ReadX 10944 7411 512 512
ReadX 10944 7923 512 512
ReadX 10944 8435 512 512
ReadX 10944 8947 512 512
ReadX 10944 9459 512 512
ReadX 10944 9971 512 512
ReadX 10944 10483 512 512
ReadX 10944 10995 512 512
ReadX 10944 11507 512 512
ReadX 10944 12019 512 512
ReadX 10944 12531 512 512
ReadX 10944 13043 512 512
ReadX 10944 13555 512 512
ReadX 10944 14067 512 512
ReadX 10944 14579 512 512
ReadX 10944 15091 512 512
ReadX 10944 15603 342 342
ReadX 10944 725 512 512
ReadX 10944 2000 512 512
ReadX 10944 3918 512 512
ReadX 10944 727 512 512
ReadX 10944 258 512 512
ReadX 10944 376 512 512
ReadX 10944 1109 512 512
ReadX 10944 1028 512 512
ReadX 10944 1540 512 512
ReadX 10944 2052 512 512
ReadX 10944 2564 512 512
ReadX 10944 3076 512 512
ReadX 10944 3588 512 512
ReadX 10944 4100 512 512
ReadX 10944 4612 412 412
ReadX 10944 1012 100 100
ReadX 10944 1112 512 512
ReadX 10944 1624 512 512
ReadX 10944 2136 512 512
ReadX 10944 2648 512 512
ReadX 10944 3160 512 512
ReadX 10944 3672 512 512
ReadX 10944 4184 412 412
ReadX 10944 1044 100 100
ReadX 10944 1144 512 512
ReadX 10944 1656 512 512
ReadX 10944 2168 512 512
ReadX 10944 2680 512 512
ReadX 10944 3192 512 512
ReadX 10944 3704 512 512
ReadX 10944 4216 512 512
ReadX 10944 4728 512 512
ReadX 10944 5240 512 512
ReadX 10944 5752 512 512
ReadX 10944 6264 512 512
ReadX 10944 6776 512 512
QUERY_FS_INFORMATION 259
ReadX 10944 7288 512 512
ReadX 10944 7800 512 512
ReadX 10944 8312 512 512
ReadX 10944 8824 512 512
ReadX 10944 9336 512 512
ReadX 10944 9848 512 512
ReadX 10944 10360 512 512
ReadX 10944 10872 512 512
ReadX 10944 11384 512 512
ReadX 10944 11896 512 512
ReadX 10944 12408 512 512
ReadX 10944 1088 512 512
ReadX 10944 1600 512 512
ReadX 10944 1090 512 512
ReadX 10944 1094 512 512
ReadX 10944 1606 512 512
ReadX 10944 2118 512 512
ReadX 10944 2630 512 512
ReadX 10944 3142 512 512
ReadX 10944 3654 512 512
ReadX 10944 4166 512 512
ReadX 10944 4678 512 512
ReadX 10944 1111 512 512
ReadX 10944 1623 512 512
ReadX 10944 2135 512 512
ReadX 10944 2647 512 512
ReadX 10944 3159 512 512
ReadX 10944 3671 512 512
ReadX 10944 4183 512 512
ReadX 10944 4695 512 512
ReadX 10944 5207 512 512
ReadX 10944 5719 512 512
ReadX 10944 6231 512 512
ReadX 10944 6743 512 512
ReadX 10944 7255 512 512
ReadX 10944 7767 512 512
ReadX 10944 8279 512 512
ReadX 10944 8791 512 512
ReadX 10944 9303 512 512
ReadX 10944 9815 512 512
ReadX 10944 10327 512 512
ReadX 10944 10839 512 512
ReadX 10944 11351 294 294
ReadX 10944 1091 512 512
ReadX 10944 970 512 512
ReadX 10944 1093 512 512
ReadX 10944 1434 512 512
ReadX 10944 2050 512 512
ReadX 10944 2158 512 512
ReadX 10944 2118 512 512
ReadX 10944 2630 512 512
ReadX 10944 3142 512 512
ReadX 10944 3654 512 512
ReadX 10944 4166 512 512
ReadX 10944 4678 512 512
ReadX 10944 5190 512 512
ReadX 10944 5702 382 382
ReadX 10944 2104 130 130
ReadX 10944 2234 512 512
ReadX 10944 2746 512 512
ReadX 10944 3258 512 512
ReadX 10944 3770 512 512
ReadX 10944 4282 512 512
ReadX 10944 4794 512 512
ReadX 10944 5306 382 382
ReadX 10944 2134 130 130
ReadX 10944 2264 512 512
ReadX 10944 2776 512 512
ReadX 10944 3288 512 512
ReadX 10944 3800 512 512
ReadX 10944 4312 512 512
ReadX 10944 4824 512 512
ReadX 10944 5336 512 512
ReadX 10944 2147 512 512
ReadX 10944 2149 512 512
ReadX 10944 2152 512 512
ReadX 10944 2664 512 512
ReadX 10944 3176 512 512
ReadX 10944 3688 512 512
ReadX 10944 2159 512 512
ReadX 10944 2671 512 512
ReadX 10944 3183 512 512
ReadX 10944 3695 512 512
ReadX 10944 4207 512 512
ReadX 10944 4719 512 512
ReadX 10944 5231 512 512
ReadX 10944 5743 512 512
ReadX 10944 6255 512 512
ReadX 10944 6767 512 512
ReadX 10944 7279 512 512
ReadX 10944 7791 512 512
ReadX 10944 8303 512 512
ReadX 10944 8815 512 512
ReadX 10944 9327 512 512
ReadX 10944 9839 512 512
ReadX 10944 10351 512 512
ReadX 10944 10863 512 512
ReadX 10944 11375 512 512
ReadX 10944 11887 512 512
ReadX 10944 12399 38 38
ReadX 10944 2149 512 512
ReadX 10944 1794 512 512
ReadX 10944 2016 512 512
ReadX 10944 2151 512 512
ReadX 10944 1918 512 512
ReadX 10944 1880 512 512
ReadX 10944 2392 512 512
ReadX 10944 2904 512 512
ReadX 10944 3416 512 512
ReadX 10944 3928 512 512
ReadX 10944 4440 512 512
ReadX 10944 4952 512 512
ReadX 10944 5464 416 416
ReadX 10944 1866 96 96
ReadX 10944 1962 512 512
ReadX 10944 2474 512 512
ReadX 10944 2986 512 512
ReadX 10944 3498 512 512
ReadX 10944 4010 512 512
ReadX 10944 4522 512 512
ReadX 10944 5034 416 416
ReadX 10944 1896 96 96
ReadX 10944 1992 512 512
ReadX 10944 2504 512 512
ReadX 10944 3016 512 512
ReadX 10944 3528 512 512
ReadX 10944 1903 512 512
ReadX 10944 1905 512 512
ReadX 10944 1908 512 512
ReadX 10944 2420 512 512
ReadX 10944 2932 512 512
ReadX 10944 3444 512 512
ReadX 10944 3956 512 512
ReadX 10944 1919 512 512
ReadX 10944 2431 512 512
ReadX 10944 2943 512 512
ReadX 10944 3455 512 512
ReadX 10944 3967 512 512
ReadX 10944 4479 512 512
ReadX 10944 4991 512 512
ReadX 10944 5503 512 512
ReadX 10944 6015 512 512
ReadX 10944 6527 512 512
ReadX 10944 7039 512 512
ReadX 10944 7551 512 512
ReadX 10944 8063 512 512
ReadX 10944 8575 512 512
ReadX 10944 9087 512 512
ReadX 10944 9599 512 512
ReadX 10944 10111 512 512
ReadX 10944 10623 512 512
ReadX 10944 11135 512 512
ReadX 10944 11647 512 512
ReadX 10944 12159 322 322
ReadX 10944 1905 512 512
ReadX 10944 1846 512 512
ReadX 10944 1907 512 512
ReadX 10944 1860 268 268
ReadX 10944 1832 244 244
ReadX 10944 1846 512 512
ReadX 10944 2358 512 512
ReadX 10944 2870 512 512
ReadX 10944 3382 512 512
ReadX 10944 3894 512 512
ReadX 10944 4406 512 512
ReadX 10944 4918 512 512
ReadX 10944 1858 512 512
ReadX 10944 1859 512 512
ReadX 10944 1860 488 488
ReadX 10944 1832 24 24
ReadX 10944 1861 228 228
ReadX 10944 1832 284 284
ReadX 10944 2116 512 512
ReadX 10944 2628 512 512
ReadX 10944 3140 512 512
ReadX 10944 3652 512 512
ReadX 10944 4164 512 512
ReadX 10944 4676 512 512
ReadX 10944 5188 228 228
ReadX 10944 1862 284 284
ReadX 10944 2146 512 512
ReadX 10944 2658 38 38
ReadX 10944 1859 512 512
ReadX 10944 2047 512 512
ReadX 10944 2016 512 512
ReadX 10944 2528 512 512
ReadX 10944 3040 512 512
ReadX 10944 3552 512 512
ReadX 10944 4064 512 512
ReadX 10944 4576 512 512
ReadX 10944 5088 512 512
ReadX 10944 5600 424 424
ReadX 10944 2002 88 88
ReadX 10944 2090 512 512
ReadX 10944 2602 512 512
ReadX 10944 3114 512 512
ReadX 10944 3626 512 512
ReadX 10944 4138 512 512
ReadX 10944 4650 512 512
ReadX 10944 5162 424 424
ReadX 10944 2032 88 88
ReadX 10944 2120 512 512
ReadX 10944 2632 512 512
ReadX 10944 3144 512 512
ReadX 10944 3656 512 512
ReadX 10944 4168 512 512
ReadX 10944 4680 512 512
ReadX 10944 5192 512 512
ReadX 10944 2044 512 512
ReadX 10944 2045 512 512
ReadX 10944 2046 512 512
ReadX 10944 2047 512 512
ReadX 10944 2559 110 110
ReadX 10944 2052 402 402
ReadX 10944 2454 512 512
ReadX 10944 2966 512 512
ReadX 10944 3478 512 512
ReadX 10944 3990 512 512
ReadX 10944 4502 512 512
ReadX 10944 5014 512 512
ReadX 10944 5526 512 512
ReadX 10944 6038 512 512
ReadX 10944 6550 512 512
ReadX 10944 7062 512 512
ReadX 10944 7574 512 512
ReadX 10944 8086 512 512
ReadX 10944 8598 512 512
ReadX 10944 9110 512 512
ReadX 10944 9622 512 512
ReadX 10944 10134 512 512
ReadX 10944 10646 512 512
ReadX 10944 11158 512 512
ReadX 10944 11670 512 512
ReadX 10944 12182 512 512
ReadX 10944 12694 118 118
ReadX 10944 2045 512 512
ReadX 10944 1282 512 512
ReadX 10944 1343 512 512
ReadX 10944 1286 512 512
ReadX 10944 1798 512 512
ReadX 10944 2310 512 512
ReadX 10944 2822 512 512
ReadX 10944 3334 512 512
ReadX 10944 3846 512 512
ReadX 10944 4358 512 512
ReadX 10944 4870 416 416
ReadX 10944 1270 96 96
ReadX 10944 1366 512 512
ReadX 10944 1878 512 512
ReadX 10944 2390 512 512
ReadX 10944 2902 512 512
ReadX 10944 3414 512 512
ReadX 10944 3926 416 416
ReadX 10944 1284 96 96
ReadX 10944 1380 416 416
ReadX 10944 1302 96 96
ReadX 10944 1398 512 512
ReadX 10944 1910 512 512
ReadX 10944 2422 512 512
ReadX 10944 2934 512 512
ReadX 10944 3446 512 512
ReadX 10944 3958 512 512
ReadX 10944 4470 512 512
ReadX 10944 4982 512 512
ReadX 10944 5494 512 512
ReadX 10944 6006 512 512
ReadX 10944 6518 512 512
ReadX 10944 7030 512 512
ReadX 10944 7542 512 512
ReadX 10944 1328 512 512
ReadX 10944 1330 512 512
ReadX 10944 1333 512 512
ReadX 10944 1845 512 512
ReadX 10944 2357 512 512
ReadX 10944 2869 512 512
ReadX 10944 3381 512 512
ReadX 10944 1344 512 512
ReadX 10944 1856 512 512
ReadX 10944 2368 512 512
ReadX 10944 2880 512 512
ReadX 10944 3392 512 512
ReadX 10944 3904 512 512
ReadX 10944 4416 512 512
ReadX 10944 4928 512 512
ReadX 10944 5440 512 512
ReadX 10944 5952 512 512
ReadX 10944 6464 512 512
ReadX 10944 6976 512 512
ReadX 10944 7488 512 512
ReadX 10944 8000 512 512
ReadX 10944 8512 512 512
ReadX 10944 9024 512 512
ReadX 10944 9536 512 512
ReadX 10944 10048 512 512
ReadX 10944 10560 512 512
ReadX 10944 11072 512 512
ReadX 10944 11584 426 426
ReadX 10944 1330 512 512
ReadX 10944 1842 512 512
ReadX 10944 1250 512 512
ReadX 10944 1264 268 268
ReadX 10944 1236 244 244
ReadX 10944 1250 512 512
ReadX 10944 1762 512 512
ReadX 10944 2274 512 512
ReadX 10944 2786 512 512
ReadX 10944 3298 512 512
ReadX 10944 3810 512 512
ReadX 10944 4322 512 512
ReadX 10944 1262 512 512
ReadX 10944 1263 512 512
ReadX 10944 1264 488 488
ReadX 10944 1236 24 24
ReadX 10944 1265 228 228
ReadX 10944 1236 284 284
ReadX 10944 1520 512 512
ReadX 10944 2032 512 512
ReadX 10944 2544 512 512
ReadX 10944 3056 512 512
ReadX 10944 3568 512 512
ReadX 10944 4080 512 512
ReadX 10944 4592 228 228
ReadX 10944 1266 284 284
ReadX 10944 1550 512 512
ReadX 10944 2062 42 42
ReadX 10944 1263 512 512
ReadX 10944 1538 512 512
ReadX 10944 1640 512 512
ReadX 10944 1510 512 512
ReadX 10944 2022 512 512
ReadX 10944 2534 512 512
ReadX 10944 3046 512 512
ReadX 10944 3558 512 512
ReadX 10944 4070 512 512
ReadX 10944 4582 512 512
ReadX 10944 5094 408 408
ReadX 10944 1496 104 104
ReadX 10944 1600 512 512
ReadX 10944 2112 512 512
ReadX 10944 2624 512 512
ReadX 10944 3136 512 512
ReadX 10944 3648 512 512
ReadX 10944 4160 512 512
ReadX 10944 4672 408 408
ReadX 10944 1526 104 104
ReadX 10944 1630 512 512
ReadX 10944 2142 512 512
ReadX 10944 2654 512 512
ReadX 10944 3166 512 512
ReadX 10944 3678 512 512
ReadX 10944 4190 408 408
ReadX 10944 1540 104 104
ReadX 10944 1644 512 512
ReadX 10944 2156 512 512
ReadX 10944 2668 512 512
ReadX 10944 3180 512 512
ReadX 10944 3692 512 512
ReadX 10944 4204 512 512
ReadX 10944 4716 512 512
ReadX 10944 5228 512 512
ReadX 10944 5740 512 512
ReadX 10944 6252 512 512
ReadX 10944 6764 512 512
ReadX 10944 7276 512 512
ReadX 10944 7788 512 512
ReadX 10944 8300 512 512
ReadX 10944 8812 512 512
ReadX 10944 9324 512 512
ReadX 10944 9836 512 512
ReadX 10944 10348 512 512
ReadX 10944 10860 512 512
ReadX 10944 11372 512 512
ReadX 10944 1615 512 512
ReadX 10944 2127 512 512
ReadX 10944 1617 512 512
ReadX 10944 1621 512 512
ReadX 10944 2133 512 512
ReadX 10944 2645 512 512
ReadX 10944 3157 512 512
ReadX 10944 3669 512 512
ReadX 10944 4181 512 512
ReadX 10944 4693 512 512
ReadX 10944 5205 512 512
ReadX 10944 5717 512 512
ReadX 10944 6229 512 512
ReadX 10944 1641 512 512
ReadX 10944 2153 512 512
ReadX 10944 2665 512 512
ReadX 10944 3177 512 512
ReadX 10944 3689 512 512
ReadX 10944 4201 512 512
ReadX 10944 4713 512 512
ReadX 10944 5225 512 512
ReadX 10944 5737 512 512
ReadX 10944 6249 512 512
ReadX 10944 6761 512 512
ReadX 10944 7273 512 512
ReadX 10944 7785 512 512
ReadX 10944 8297 512 512
ReadX 10944 8809 512 512
ReadX 10944 9321 512 512
ReadX 10944 9833 512 512
ReadX 10944 10345 512 512
ReadX 10944 10857 512 512
ReadX 10944 11369 512 512
ReadX 10944 11881 2 2
ReadX 10944 1796 510 510
ReadX 10944 2306 512 512
ReadX 10944 2818 512 512
ReadX 10944 3330 512 512
ReadX 10944 3842 512 512
ReadX 10944 4354 512 512
ReadX 10944 4866 512 512
ReadX 10944 5378 512 512
ReadX 10944 5890 512 512
ReadX 10944 6402 512 512
ReadX 10944 6914 512 512
ReadX 10944 7426 512 512
ReadX 10944 7938 512 512
ReadX 10944 8450 512 512
ReadX 10944 8962 512 512
ReadX 10944 9474 512 512
ReadX 10944 9986 512 512
ReadX 10944 10498 326 326
ReadX 10944 1617 512 512
ReadX 10944 2129 512 512
ReadX 10944 1450 512 512
ReadX 10944 1621 512 512
ReadX 10944 1446 512 512
ReadX 10944 1450 512 512
ReadX 10944 1962 512 512
ReadX 10944 2474 512 512
ReadX 10944 2986 512 512
ReadX 10944 3498 512 512
ReadX 10944 4010 512 512
ReadX 10944 4522 512 512
ReadX 10944 5034 424 424
ReadX 10944 1436 88 88
ReadX 10944 1524 512 512
ReadX 10944 2036 512 512
ReadX 10944 2548 512 512
ReadX 10944 3060 512 512
ReadX 10944 1442 512 512
ReadX 10944 1443 512 512
ReadX 10944 1444 512 512
ReadX 10944 1446 512 512
ReadX 10944 1958 386 386
ReadX 10944 1466 126 126
ReadX 10944 1592 512 512
ReadX 10944 2104 512 512
ReadX 10944 2616 512 512
ReadX 10944 3128 512 512
ReadX 10944 3640 512 512
ReadX 10944 4152 512 512
ReadX 10944 4664 512 512
ReadX 10944 5176 512 512
ReadX 10944 5688 512 512
ReadX 10944 6200 512 512
ReadX 10944 6712 512 512
ReadX 10944 7224 512 512
ReadX 10944 7736 512 512
ReadX 10944 8248 512 512
ReadX 10944 8760 294 294
ReadX 10944 1443 512 512
ReadX 10944 964 512 512
ReadX 10944 970 512 512
ReadX 10944 1482 512 512
ReadX 10944 1994 512 512
ReadX 10944 2506 512 512
ReadX 10944 3018 512 512
ReadX 10944 3530 512 512
ReadX 10944 4042 512 512
ReadX 10944 4554 424 424
ReadX 10944 956 88 88
ReadX 10944 1044 512 512
ReadX 10944 1556 512 512
ReadX 10944 2068 512 512
ReadX 10944 2580 512 512
ReadX 10944 962 512 512
ReadX 10944 963 512 512
ReadX 10944 964 512 512
ReadX 10944 965 512 512
ReadX 10944 1477 512 512
ReadX 10944 1989 228 228
ReadX 10944 986 284 284
ReadX 10944 1270 512 512
ReadX 10944 1782 512 512
ReadX 10944 2294 512 512
ReadX 10944 2806 512 512
ReadX 10944 3318 512 512
ReadX 10944 3830 512 512
ReadX 10944 4342 512 512
ReadX 10944 4854 512 512
ReadX 10944 5366 512 512
ReadX 10944 5878 512 512
ReadX 10944 6390 512 512
ReadX 10944 6902 512 512
ReadX 10944 7414 42 42
ReadX 10944 963 512 512
ReadX 10944 2610 512 512
ReadX 10944 3812 512 512
ReadX 10944 3828 512 512
ReadX 10944 3969 512 512
ReadX 10944 3918 512 512
ReadX 10944 4430 512 512
ReadX 10944 4942 512 512
ReadX 10944 5454 512 512
ReadX 10944 5966 512 512
ReadX 10944 6478 512 512
ReadX 10944 6990 512 512
ReadX 10944 7502 424 424
ReadX 10944 3904 88 88
ReadX 10944 3992 512 512
ReadX 10944 4504 512 512
ReadX 10944 5016 512 512
ReadX 10944 5528 512 512
ReadX 10944 6040 512 512
ReadX 10944 6552 512 512
ReadX 10944 7064 424 424
ReadX 10944 3934 88 88
ReadX 10944 4022 512 512
ReadX 10944 4534 512 512
ReadX 10944 5046 512 512
ReadX 10944 5558 512 512
ReadX 10944 6070 512 512
ReadX 10944 6582 512 512
ReadX 10944 7094 512 512
ReadX 10944 7606 512 512
ReadX 10944 8118 512 512
ReadX 10944 8630 512 512
ReadX 10944 3953 512 512
ReadX 10944 4465 512 512
ReadX 10944 3956 512 512
ReadX 10944 3964 512 512
ReadX 10944 4476 512 512
ReadX 10944 4988 512 512
ReadX 10944 3970 512 512
ReadX 10944 4482 512 512
ReadX 10944 4994 512 512
ReadX 10944 5506 512 512
ReadX 10944 6018 512 512
ReadX 10944 6530 512 512
ReadX 10944 7042 512 512
ReadX 10944 7554 512 512
ReadX 10944 8066 512 512
ReadX 10944 8578 512 512
ReadX 10944 9090 512 512
ReadX 10944 9602 512 512
ReadX 10944 10114 512 512
ReadX 10944 10626 512 512
ReadX 10944 11138 512 512
ReadX 10944 11650 512 512
ReadX 10944 12162 512 512
ReadX 10944 12674 512 512
ReadX 10944 13186 512 512
ReadX 10944 13698 512 512
ReadX 10944 14210 134 134
ReadX 10944 3956 512 512
ReadX 10944 4468 512 512
ReadX 10944 4980 512 512
ReadX 10944 5492 512 512
ReadX 10944 3074 512 512
ReadX 10944 3246 512 512
ReadX 10944 3964 512 512
ReadX 10944 3330 512 512
ReadX 10944 3465 512 512
ReadX 10944 3246 512 512
ReadX 10944 3758 512 512
ReadX 10944 4270 512 512
ReadX 10944 4782 512 512
ReadX 10944 5294 512 512
ReadX 10944 5806 512 512
ReadX 10944 6318 512 512
ReadX 10944 6830 368 368
ReadX 10944 3232 144 144
ReadX 10944 3376 512 512
ReadX 10944 3888 512 512
ReadX 10944 4400 512 512
ReadX 10944 4912 512 512
ReadX 10944 5424 512 512
ReadX 10944 5936 512 512
ReadX 10944 6448 368 368
ReadX 10944 3262 144 144
ReadX 10944 3406 512 512
ReadX 10944 3918 512 512
ReadX 10944 4430 512 512
ReadX 10944 4942 512 512
ReadX 10944 5454 512 512
ReadX 10944 5966 512 512
ReadX 10944 6478 512 512
ReadX 10944 6990 512 512
ReadX 10944 7502 512 512
ReadX 10944 8014 512 512
ReadX 10944 8526 512 512
ReadX 10944 9038 512 512
ReadX 10944 9550 512 512
ReadX 10944 10062 512 512
ReadX 10944 10574 512 512
ReadX 10944 11086 512 512
ReadX 10944 11598 512 512
ReadX 10944 12110 512 512
ReadX 10944 12622 512 512
ReadX 10944 13134 512 512
ReadX 10944 13646 368 368
ReadX 10944 3332 144 144
ReadX 10944 3476 512 512
ReadX 10944 3988 512 512
ReadX 10944 4500 512 512
ReadX 10944 5012 512 512
ReadX 10944 5524 512 512
ReadX 10944 6036 512 512
ReadX 10944 6548 512 512
ReadX 10944 7060 512 512
ReadX 10944 7572 512 512
ReadX 10944 8084 512 512
ReadX 10944 8596 512 512
ReadX 10944 9108 512 512
ReadX 10944 9620 512 512
ReadX 10944 10132 512 512
ReadX 10944 10644 512 512
ReadX 10944 11156 512 512
ReadX 10944 11668 512 512
ReadX 10944 12180 512 512
ReadX 10944 12692 512 512
ReadX 10944 13204 512 512
ReadX 10944 3430 512 512
ReadX 10944 3942 512 512
ReadX 10944 3434 512 512
ReadX 10944 3435 512 512
ReadX 10944 3947 512 512
ReadX 10944 4459 512 512
ReadX 10944 4971 512 512
ReadX 10944 5483 512 512
ReadX 10944 5995 512 512
ReadX 10944 6507 512 512
ReadX 10944 7019 512 512
ReadX 10944 7531 512 512
ReadX 10944 8043 512 512
ReadX 10944 8555 512 512
ReadX 10944 9067 512 512
ReadX 10944 9579 512 512
ReadX 10944 10091 512 512
ReadX 10944 10603 512 512
ReadX 10944 11115 512 512
ReadX 10944 3467 512 512
ReadX 10944 3979 512 512
ReadX 10944 4491 512 512
ReadX 10944 5003 512 512
ReadX 10944 5515 512 512
ReadX 10944 6027 512 512
ReadX 10944 6539 512 512
ReadX 10944 7051 512 512
ReadX 10944 7563 512 512
ReadX 10944 8075 512 512
ReadX 10944 8587 512 512
ReadX 10944 9099 512 512
ReadX 10944 9611 512 512
ReadX 10944 10123 512 512
ReadX 10944 10635 512 512
ReadX 10944 11147 512 512
ReadX 10944 11659 512 512
ReadX 10944 12171 512 512
ReadX 10944 12683 512 512
ReadX 10944 13195 512 512
ReadX 10944 13707 56 56
ReadX 10944 13763 512 512
ReadX 10944 14275 456 456
ReadX 10944 14731 512 512
ReadX 10944 15243 512 512
ReadX 10944 15755 512 512
ReadX 10944 16267 512 512
ReadX 10944 16779 512 512
ReadX 10944 17291 512 512
ReadX 10944 17803 512 512
ReadX 10944 18315 512 512
ReadX 10944 18827 512 512
ReadX 10944 19339 512 512
ReadX 10944 19851 512 512
ReadX 10944 20363 512 512
ReadX 10944 20875 512 512
ReadX 10944 21387 512 512
ReadX 10944 21899 512 512
ReadX 10944 22411 512 512
ReadX 10944 22923 512 512
ReadX 10944 23435 512 512
ReadX 10944 23947 512 512
ReadX 10944 24459 512 512
ReadX 10944 24971 282 282
ReadX 10944 3434 512 512
ReadX 10944 2818 512 512
ReadX 10944 2870 512 512
ReadX 10944 3026 512 512
ReadX 10944 3538 512 512
ReadX 10944 2870 512 512
ReadX 10944 3382 512 512
ReadX 10944 3894 512 512
ReadX 10944 4406 512 512
ReadX 10944 4918 512 512
ReadX 10944 5430 512 512
ReadX 10944 5942 512 512
ReadX 10944 6454 374 374
ReadX 10944 2856 138 138
ReadX 10944 2994 512 512
ReadX 10944 3506 512 512
ReadX 10944 4018 512 512
ReadX 10944 4530 512 512
ReadX 10944 5042 512 512
ReadX 10944 5554 512 512
ReadX 10944 6066 374 374
ReadX 10944 2886 138 138
ReadX 10944 3024 512 512
ReadX 10944 3536 512 512
ReadX 10944 4048 512 512
ReadX 10944 4560 512 512
ReadX 10944 5072 512 512
ReadX 10944 5584 512 512
ReadX 10944 6096 512 512
ReadX 10944 6608 512 512
ReadX 10944 7120 512 512
ReadX 10944 7632 512 512
ReadX 10944 8144 512 512
ReadX 10944 8656 512 512
ReadX 10944 9168 512 512
ReadX 10944 9680 512 512
ReadX 10944 10192 512 512
ReadX 10944 10704 512 512
ReadX 10944 11216 512 512
ReadX 10944 11728 512 512
ReadX 10944 12240 512 512
ReadX 10944 12752 512 512
QUERY_FS_INFORMATION 259
ReadX 10944 13264 512 512
ReadX 10944 13776 512 512
ReadX 10944 14288 512 512
ReadX 10944 14800 512 512
ReadX 10944 15312 512 512
ReadX 10944 15824 512 512
ReadX 10944 16336 512 512
ReadX 10944 16848 512 512
ReadX 10944 17360 512 512
ReadX 10944 17872 512 512
ReadX 10944 18384 512 512
ReadX 10944 18896 512 512
ReadX 10944 19408 512 512
ReadX 10944 19920 512 512
ReadX 10944 20432 512 512
ReadX 10944 20944 512 512
ReadX 10944 21456 512 512
ReadX 10944 21968 512 512
ReadX 10944 22480 512 512
ReadX 10944 22992 512 512
ReadX 10944 2998 512 512
ReadX 10944 3510 512 512
ReadX 10944 3001 512 512
ReadX 10944 3003 512 512
ReadX 10944 3515 512 512
ReadX 10944 4027 512 512
ReadX 10944 4539 512 512
ReadX 10944 5051 512 512
ReadX 10944 5563 512 512
ReadX 10944 6075 512 512
ReadX 10944 6587 512 512
ReadX 10944 7099 512 512
ReadX 10944 7611 512 512
ReadX 10944 8123 512 512
ReadX 10944 8635 512 512
ReadX 10944 3029 512 512
ReadX 10944 3541 512 512
ReadX 10944 4053 512 512
ReadX 10944 4565 512 512
ReadX 10944 5077 512 512
ReadX 10944 5589 512 512
ReadX 10944 6101 512 512
ReadX 10944 6613 512 512
ReadX 10944 7125 512 512
ReadX 10944 7637 512 512
ReadX 10944 8149 512 512
ReadX 10944 8661 512 512
ReadX 10944 9173 512 512
ReadX 10944 9685 512 512
ReadX 10944 10197 512 512
ReadX 10944 10709 512 512
ReadX 10944 11221 512 512
ReadX 10944 11733 512 512
ReadX 10944 12245 512 512
ReadX 10944 12757 512 512
ReadX 10944 13269 40 40
ReadX 10944 3076 472 472
ReadX 10944 3548 512 512
ReadX 10944 4060 512 512
ReadX 10944 4572 512 512
ReadX 10944 5084 512 512
ReadX 10944 5596 512 512
ReadX 10944 6108 512 512
ReadX 10944 6620 512 512
ReadX 10944 7132 512 512
ReadX 10944 7644 512 512
ReadX 10944 8156 512 512
ReadX 10944 8668 512 512
ReadX 10944 9180 512 512
ReadX 10944 9692 512 512
ReadX 10944 10204 512 512
ReadX 10944 10716 512 512
ReadX 10944 11228 512 512
ReadX 10944 11740 512 512
ReadX 10944 12252 512 512
ReadX 10944 12764 512 512
ReadX 10944 13276 310 310
ReadX 10944 3001 512 512
ReadX 10944 2562 512 512
ReadX 10944 2626 512 512
ReadX 10944 3003 512 512
ReadX 10944 2721 512 512
ReadX 10944 2626 512 512
ReadX 10944 3138 512 512
ReadX 10944 3650 512 512
ReadX 10944 4162 512 512
ReadX 10944 4674 512 512
ReadX 10944 5186 512 512
ReadX 10944 5698 512 512
ReadX 10944 6210 424 424
ReadX 10944 2612 88 88
ReadX 10944 2700 512 512
ReadX 10944 3212 512 512
ReadX 10944 3724 512 512
ReadX 10944 4236 512 512
ReadX 10944 4748 512 512
ReadX 10944 5260 512 512
ReadX 10944 5772 424 424
ReadX 10944 2642 88 88
ReadX 10944 2730 512 512
ReadX 10944 3242 512 512
ReadX 10944 3754 512 512
ReadX 10944 4266 512 512
ReadX 10944 4778 512 512
ReadX 10944 5290 512 512
ReadX 10944 5802 512 512
ReadX 10944 6314 512 512
ReadX 10944 6826 512 512
ReadX 10944 7338 512 512
ReadX 10944 7850 512 512
ReadX 10944 8362 512 512
ReadX 10944 8874 512 512
ReadX 10944 9386 512 512
ReadX 10944 9898 512 512
ReadX 10944 10410 512 512
ReadX 10944 10922 512 512
ReadX 10944 11434 512 512
ReadX 10944 11946 512 512
ReadX 10944 12458 512 512
ReadX 10944 2716 512 512
ReadX 10944 2717 512 512
ReadX 10944 2718 512 512
ReadX 10944 3230 512 512
ReadX 10944 2721 512 512
ReadX 10944 3233 512 512
ReadX 10944 3745 512 512
ReadX 10944 4257 512 512
ReadX 10944 4769 512 512
ReadX 10944 5281 512 512
ReadX 10944 5793 512 512
ReadX 10944 6305 512 512
ReadX 10944 6817 512 512
ReadX 10944 7329 512 512
ReadX 10944 7841 512 512
ReadX 10944 8353 512 512
ReadX 10944 8865 512 512
ReadX 10944 9377 512 512
ReadX 10944 9889 512 512
ReadX 10944 10401 512 512
ReadX 10944 10913 512 512
ReadX 10944 11425 512 512
ReadX 10944 11937 512 512
ReadX 10944 12449 512 512
ReadX 10944 12961 512 512
ReadX 10944 13473 512 512
ReadX 10944 13985 106 106
ReadX 10944 2820 406 406
ReadX 10944 3226 512 512
ReadX 10944 3738 512 512
ReadX 10944 4250 512 512
ReadX 10944 4762 512 512
ReadX 10944 5274 512 512
ReadX 10944 5786 512 512
ReadX 10944 6298 512 512
ReadX 10944 6810 512 512
ReadX 10944 7322 512 512
ReadX 10944 7834 512 512
ReadX 10944 8346 512 512
ReadX 10944 8858 512 512
ReadX 10944 9370 512 512
ReadX 10944 9882 512 512
ReadX 10944 10394 512 512
ReadX 10944 10906 512 512
ReadX 10944 11418 182 182
ReadX 10944 2717 512 512
ReadX 10944 258 512 512
ReadX 10944 470 512 512
ReadX 10944 376 512 512
ReadX 10944 888 512 512
ReadX 10944 1400 512 512
ReadX 10944 1912 512 512
ReadX 10944 2424 512 512
ReadX 10944 2936 512 512
ReadX 10944 3448 512 512
ReadX 10944 3960 424 424
ReadX 10944 362 88 88
ReadX 10944 450 512 512
ReadX 10944 962 512 512
ReadX 10944 1474 512 512
ReadX 10944 1986 512 512
ReadX 10944 2498 512 512
ReadX 10944 3010 512 512
ReadX 10944 3522 424 424
ReadX 10944 392 88 88
ReadX 10944 480 512 512
ReadX 10944 992 512 512
ReadX 10944 1504 512 512
ReadX 10944 2016 512 512
ReadX 10944 2528 512 512
ReadX 10944 3040 512 512
ReadX 10944 3552 512 512
ReadX 10944 4064 512 512
ReadX 10944 4576 512 512
ReadX 10944 5088 512 512
ReadX 10944 5600 512 512
ReadX 10944 6112 512 512
ReadX 10944 6624 512 512
ReadX 10944 7136 512 512
ReadX 10944 7648 512 512
ReadX 10944 8160 512 512
ReadX 10944 8672 512 512
ReadX 10944 9184 512 512
ReadX 10944 9696 512 512
ReadX 10944 10208 512 512
ReadX 10944 464 512 512
ReadX 10944 465 512 512
ReadX 10944 466 512 512
ReadX 10944 978 512 512
ReadX 10944 470 512 512
ReadX 10944 982 512 512
ReadX 10944 1494 512 512
ReadX 10944 2006 512 512
ReadX 10944 2518 512 512
ReadX 10944 3030 512 512
ReadX 10944 3542 512 512
ReadX 10944 4054 512 512
ReadX 10944 4566 512 512
ReadX 10944 5078 512 512
ReadX 10944 5590 512 512
ReadX 10944 6102 512 512
ReadX 10944 6614 512 512
ReadX 10944 7126 512 512
ReadX 10944 7638 512 512
ReadX 10944 8150 512 512
ReadX 10944 8662 512 512
ReadX 10944 9174 512 512
ReadX 10944 9686 512 512
ReadX 10944 10198 512 512
ReadX 10944 10710 333 333
ReadX 10944 11043 512 512
ReadX 10944 11555 179 179
ReadX 10944 11734 512 512
ReadX 10944 12246 512 512
ReadX 10944 12758 512 512
ReadX 10944 13270 512 512
ReadX 10944 13782 512 512
ReadX 10944 14294 512 512
ReadX 10944 14806 512 512
ReadX 10944 15318 512 512
ReadX 10944 15830 512 512
ReadX 10944 16342 512 512
ReadX 10944 16854 512 512
ReadX 10944 17366 512 512
ReadX 10944 17878 512 512
ReadX 10944 18390 512 512
ReadX 10944 18902 512 512
ReadX 10944 19414 512 512
ReadX 10944 19926 512 512
ReadX 10944 20438 512 512
ReadX 10944 20950 512 512
ReadX 10944 21462 512 512
ReadX 10944 21974 350 350
ReadX 10944 465 512 512
ReadX 10944 3812 512 512
ReadX 10944 4046 512 512
ReadX 10944 3828 512 512
ReadX 10944 256 512 512
ReadX 10944 260 512 512
ReadX 10944 4066 512 512
ReadX 10944 4578 512 512
ReadX 10944 5090 512 512
ReadX 10944 5602 512 512
ReadX 10944 6114 512 512
ReadX 10944 6626 512 512
ReadX 10944 7138 512 512
ReadX 10944 7650 394 394
ReadX 10944 4052 118 118
ReadX 10944 4170 512 512
ReadX 10944 4682 512 512
ReadX 10944 5194 512 512
ReadX 10944 5706 512 512
ReadX 10944 6218 512 512
ReadX 10944 6730 512 512
ReadX 10944 7242 394 394
ReadX 10944 4082 118 118
ReadX 10944 4200 512 512
ReadX 10944 4712 512 512
ReadX 10944 5224 512 512
ReadX 10944 5736 512 512
ReadX 10944 6248 512 512
ReadX 10944 6760 512 512
ReadX 10944 7272 512 512
ReadX 10944 7784 394 394
ReadX 10944 256 118 118
ReadX 10944 374 512 512
ReadX 10944 886 512 512
ReadX 10944 1398 512 512
ReadX 10944 1910 512 512
ReadX 10944 2422 512 512
ReadX 10944 2934 512 512
ReadX 10944 3446 512 512
ReadX 10944 3958 512 512
ReadX 10944 4470 512 512
ReadX 10944 4982 512 512
ReadX 10944 5494 512 512
ReadX 10944 6006 512 512
ReadX 10944 6518 512 512
ReadX 10944 7030 512 512
ReadX 10944 7542 512 512
ReadX 10944 8054 512 512
ReadX 10944 8566 512 512
ReadX 10944 9078 512 512
ReadX 10944 9590 512 512
ReadX 10944 10102 512 512
ReadX 10944 259 512 512
ReadX 10944 771 512 512
ReadX 10944 259 512 512
ReadX 10944 259 512 512
ReadX 10944 771 512 512
ReadX 10944 1283 512 512
ReadX 10944 1795 512 512
ReadX 10944 2307 512 512
ReadX 10944 2819 512 512
ReadX 10944 3331 512 512
ReadX 10944 3843 512 512
ReadX 10944 4355 512 512
ReadX 10944 4867 512 512
ReadX 10944 260 512 512
ReadX 10944 772 512 512
ReadX 10944 1284 512 512
ReadX 10944 1796 512 512
ReadX 10944 2308 512 512
ReadX 10944 2820 512 512
ReadX 10944 3332 512 512
ReadX 10944 3844 512 512
ReadX 10944 4356 512 512
ReadX 10944 4868 512 512
ReadX 10944 5380 512 512
ReadX 10944 5892 512 512
ReadX 10944 6404 512 512
ReadX 10944 6916 512 512
ReadX 10944 7428 512 512
ReadX 10944 7940 512 512
ReadX 10944 8452 512 512
ReadX 10944 8964 512 512
ReadX 10944 9476 512 512
ReadX 10944 9988 512 512
ReadX 10944 10500 378 378
ReadX 10944 10878 512 512
ReadX 10944 11390 134 134
ReadX 10944 11524 512 512
ReadX 10944 12036 512 512
ReadX 10944 12548 512 512
ReadX 10944 13060 512 512
ReadX 10944 13572 138 138
ReadX 10944 259 512 512
ReadX 10944 273 512 512
ReadX 10944 276 512 512
ReadX 10944 295 512 512
ReadX 10944 288 512 512
ReadX 10944 296 512 512
ReadX 10944 259 512 512
ReadX 10944 273 512 512
ReadX 10944 273 512 512
ReadX 10944 785 512 512
ReadX 10944 1297 512 512
ReadX 10944 1809 512 512
ReadX 10944 2321 512 512
ReadX 10944 274 512 512
ReadX 10944 274 512 512
ReadX 10944 274 497 497
ReadX 10944 272 15 15
ReadX 10944 287 512 512
ReadX 10944 799 512 512
ReadX 10944 273 512 512
ReadX 10944 785 512 512
ReadX 10944 1297 512 512
ReadX 10944 1809 512 512
ReadX 10944 2321 512 512
ReadX 10944 2833 317 317
ReadX 10944 274 195 195
ReadX 10944 469 512 512
ReadX 10944 981 512 512
ReadX 10944 1493 512 512
ReadX 10944 2005 512 512
ReadX 10944 2517 512 512
ReadX 10944 3029 512 512
ReadX 10944 3541 512 512
ReadX 10944 4053 512 512
ReadX 10944 4565 250 250
ReadX 10944 274 512 512
ReadX 10944 283 512 512
ReadX 10944 795 512 512
ReadX 10944 276 512 512
ReadX 10944 788 512 512
ReadX 10944 1300 512 512
ReadX 10944 1812 512 512
ReadX 10944 2324 512 512
ReadX 10944 2836 512 512
ReadX 10944 3348 512 512
ReadX 10944 3860 420 420
ReadX 10944 275 92 92
ReadX 10944 367 512 512
ReadX 10944 879 512 512
ReadX 10944 1391 512 512
ReadX 10944 1903 512 512
ReadX 10944 2415 512 512
ReadX 10944 2927 512 512
ReadX 10944 3439 420 420
ReadX 10944 277 92 92
ReadX 10944 369 512 512
ReadX 10944 881 512 512
ReadX 10944 1393 512 512
ReadX 10944 1905 512 512
ReadX 10944 2417 512 512
ReadX 10944 2929 512 512
ReadX 10944 3441 512 512
ReadX 10944 3953 512 512
ReadX 10944 4465 512 512
ReadX 10944 4977 512 512
ReadX 10944 5489 512 512
ReadX 10944 6001 512 512
ReadX 10944 6513 512 512
ReadX 10944 7025 512 512
ReadX 10944 7537 512 512
ReadX 10944 8049 512 512
ReadX 10944 8561 512 512
ReadX 10944 9073 512 512
ReadX 10944 9585 512 512
ReadX 10944 10097 512 512
ReadX 10944 282 512 512
ReadX 10944 794 512 512
ReadX 10944 1306 512 512
ReadX 10944 1818 512 512
ReadX 10944 2330 512 512
ReadX 10944 2842 512 512
ReadX 10944 3354 512 512
ReadX 10944 3866 512 512
ReadX 10944 4378 512 512
ReadX 10944 284 512 512
ReadX 10944 796 512 512
ReadX 10944 1308 512 512
ReadX 10944 1820 512 512
ReadX 10944 2332 512 512
ReadX 10944 2844 512 512
ReadX 10944 3356 512 512
ReadX 10944 3868 512 512
ReadX 10944 4380 512 512
ReadX 10944 4892 512 512
ReadX 10944 5404 512 512
ReadX 10944 5916 512 512
ReadX 10944 6428 512 512
ReadX 10944 6940 512 512
ReadX 10944 7452 512 512
ReadX 10944 7964 512 512
ReadX 10944 8476 512 512
ReadX 10944 8988 512 512
ReadX 10944 9500 512 512
ReadX 10944 10012 512 512
ReadX 10944 10524 472 472
ReadX 10944 288 40 40
ReadX 10944 328 512 512
ReadX 10944 840 512 512
ReadX 10944 1352 512 512
ReadX 10944 1864 512 512
ReadX 10944 2376 512 512
ReadX 10944 2888 512 512
ReadX 10944 3400 512 512
ReadX 10944 3912 512 512
ReadX 10944 4424 512 512
ReadX 10944 4936 512 512
ReadX 10944 5448 512 512
ReadX 10944 5960 512 512
ReadX 10944 6472 512 512
ReadX 10944 6984 512 512
ReadX 10944 7496 512 512
ReadX 10944 8008 512 512
ReadX 10944 8520 512 512
ReadX 10944 9032 512 512
ReadX 10944 9544 512 512
ReadX 10944 10056 512 512
ReadX 10944 10568 506 506
ReadX 10944 282 512 512
ReadX 10944 794 512 512
ReadX 10944 301 512 512
ReadX 10944 296 512 512
ReadX 10944 808 512 512
ReadX 10944 1320 512 512
ReadX 10944 1832 512 512
ReadX 10944 2344 512 512
ReadX 10944 2856 512 512
ReadX 10944 3368 512 512
ReadX 10944 3880 424 424
ReadX 10944 295 88 88
ReadX 10944 383 512 512
ReadX 10944 895 512 512
ReadX 10944 1407 512 512
ReadX 10944 1919 512 512
ReadX 10944 2431 512 512
ReadX 10944 2943 512 512
ReadX 10944 3455 424 424
ReadX 10944 297 88 88
ReadX 10944 385 512 512
ReadX 10944 897 512 512
ReadX 10944 1409 512 512
ReadX 10944 1921 512 512
ReadX 10944 2433 512 512
ReadX 10944 2945 512 512
ReadX 10944 3457 512 512
ReadX 10944 3969 512 512
ReadX 10944 4481 512 512
ReadX 10944 4993 512 512
ReadX 10944 5505 512 512
ReadX 10944 6017 512 512
ReadX 10944 6529 512 512
ReadX 10944 7041 512 512
ReadX 10944 7553 512 512
ReadX 10944 8065 512 512
ReadX 10944 8577 512 512
ReadX 10944 9089 512 512
ReadX 10944 9601 512 512
ReadX 10944 10113 512 512
ReadX 10944 301 512 512
ReadX 10944 301 512 512
ReadX 10944 301 512 512
ReadX 10944 813 512 512
ReadX 10944 301 512 512
ReadX 10944 813 512 512
ReadX 10944 1325 512 512
ReadX 10944 1837 512 512
ReadX 10944 2349 512 512
ReadX 10944 2861 512 512
ReadX 10944 3373 512 512
ReadX 10944 3885 512 512
ReadX 10944 4397 512 512
ReadX 10944 4909 512 512
ReadX 10944 5421 512 512
ReadX 10944 5933 512 512
ReadX 10944 6445 512 512
ReadX 10944 6957 512 512
ReadX 10944 7469 512 512
ReadX 10944 7981 512 512
ReadX 10944 8493 512 512
ReadX 10944 9005 512 512
ReadX 10944 9517 463 463
ReadX 10944 9980 512 512
ReadX 10944 10492 49 49
ReadX 10944 10541 512 512
ReadX 10944 11053 512 512
ReadX 10944 11565 512 512
ReadX 10944 12077 512 512
ReadX 10944 12589 512 512
ReadX 10944 13101 512 512
ReadX 10944 13613 512 512
ReadX 10944 14125 512 512
ReadX 10944 14637 512 512
ReadX 10944 15149 512 512
ReadX 10944 15661 512 512
ReadX 10944 16173 512 512
ReadX 10944 16685 512 512
ReadX 10944 17197 512 512
ReadX 10944 17709 512 512
ReadX 10944 18221 512 512
ReadX 10944 18733 512 512
ReadX 10944 19245 512 512
ReadX 10944 19757 512 512
ReadX 10944 20269 512 512
ReadX 10944 20781 326 326
ReadX 10944 301 512 512
QUERY_FS_INFORMATION 259
Close 10942
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10945
Close 10945
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10946
ReadX 10946 0 24 24
Close 10946
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10947
QUERY_FILE_INFORMATION 10947
ReadX 10947 0 512 512
ReadX 10947 476 512 512
ReadX 10947 510 512 512
ReadX 10947 484 512 512
ReadX 10947 474 512 512
ReadX 10947 478 512 512
ReadX 10947 990 512 512
ReadX 10947 509 57 57
Close 10947
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10948
QUERY_FILE_INFORMATION 10948
ReadX 10948 0 512 512
ReadX 10948 476 512 512
ReadX 10948 510 512 512
ReadX 10948 484 512 512
ReadX 10948 480 512 512
ReadX 10948 474 512 512
ReadX 10948 478 512 512
QUERY_FILE_INFORMATION 10948
WriteX 10948 494 60 60
WriteX 10948 494 4 4
QUERY_FILE_INFORMATION 10948
WriteX 10948 494 11 11
WriteX 10948 510 512 512
WriteX 10948 484 512 512
WriteX 10948 474 512 512
WriteX 10948 478 512 512
WriteX 10948 990 512 512
Close 10948
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x2 10949
Close 10949
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x200000 0x1 10950
Close 10950
Rename \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10952
WriteX 10952 4607 1 1
QUERY_FILE_INFORMATION 10952
WriteX 10952 0 65471 65471
WriteX 10952 65471 65 65
WriteX 10952 65536 19490 19490
Close 10952
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10953
QUERY_FILE_INFORMATION 10953
ReadX 10953 0 512 512
ReadX 10953 482 512 512
ReadX 10953 994 512 512
ReadX 10953 1506 512 512
ReadX 10953 480 512 512
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 490 448 448
QUERY_FILE_INFORMATION 10953
WriteX 10953 490 60 60
WriteX 10953 490 4 4
QUERY_FILE_INFORMATION 10953
WriteX 10953 490 11 11
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 484 512 512
WriteX 10953 996 512 512
WriteX 10953 1508 512 512
WriteX 10953 482 512 512
WriteX 10953 0 512 512
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
ReadX 10953 490 512 512
WriteX 10953 502 512 512
WriteX 10953 502 292 292
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 503 20 20
WriteX 10953 503 108 108
QUERY_FILE_INFORMATION 10953
WriteX 10953 504 448 448
QUERY_FILE_INFORMATION 10953
WriteX 10953 504 44 44
WriteX 10953 504 20 20
WriteX 10953 500 512 512
WriteX 10953 492 512 512
WriteX 10953 496 512 512
WriteX 10953 1008 512 512
WriteX 10953 494 512 512
Flush 10953
WriteX 10953 0 512 512
Flush 10953
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 500 512 512
WriteX 10953 492 512 512
WriteX 10953 496 512 512
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 518 320 320
QUERY_FILE_INFORMATION 10953
WriteX 10953 518 60 60
ReadX 10953 504 512 512
WriteX 10953 522 512 512
WriteX 10953 506 3204 3204
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 519 25 25
WriteX 10953 518 103 103
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 519 44 44
WriteX 10953 519 20 20
WriteX 10953 520 512 512
WriteX 10953 482 512 512
WriteX 10953 486 512 512
WriteX 10953 998 512 512
WriteX 10953 484 512 512
WriteX 10953 490 512 512
Flush 10953
WriteX 10953 0 512 512
Flush 10953
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
QUERY_FILE_INFORMATION 10953
WriteX 10953 519 7 7
WriteX 10953 519 57 57
WriteX 10953 520 512 512
WriteX 10953 492 512 512
WriteX 10953 482 512 512
WriteX 10953 486 512 512
WriteX 10953 998 512 512
Flush 10953
WriteX 10953 520 512 512
Flush 10953
Close 10953
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10954
Close 10954
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x1 10955
QUERY_FILE_INFORMATION 10955
ReadX 10955 0 512 512
ReadX 10955 490 512 512
ReadX 10955 484 512 512
ReadX 10955 520 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP 0x40 0x1 10956
Close 10956
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC112.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10955
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10957
Close 10957
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10958
ReadX 10958 0 24 24
Close 10958
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10959
QUERY_FILE_INFORMATION 10959
ReadX 10959 0 512 512
ReadX 10959 366 512 512
ReadX 10959 878 512 512
ReadX 10959 1390 512 512
ReadX 10959 1902 512 512
ReadX 10959 374 57 57
Close 10959
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10960
QUERY_FILE_INFORMATION 10960
ReadX 10960 0 512 512
ReadX 10960 366 512 512
ReadX 10960 878 512 512
ReadX 10960 1390 512 512
ReadX 10960 1902 512 512
QUERY_FILE_INFORMATION 10960
WriteX 10960 374 60 60
WriteX 10960 374 4 4
QUERY_FILE_INFORMATION 10960
WriteX 10960 374 11 11
ReadX 10960 374 57 57
ReadX 10960 374 57 57
ReadX 10960 292 4096 4096
ReadX 10960 364 512 512
ReadX 10960 512 4096 4096
ReadX 10960 4608 4096 4096
ReadX 10960 8704 4096 4096
ReadX 10960 12800 4096 4096
ReadX 10960 16896 4096 4096
ReadX 10960 20992 4096 4096
ReadX 10960 25088 4096 4096
ReadX 10960 29184 4096 4096
ReadX 10960 33280 4096 4096
ReadX 10960 37376 4096 4096
ReadX 10960 41472 4096 4096
ReadX 10960 45568 4096 4096
ReadX 10960 49664 4096 4096
ReadX 10960 53760 4096 4096
ReadX 10960 57856 4096 4096
ReadX 10960 61952 4096 4096
ReadX 10960 66048 4096 4096
ReadX 10960 70144 4096 4096
ReadX 10960 74240 162 162
ReadX 10960 308 4096 4096
ReadX 10960 4404 4096 4096
WriteX 10960 368 512 512
WriteX 10960 880 512 512
WriteX 10960 1392 512 512
Close 10960
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10961
Close 10961
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10962
QUERY_FILE_INFORMATION 10962
ReadX 10962 0 512 512
ReadX 10962 366 512 512
ReadX 10962 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10963
Close 10963
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10962
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10965
WriteX 10965 4607 1 1
QUERY_FILE_INFORMATION 10965
WriteX 10965 0 65471 65471
WriteX 10965 65471 65 65
WriteX 10965 65536 8866 8866
Close 10965
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10966
QUERY_FILE_INFORMATION 10966
ReadX 10966 0 512 512
ReadX 10966 366 512 512
ReadX 10966 878 512 512
ReadX 10966 1390 512 512
ReadX 10966 364 512 512
QUERY_FILE_INFORMATION 10966
QUERY_FILE_INFORMATION 10966
QUERY_FILE_INFORMATION 10966
WriteX 10966 374 448 448
QUERY_FILE_INFORMATION 10966
WriteX 10966 374 60 60
WriteX 10966 374 4 4
QUERY_FILE_INFORMATION 10966
WriteX 10966 374 11 11
QUERY_FILE_INFORMATION 10966
QUERY_FILE_INFORMATION 10966
WriteX 10966 374 7 7
WriteX 10966 374 57 57
WriteX 10966 368 512 512
WriteX 10966 880 512 512
WriteX 10966 1392 512 512
WriteX 10966 366 512 512
WriteX 10966 0 512 512
Flush 10966
WriteX 10966 368 512 512
Flush 10966
Close 10966
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10967
QUERY_FILE_INFORMATION 10967
ReadX 10967 0 512 512
ReadX 10967 366 512 512
ReadX 10967 878 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10967
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10968
Close 10968
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10969
ReadX 10969 0 24 24
Close 10969
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10970
QUERY_FILE_INFORMATION 10970
ReadX 10970 0 512 512
ReadX 10970 366 512 512
ReadX 10970 878 512 512
ReadX 10970 1390 512 512
ReadX 10970 1902 512 512
ReadX 10970 374 57 57
Close 10970
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10971
QUERY_FILE_INFORMATION 10971
ReadX 10971 0 512 512
ReadX 10971 366 512 512
ReadX 10971 878 512 512
ReadX 10971 1390 512 512
ReadX 10971 1902 512 512
QUERY_FILE_INFORMATION 10971
WriteX 10971 374 60 60
WriteX 10971 374 4 4
QUERY_FILE_INFORMATION 10971
WriteX 10971 374 11 11
WriteX 10971 368 512 512
WriteX 10971 880 512 512
WriteX 10971 1392 512 512
Close 10971
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x2 10972
Close 10972
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 10973
Close 10973
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10975
WriteX 10975 4607 1 1
QUERY_FILE_INFORMATION 10975
WriteX 10975 0 65471 65471
WriteX 10975 65471 65 65
WriteX 10975 65536 9298 9298
Close 10975
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10976
QUERY_FILE_INFORMATION 10976
ReadX 10976 0 512 512
ReadX 10976 368 512 512
ReadX 10976 880 512 512
ReadX 10976 1392 512 512
ReadX 10976 366 512 512
QUERY_FILE_INFORMATION 10976
QUERY_FILE_INFORMATION 10976
QUERY_FILE_INFORMATION 10976
WriteX 10976 376 448 448
QUERY_FILE_INFORMATION 10976
WriteX 10976 376 60 60
WriteX 10976 376 4 4
QUERY_FILE_INFORMATION 10976
WriteX 10976 376 11 11
QUERY_FILE_INFORMATION 10976
QUERY_FILE_INFORMATION 10976
WriteX 10976 376 7 7
WriteX 10976 376 57 57
WriteX 10976 370 512 512
WriteX 10976 882 512 512
WriteX 10976 1394 512 512
WriteX 10976 368 512 512
WriteX 10976 0 512 512
Flush 10976
WriteX 10976 370 512 512
Flush 10976
Close 10976
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10977
Close 10977
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10978
QUERY_FILE_INFORMATION 10978
ReadX 10978 0 512 512
ReadX 10978 368 512 512
ReadX 10978 880 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP 0x40 0x1 10979
Close 10979
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10981
Close 10981
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10982
ReadX 10982 0 24 24
Close 10982
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10983
QUERY_FILE_INFORMATION 10983
ReadX 10983 0 512 512
ReadX 10983 512 512 512
ReadX 10983 1024 512 512
ReadX 10983 2016 512 512
ReadX 10983 1056 512 512
ReadX 10983 1096 57 57
Close 10983
FIND_FIRST \clients\client1\~dmtmp\<.JNK
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10984
QUERY_FILE_INFORMATION 10984
ReadX 10984 0 512 512
ReadX 10984 512 512 512
ReadX 10984 1024 512 512
ReadX 10984 2016 512 512
ReadX 10984 1056 512 512
ReadX 10984 1096 57 57
ReadX 10984 1096 57 57
ReadX 10984 1088 62 62
ReadX 10984 1536 4096 4096
ReadX 10984 5632 4096 4096
ReadX 10984 9728 4096 4096
ReadX 10984 13824 2859 2859
ReadX 10984 1120 28 28
ReadX 10984 1148 20 20
ReadX 10984 1168 8 8
ReadX 10984 1176 88 88
ReadX 10984 1264 8 8
ReadX 10984 1272 4 4
ReadX 10984 1276 4 4
ReadX 10984 1280 1 1
ReadX 10984 1130 4 4
ReadX 10984 1134 4 4
ReadX 10984 1138 1 1
ReadX 10984 1131 4 4
ReadX 10984 1135 4 4
ReadX 10984 1139 1 1
ReadX 10984 1131 4 4
ReadX 10984 1135 4 4
ReadX 10984 1139 2 2
ReadX 10984 1132 4 4
ReadX 10984 1136 4 4
ReadX 10984 1140 25 25
ReadX 10984 1134 4 4
ReadX 10984 1138 8 8
ReadX 10984 1146 4 4
ReadX 10984 1150 8 8
ReadX 10984 1158 4 4
ReadX 10984 1162 8 8
ReadX 10984 1170 4 4
ReadX 10984 1174 4 4
ReadX 10984 1178 4 4
ReadX 10984 1182 4 4
ReadX 10984 1186 4 4
ReadX 10984 1190 4 4
ReadX 10984 1194 13900 13900
ReadX 10984 2048 4096 4096
Close 10984
QUERY_FS_INFORMATION 259
Close 10978
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10985
Close 10985
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10986
ReadX 10986 0 24 24
Close 10986
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10987
QUERY_FILE_INFORMATION 10987
ReadX 10987 0 512 512
ReadX 10987 368 512 512
ReadX 10987 880 512 512
ReadX 10987 1392 512 512
ReadX 10987 1904 512 512
ReadX 10987 376 57 57
Close 10987
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10988
QUERY_FILE_INFORMATION 10988
ReadX 10988 0 512 512
ReadX 10988 368 512 512
ReadX 10988 880 512 512
ReadX 10988 1392 512 512
ReadX 10988 1904 512 512
QUERY_FILE_INFORMATION 10988
WriteX 10988 376 60 60
WriteX 10988 376 4 4
QUERY_FILE_INFORMATION 10988
WriteX 10988 376 11 11
WriteX 10988 370 512 512
WriteX 10988 882 512 512
WriteX 10988 1394 512 512
Close 10988
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x2 10989
Close 10989
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x200000 0x1 10990
Close 10990
Rename \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10992
WriteX 10992 4607 1 1
QUERY_FILE_INFORMATION 10992
WriteX 10992 0 65471 65471
WriteX 10992 65471 65 65
WriteX 10992 65536 11540 11540
Close 10992
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10993
QUERY_FILE_INFORMATION 10993
ReadX 10993 0 512 512
ReadX 10993 398 512 512
ReadX 10993 910 512 512
ReadX 10993 1422 512 512
ReadX 10993 396 512 512
QUERY_FILE_INFORMATION 10993
QUERY_FILE_INFORMATION 10993
QUERY_FILE_INFORMATION 10993
WriteX 10993 406 448 448
QUERY_FILE_INFORMATION 10993
WriteX 10993 406 60 60
WriteX 10993 406 4 4
QUERY_FILE_INFORMATION 10993
WriteX 10993 406 11 11
QUERY_FILE_INFORMATION 10993
QUERY_FILE_INFORMATION 10993
WriteX 10993 406 7 7
WriteX 10993 406 57 57
WriteX 10993 400 512 512
WriteX 10993 912 512 512
WriteX 10993 1424 512 512
WriteX 10993 398 512 512
WriteX 10993 0 512 512
Flush 10993
WriteX 10993 400 512 512
Flush 10993
Close 10993
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10994
Close 10994
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x1 10995
QUERY_FILE_INFORMATION 10995
ReadX 10995 0 512 512
ReadX 10995 398 512 512
ReadX 10995 910 512 512
NTCreateX \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP 0x40 0x1 10996
Close 10996
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC321.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
Close 10995
ReadX 10944 1434 512 512
Close 10944
NTCreateX \clients\client1\~dmtmp\SEED\SMALL.FIL 0x40 0x1 10997
WriteX 10997 0 65471 65471
WriteX 10997 65471 63 63
WriteX 10997 65534 65471 65471
WriteX 10997 131005 63 63
Close 10997
NTCreateX \clients\client1\~dmtmp\SEED\MEDIUM.FIL 0x40 0x1 10998
WriteX 10998 0 65471 65471
WriteX 10998 65471 63 63
WriteX 10998 65534 65471 65471
WriteX 10998 131005 63 63
WriteX 10998 131068 65471 65471
WriteX 10998 196539 63 63
WriteX 10998 196602 65471 65471
WriteX 10998 262073 63 63
Close 10998
NTCreateX \clients\client1\~dmtmp\SEED\LARGE.FIL 0x40 0x1 10999
WriteX 10999 0 65471 65471
WriteX 10999 65471 63 63
WriteX 10999 65534 65471 65471
WriteX 10999 131005 63 63
WriteX 10999 131068 65471 65471
WriteX 10999 196539 63 63
WriteX 10999 196602 65471 65471
WriteX 10999 262073 63 63
WriteX 10999 262136 65471 65471
WriteX 10999 327607 63 63
WriteX 10999 327670 65471 65471
WriteX 10999 393141 63 63
WriteX 10999 393204 65471 65471
WriteX 10999 458675 63 63
WriteX 10999 458738 65471 65471
WriteX 10999 524209 63 63
Close 10999
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11000
Close 11000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRROLS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 11001
ReadX 11001 0 512 512
ReadX 11001 512 511 511
ReadX 11001 1023 512 512
ReadX 11001 1535 512 512
Close 11001
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRBARS.CFG
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 11002
ReadX 11002 0 512 512
ReadX 11002 512 510 510
ReadX 11002 1022 512 512
ReadX 11002 1534 510 510
ReadX 11002 2044 510 510
Close 11002
NTCreateX \clients\client1\~dmtmp\COREL\ARTISTIC.ACL 0x40 0x1 11003
ReadX 11003 0 512 512
ReadX 11003 512 512 512
ReadX 11003 1024 512 512
ReadX 11003 1536 512 512
ReadX 11003 2048 512 512
ReadX 11003 2560 512 512
ReadX 11003 3072 512 512
ReadX 11003 3584 512 512
ReadX 11003 4096 512 512
ReadX 11003 4608 512 512
ReadX 11003 5120 512 512
ReadX 11003 5632 512 512
ReadX 11003 6144 512 512
ReadX 11003 6656 512 512
ReadX 11003 7168 512 512
ReadX 11003 7680 512 512
ReadX 11003 8192 512 512
ReadX 11003 8704 512 512
Close 11003
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11004
Close 11004
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CORELDRW.CDT
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 11005
QUERY_FILE_INFORMATION 11005
Close 11005
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 11006
ReadX 11006 0 8192 8192
Close 11006
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 11007
Close 11007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 11008
QUERY_FILE_INFORMATION 11008
Close 11008
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 11009
ReadX 11009 0 8192 8192
Close 11009
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11010
Close 11010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 11011
QUERY_FILE_INFORMATION 11011
Close 11011
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 11012
ReadX 11012 0 8192 8192
Close 11012
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 11013
ReadX 11013 0 8192 8192
ReadX 11013 8192 8192 8192
ReadX 11013 16384 8192 8192
ReadX 11013 24576 8192 8192
Close 11013
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 11015
Close 11015
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 11017
WriteX 11017 8191 1 1
QUERY_FILE_INFORMATION 11017
WriteX 11017 0 10438 10438
Close 11017
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 11018
Close 11018
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 11019
QUERY_FILE_INFORMATION 11019
QUERY_FILE_INFORMATION 11019
Close 11019
NTCreateX \clients\client1\~dmtmp\COREL\MAILBOX2.CPT 0x40 0x1 11020
QUERY_FILE_INFORMATION 11020
QUERY_FILE_INFORMATION 11020
Close 11020
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 11021
Close 11021
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 11022
QUERY_FILE_INFORMATION 11022
QUERY_FILE_INFORMATION 11022
Close 11022
NTCreateX \clients\client1\~dmtmp\COREL\TEAPOT2.CPT 0x40 0x1 11023
QUERY_FILE_INFORMATION 11023
QUERY_FILE_INFORMATION 11023
Close 11023
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\SIGN2.CPT
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 11024
Close 11024
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 11025
QUERY_FILE_INFORMATION 11025
QUERY_FILE_INFORMATION 11025
Close 11025
NTCreateX \clients\client1\~dmtmp\COREL\SIGN2.CPT 0x40 0x1 11026
QUERY_FILE_INFORMATION 11026
QUERY_FILE_INFORMATION 11026
Close 11026
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\TRAIN.CDR
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 11027
Close 11027
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 11028
QUERY_FILE_INFORMATION 11028
QUERY_FILE_INFORMATION 11028
Close 11028
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 11029
ReadX 11029 0 8 8
ReadX 11029 8 4 4
ReadX 11029 12 8 8
ReadX 11029 22 8 8
ReadX 11029 520 8 8
ReadX 11029 525 8 8
ReadX 11029 533 4 4
ReadX 11029 543 8 8
ReadX 11029 551 4 4
ReadX 11029 1058 8 8
ReadX 11029 1066 4 4
ReadX 11029 1081 8 8
ReadX 11029 1089 4 4
ReadX 11029 660 8 8
Close 11029
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 11030
ReadX 11030 0 8192 8192
Close 11030
NTCreateX \clients\client1\~dmtmp\COREL\TRAIN.CDR 0x40 0x1 11031
ReadX 11031 0 8192 8192
ReadX 11031 520 8192 8192
ReadX 11031 8712 8192 8192
ReadX 11031 16904 8192 8192
ReadX 11031 25096 8192 8192
ReadX 11031 33288 8192 8192
ReadX 11031 41480 8192 8192
ReadX 11031 49672 8192 8192
ReadX 11031 57864 8192 8192
ReadX 11031 66056 8192 8192
ReadX 11031 74248 8192 8192
ReadX 11031 82440 8192 8192
ReadX 11031 90632 8192 8192
ReadX 11031 98824 8192 8192
ReadX 11031 107016 8192 8192
ReadX 11031 115208 8192 8192
ReadX 11031 123400 8192 8192
ReadX 11031 131592 8192 8192
ReadX 11031 139784 8192 8192
ReadX 11031 147976 8192 8192
ReadX 11031 156168 8192 8192
Close 11031
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 11032
QUERY_FILE_INFORMATION 11032
Close 11032
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 11033
Close 11033
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 11035
WriteX 11035 8191 1 1
QUERY_FILE_INFORMATION 11035
WriteX 11035 0 28489 28489
Close 11035
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 11036
Close 11036
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 11037
Close 11037
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 11038
QUERY_FILE_INFORMATION 11038
Close 11038
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 11039
ReadX 11039 0 8192 8192
Close 11039
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11040
Close 11040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 11041
QUERY_FILE_INFORMATION 11041
Close 11041
NTCreateX \clients\client1\~dmtmp\COREL\CORELDRW.CDT 0x40 0x1 11042
ReadX 11042 0 8192 8192
Close 11042
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 11043
ReadX 11043 0 8192 8192
ReadX 11043 8192 8192 8192
ReadX 11043 16384 8192 8192
ReadX 11043 24576 8192 8192
ReadX 11043 32768 16384 16384
ReadX 11043 49152 8192 8192
ReadX 11043 57344 8192 8192
ReadX 11043 65536 8192 8192
Close 11043
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 11045
Close 11045
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 11047
WriteX 11047 8191 1 1
QUERY_FILE_INFORMATION 11047
WriteX 11047 0 29253 29253
Close 11047
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\ROSE.CPT
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 11048
Close 11048
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 11049
QUERY_FILE_INFORMATION 11049
QUERY_FILE_INFORMATION 11049
Close 11049
NTCreateX \clients\client1\~dmtmp\COREL\ROSE.CPT 0x40 0x1 11050
QUERY_FILE_INFORMATION 11050
QUERY_FILE_INFORMATION 11050
Close 11050
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 11051
QUERY_FILE_INFORMATION 11051
Close 11051
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 11052
Close 11052
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 11054
WriteX 11054 8191 1 1
QUERY_FILE_INFORMATION 11054
WriteX 11054 0 30183 30183
Close 11054
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 11055
Close 11055
Rename \clients\client1\~dmtmp\COREL\@@@CDRW.TMP \clients\client1\~dmtmp\COREL\GRAPH2.BAK
NTCreateX \clients\client1\~dmtmp\COREL\CDRBARS.CFG 0x40 0x1 11056
WriteX 11056 0 510 510
WriteX 11056 510 512 512
WriteX 11056 1022 510 510
WriteX 11056 1532 510 510
WriteX 11056 2042 168 168
Close 11056
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11057
Close 11057
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Unlink \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\CDRROLS.CFG 0x40 0x1 11058
WriteX 11058 0 511 511
WriteX 11058 511 512 512
WriteX 11058 1023 512 512
WriteX 11058 1535 488 488
Close 11058
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\SEED
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1
QUERY_PATH_INFORMATION \clients\client1\mixfile
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
FIND_FIRST \clients\client1\~dmtmp\COREL\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.BAK
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM
FIND_FIRST \clients\client1\~dmtmp\PM\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.VAL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.VAL
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.DB
Unlink \clients\client1\~dmtmp\PARADOX\CHANGED.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.MB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.MB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.DB
Unlink \clients\client1\~dmtmp\PARADOX\ANSWER.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
Unlink \clients\client1\~dmtmp\ACCESS\INV.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
Unlink \clients\client1\~dmtmp\ACCESS\SALES.PRN
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
Unlink \clients\client1\~dmtmp\ACCESS\LABELS.PRN
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\mixfile 0x40 0x5 11059
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\WORD\*
FIND_FIRST \clients\client1\~dmtmp\EXCEL\*
FIND_FIRST \clients\client1\~dmtmp\PWRPNT\*
FIND_FIRST \clients\client1\~dmtmp\COREL\*
FIND_FIRST \clients\client1\~dmtmp\WORDPRO\*
FIND_FIRST \clients\client1\~dmtmp\PM\*
FIND_FIRST \clients\client1\~dmtmp\PARADOX\*
FIND_FIRST \clients\client1\~dmtmp\ACCESS\*
FIND_FIRST \clients\client1\~dmtmp\SEED\*
FIND_FIRST \clients\client1\FILLER"*
WriteX 11059 3 1 1
QUERY_FILE_INFORMATION 11059
WriteX 11059 0 4 4
WriteX 11059 4 8 8
Close 11059
Unlink \clients\client1\~dmtmp\WORD\CHAP10.DOC
Unlink \clients\client1\~dmtmp\WORD\BASEMACH.DOC
Unlink \clients\client1\~dmtmp\WORD\FACTS.DOC
Unlink \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
Unlink \clients\client1\~dmtmp\EXCEL\SALES.XLS
Unlink \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\ZD16.BMP
Unlink \clients\client1\~dmtmp\PWRPNT\PPTOOLS1.PPA
Unlink \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
Unlink \clients\client1\~dmtmp\COREL\CDRROLS.CFG
Unlink \clients\client1\~dmtmp\COREL\CDRBARS.CFG
Unlink \clients\client1\~dmtmp\COREL\ARTISTIC.ACL
Unlink \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR
Unlink \clients\client1\~dmtmp\COREL\MAILBOX2.CPT
Unlink \clients\client1\~dmtmp\COREL\TEAPOT2.CPT
Unlink \clients\client1\~dmtmp\COREL\SIGN2.CPT
Unlink \clients\client1\~dmtmp\COREL\TRAIN.CDR
Unlink \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR
Unlink \clients\client1\~dmtmp\COREL\ROSE.CPT
Unlink \clients\client1\~dmtmp\COREL\CORELDRW.CDT
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\RESULTS.XLS
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1.LWP
Unlink \clients\client1\~dmtmp\PM\T1.XLS
Unlink \clients\client1\~dmtmp\PM\EVENTS.DOC
Unlink \clients\client1\~dmtmp\PM\MOVED.DOC
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.DB
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.PX
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.X04
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.Y04
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.PX
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.XG0
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.YG0
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.XG1
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.YG1
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.VAL
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.MB
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.DB
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.PX
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.X03
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.Y03
Unlink \clients\client1\~dmtmp\PARADOX\ENROLL.VAL
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.TV
Unlink \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
Unlink \clients\client1\~dmtmp\PARADOX\COURSES.FSL
Unlink \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
Unlink \clients\client1\~dmtmp\SEED\SMALL.FIL
Unlink \clients\client1\~dmtmp\SEED\MEDIUM.FIL
Unlink \clients\client1\~dmtmp\SEED\LARGE.FIL
Unlink \clients\client1\filler.000
Unlink \clients\client1\filler.001
Unlink \clients\client1\filler.002
Unlink \clients\client1\filler.003
Unlink \clients\client1\filler.004
Unlink \clients\client1\mixfile
Rmdir \clients\client1\~dmtmp\WORDPRO
Rmdir \clients\client1\~dmtmp\WORD
Rmdir \clients\client1\~dmtmp\SEED
Rmdir \clients\client1\~dmtmp\PWRPNT
Rmdir \clients\client1\~dmtmp\PM
Rmdir \clients\client1\~dmtmp\PARADOX
Rmdir \clients\client1\~dmtmp\EXCEL
Rmdir \clients\client1\~dmtmp\COREL
Rmdir \clients\client1\~dmtmp\ACCESS
Rmdir \clients\client1\~dmtmp
Rmdir \clients\client1