Deltree \clients\client1
-NTCreateX \clients 0x1 0x3 12114 1
+NTCreateX \clients 0x1 0x3 12114 1001
Close 12114 1
NTCreateX \clients\client1 0x1 0x2 12115
Close 12115
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13569
QUERY_FILE_INFORMATION 13569
ReadX 13569 0 512 512
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12661
ReadX 12661 0 41 41
ReadX 12649 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1111
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12691
ReadX 12691 0 511 511
ReadX 12691 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12691
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
Close 12715
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12716
ReadX 12716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12717
ReadX 12720 293 2 2
Close 12720
ReadX 12716 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 12716 384 2048 2048
ReadX 12716 768 16384 16384
ReadX 12716 1792 14336 14336
Close 12717
Close 12718
Close 12719
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12721
Close 12721
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12722
ReadX 12722 0 511 511
ReadX 12722 0 530 530
Close 12727
Close 12724
Close 12725
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12736
Close 12736
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12737
QUERY_FILE_INFORMATION 12737
ReadX 12737 0 64 64
Close 12755
Close 12756
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12758
ReadX 12758 0 511 511
ReadX 12758 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12770
ReadX 12770 0 41 41
ReadX 12758 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12793
ReadX 12793 0 511 511
ReadX 12793 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12793
WriteX 12777 2048 2048 2048
WriteX 12777 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12809
ReadX 12809 0 511 511
ReadX 12809 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12809
Close 12777
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12811
Close 12811
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12812
QUERY_FILE_INFORMATION 12812
ReadX 12812 0 64 64
Close 12815
Close 12816
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12826
ReadX 12826 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12827
ReadX 12838 241 298 298
Close 12838
ReadX 12826 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12845 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12871
QUERY_FILE_INFORMATION 12871
ReadX 12871 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12873
Close 12873
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12871 1568 512 512
ReadX 12871 1536 512 512
ReadX 12871 2176 384 384
ReadX 12871 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12874
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12871 288 2048 2048
ReadX 12871 2336 2048 2048
ReadX 12871 4384 2048 2048
ReadX 12877 2560 2048 2048
ReadX 12877 4608 2048 2048
ReadX 12877 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 12880 8192 4096 4096
Close 12879
Close 12880
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12881
WriteX 12881 15359 1 1
QUERY_FILE_INFORMATION 12881
WriteX 12882 0 512 512
QUERY_FILE_INFORMATION 12877
QUERY_FILE_INFORMATION 12877
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 12877
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12883
Close 12883
WriteX 12887 2560 512 512
WriteX 12887 0 512 512
QUERY_FILE_INFORMATION 12887
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12888
QUERY_FILE_INFORMATION 12888
ReadX 12888 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12890
Close 12890
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12891
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 12888 2560 2048 2048
ReadX 12888 4608 2048 2048
ReadX 12888 6656 2048 2048
ReadX 12894 5632 2048 2048
ReadX 12894 7680 2048 2048
ReadX 12894 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12896
WriteX 12896 11990 1 1
QUERY_FILE_INFORMATION 12896
WriteX 12897 0 512 512
QUERY_FILE_INFORMATION 12894
QUERY_FILE_INFORMATION 12894
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 12894
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12898
Close 12898
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12903
Close 12903
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12909
QUERY_FILE_INFORMATION 12909
ReadX 12909 528 2048 2048
ReadX 12909 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12913
Close 12913
ReadX 12909 1384 2048 2048
ReadX 12909 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12917
Close 12917
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12921
Close 12921
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12927
Close 12927
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12933
Close 12933
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 12962
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12964
Close 12964
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12970
Close 12970
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12988
Close 12988
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13007
Close 13007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13010 8192 512 512
ReadX 13010 8704 512 512
Close 13010
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13011
Close 13011
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13016
ReadX 13016 0 8192 8192
Close 13016
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13017
Close 13017
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13020 16384 8192 8192
ReadX 13020 24576 8192 8192
Close 13020
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13022
Close 13022
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13024
WriteX 13024 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13039
QUERY_FILE_INFORMATION 13039
Close 13039
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13040
Close 13040
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13042
WriteX 13042 0 28489 28489
Close 13042
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13043
Close 13043
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13046
ReadX 13046 0 8192 8192
Close 13046
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13047
Close 13047
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13050 65536 8192 8192
Close 13050
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13052
Close 13052
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13054
WriteX 13054 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13058
QUERY_FILE_INFORMATION 13058
Close 13058
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13059
Close 13059
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13061
WriteX 13061 0 30183 30183
Close 13061
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13062
Close 13062
WriteX 13063 1532 510 510
WriteX 13063 2042 168 168
Close 13063
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13064
Close 13064
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13068
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13069
QUERY_FILE_INFORMATION 13069
ReadX 13069 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13070
Close 13070
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13071
WriteX 13071 1535 1 1
QUERY_FILE_INFORMATION 13071
Close 13072
WriteX 13071 0 4096 4096
Close 13071
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13073
Close 13073
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13075
WriteX 13075 1535 1 1
QUERY_FILE_INFORMATION 13075
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13077 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13079
Close 13079
QUERY_FILE_INFORMATION 13081
WriteX 13081 0 53077 53077
Close 13081
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13082
WriteX 13082 1535 1 1
QUERY_FILE_INFORMATION 13082
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13086
Close 13086
WriteX 13088 0 7983 7983
Close 13088
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13090
Close 13090
WriteX 13092 458687 65 65
WriteX 13092 458752 46731 46731
Close 13092
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13093
WriteX 13093 1535 1 1
QUERY_FILE_INFORMATION 13093
Close 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13096
QUERY_FILE_INFORMATION 13096
ReadX 13096 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13097
Close 13097
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13098
WriteX 13098 2047 1 1
QUERY_FILE_INFORMATION 13098
Close 13099
WriteX 13098 0 42388 42388
Close 13098
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13100
Close 13100
QUERY_FILE_INFORMATION 13101
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13102
WriteX 13102 2047 1 1
QUERY_FILE_INFORMATION 13102
QUERY_FILE_INFORMATION 13104
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13106
Close 13106
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13116
Close 13116
Close 13119
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13122
Close 13122
Close 13125
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13128
Close 13128
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13132
Close 13132
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13136
Close 13136
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13140
Close 13140
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13144
Close 13144
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13148
Close 13148
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13152
Close 13152
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13156
Close 13156
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13158
Close 13158
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13160
Close 13160
Close 13162
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 13174
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13177
Close 13177
Close 13180
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13183
Close 13183
Close 13186
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13189
Close 13189
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13193
Close 13193
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13197
Close 13197
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13201
Close 13201
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13205
Close 13205
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13209
Close 13209
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13212
Close 13212
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13216
Close 13216
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13220
Close 13220
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13259
Close 13259
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13261
WriteX 13261 15 1 1
WriteX 13261 0 10575 10575
Flush 13261
Close 13261
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13262
Close 13262
Close 13256
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13269
Close 13269
WriteX 13271 589824 35257 35257
Close 13271
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13273
Close 13273
ReadX 13282 1025 2048 2048
ReadX 13282 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13284
Close 13284
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13286
WriteX 13286 15 1 1
WriteX 13286 0 11588 11588
Flush 13286
Close 13286
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13287
Close 13287
ReadX 13292 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13294
Close 13294
ReadX 13281 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13298
Close 13298
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13308
Close 13308
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13309
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13309 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13312
ReadX 13312 0 511 511
ReadX 13309 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13309
Close 13310
Close 13311
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13316
ReadX 13316 0 511 511
ReadX 13313 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13317
FIND_FIRST \clients\client1\~dmtmp\*
Close 13317
ReadX 13333 293 2 2
Close 13333
ReadX 13329 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13329
Close 13330
Close 13331
Close 13318
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13334
Close 13334
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13335
ReadX 13335 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13336
ReadX 13344 293 2 2
Close 13344
ReadX 13340 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13372
ReadX 13372 0 511 511
ReadX 13372 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13372
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13373
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13379
Close 13379
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13380
ReadX 13380 0 511 511
ReadX 13380 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13400
ReadX 13400 0 41 41
ReadX 13388 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 13407 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13408
Close 13408
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13409
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13409 0 511 511
ReadX 13426 241 298 298
Close 13426
ReadX 13414 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 13461 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13462
ReadX 13462 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13462
Close 13461
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13480
Close 13480
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13481
ReadX 13481 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13482
ReadX 13498 241 298 298
Close 13498
ReadX 13486 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 13505 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13506
Close 13506
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13507
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13507 0 511 511
ReadX 13516 293 2 2
Close 13516
ReadX 13512 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 13523 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13524
Close 13524
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13525
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13525 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13545
ReadX 13545 0 41 41
ReadX 13533 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13575
ReadX 13575 0 511 511
ReadX 13575 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13575
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
Close 13599
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13600
ReadX 13600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13601
ReadX 13604 293 2 2
Close 13604
ReadX 13600 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 13600 384 2048 2048
ReadX 13600 768 16384 16384
ReadX 13600 1792 14336 14336
Close 13601
Close 13602
Close 13603
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13605
Close 13605
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13606
ReadX 13606 0 511 511
ReadX 13606 0 530 530
Close 13611
Close 13608
Close 13609
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13620
Close 13620
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13621
QUERY_FILE_INFORMATION 13621
ReadX 13621 0 64 64
Close 13639
Close 13640
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13642
ReadX 13642 0 511 511
ReadX 13642 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13654
ReadX 13654 0 41 41
ReadX 13642 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13677
ReadX 13677 0 511 511
ReadX 13677 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13677
WriteX 13661 2048 2048 2048
WriteX 13661 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13693
ReadX 13693 0 511 511
ReadX 13693 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13693
Close 13661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13695
Close 13695
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13696
QUERY_FILE_INFORMATION 13696
ReadX 13696 0 64 64
Close 13699
Close 13700
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13710
ReadX 13710 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13711
ReadX 13722 241 298 298
Close 13722
ReadX 13710 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13729 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13755
QUERY_FILE_INFORMATION 13755
ReadX 13755 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13757
Close 13757
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13755 1568 512 512
ReadX 13755 1536 512 512
ReadX 13755 2176 384 384
ReadX 13755 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13758
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13755 288 2048 2048
ReadX 13755 2336 2048 2048
ReadX 13755 4384 2048 2048
ReadX 13761 2560 2048 2048
ReadX 13761 4608 2048 2048
ReadX 13761 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 13764 8192 4096 4096
Close 13763
Close 13764
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13765
WriteX 13765 15359 1 1
QUERY_FILE_INFORMATION 13765
WriteX 13766 0 512 512
QUERY_FILE_INFORMATION 13761
QUERY_FILE_INFORMATION 13761
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 13761
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13767
Close 13767
WriteX 13771 2560 512 512
WriteX 13771 0 512 512
QUERY_FILE_INFORMATION 13771
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13772
QUERY_FILE_INFORMATION 13772
ReadX 13772 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13774
Close 13774
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13775
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 13772 2560 2048 2048
ReadX 13772 4608 2048 2048
ReadX 13772 6656 2048 2048
ReadX 13778 5632 2048 2048
ReadX 13778 7680 2048 2048
ReadX 13778 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13780
WriteX 13780 11990 1 1
QUERY_FILE_INFORMATION 13780
WriteX 13781 0 512 512
QUERY_FILE_INFORMATION 13778
QUERY_FILE_INFORMATION 13778
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 13778
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13782
Close 13782
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13787
Close 13787
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13793
QUERY_FILE_INFORMATION 13793
ReadX 13793 528 2048 2048
ReadX 13793 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13797
Close 13797
ReadX 13793 1384 2048 2048
ReadX 13793 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13801
Close 13801
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13805
Close 13805
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13811
Close 13811
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13817
Close 13817
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13846
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13848
Close 13848
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13854
Close 13854
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13872
Close 13872
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13891
Close 13891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13894 8192 512 512
ReadX 13894 8704 512 512
Close 13894
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13895
Close 13895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13900
ReadX 13900 0 8192 8192
Close 13900
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13901
Close 13901
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13904 16384 8192 8192
ReadX 13904 24576 8192 8192
Close 13904
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13906
Close 13906
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13908
WriteX 13908 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13923
QUERY_FILE_INFORMATION 13923
Close 13923
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13924
Close 13924
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13926
WriteX 13926 0 28489 28489
Close 13926
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13927
Close 13927
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13930
ReadX 13930 0 8192 8192
Close 13930
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13931
Close 13931
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13934 65536 8192 8192
Close 13934
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13936
Close 13936
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13938
WriteX 13938 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13942
QUERY_FILE_INFORMATION 13942
Close 13942
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13943
Close 13943
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13945
WriteX 13945 0 30183 30183
Close 13945
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13946
Close 13946
WriteX 13947 1532 510 510
WriteX 13947 2042 168 168
Close 13947
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13948
Close 13948
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13952
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13953
QUERY_FILE_INFORMATION 13953
ReadX 13953 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13954
Close 13954
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13955
WriteX 13955 1535 1 1
QUERY_FILE_INFORMATION 13955
Close 13956
WriteX 13955 0 4096 4096
Close 13955
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13957
Close 13957
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13959
WriteX 13959 1535 1 1
QUERY_FILE_INFORMATION 13959
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13961 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13963
Close 13963
QUERY_FILE_INFORMATION 13965
WriteX 13965 0 53077 53077
Close 13965
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13966
WriteX 13966 1535 1 1
QUERY_FILE_INFORMATION 13966
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13970
Close 13970
WriteX 13972 0 7983 7983
Close 13972
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13974
Close 13974
WriteX 13976 458687 65 65
WriteX 13976 458752 46731 46731
Close 13976
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13977
WriteX 13977 1535 1 1
QUERY_FILE_INFORMATION 13977
Close 13979
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13980
QUERY_FILE_INFORMATION 13980
ReadX 13980 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13981
Close 13981
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13982
WriteX 13982 2047 1 1
QUERY_FILE_INFORMATION 13982
Close 13983
WriteX 13982 0 42388 42388
Close 13982
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13984
Close 13984
QUERY_FILE_INFORMATION 13985
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13986
WriteX 13986 2047 1 1
QUERY_FILE_INFORMATION 13986
QUERY_FILE_INFORMATION 13988
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13990
Close 13990
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14000
Close 14000
Close 14003
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14006
Close 14006
Close 14009
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14012
Close 14012
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14016
Close 14016
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14020
Close 14020
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14024
Close 14024
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14032
Close 14032
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14036
Close 14036
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 14040
Close 14040
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 14042
Close 14042
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14044
Close 14044
Close 14046
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 14058
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14061
Close 14061
Close 14064
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14067
Close 14067
Close 14070
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14073
Close 14073
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14077
Close 14077
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14081
Close 14081
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14085
Close 14085
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14089
Close 14089
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14093
Close 14093
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12421
Close 12421
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12425
Close 12425
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12429
Close 12429
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12468
Close 12468
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12470
WriteX 12470 15 1 1
WriteX 12470 0 10575 10575
Flush 12470
Close 12470
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12471
Close 12471
Close 12465
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12478
Close 12478
WriteX 12480 589824 35257 35257
Close 12480
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12482
Close 12482
ReadX 12491 1025 2048 2048
ReadX 12491 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12493
Close 12493
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12495
WriteX 12495 15 1 1
WriteX 12495 0 11588 11588
Flush 12495
Close 12495
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12496
Close 12496
ReadX 12501 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12503
Close 12503
ReadX 12490 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12507
Close 12507
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12517
Close 12517
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12518
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12518 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12521
ReadX 12521 0 511 511
ReadX 12518 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12518
Close 12519
Close 12520
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12525
ReadX 12525 0 511 511
ReadX 12522 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12526
FIND_FIRST \clients\client1\~dmtmp\*
Close 12526
ReadX 12542 293 2 2
Close 12542
ReadX 12538 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12538
Close 12539
Close 12540
Close 12527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12543
Close 12543
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12544
ReadX 12544 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12545
ReadX 12553 293 2 2
Close 12553
ReadX 12549 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12581
ReadX 12581 0 511 511
ReadX 12581 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12581
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12582
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12588
Close 12588
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12589
ReadX 12589 0 511 511
ReadX 12589 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12609
ReadX 12609 0 41 41
ReadX 12597 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 12616 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12617
Close 12617
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12618
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12618 0 511 511
ReadX 12635 241 298 298
Close 12635
ReadX 12623 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 12670 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12671
ReadX 12671 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12671
Close 12670
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12689
Close 12689
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12690
ReadX 12690 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12691
ReadX 12707 241 298 298
Close 12707
ReadX 12695 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 12714 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
Close 12715
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12716
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12716 0 511 511
ReadX 12725 293 2 2
Close 12725
ReadX 12721 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 12732 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12733
Close 12733
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12734
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12734 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12754
ReadX 12754 0 41 41
ReadX 12742 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12784
ReadX 12784 0 511 511
ReadX 12784 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12784
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12808
Close 12808
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12809
ReadX 12809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12810
ReadX 12813 293 2 2
Close 12813
ReadX 12809 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 12809 384 2048 2048
ReadX 12809 768 16384 16384
ReadX 12809 1792 14336 14336
Close 12810
Close 12811
Close 12812
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12814
Close 12814
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12815
ReadX 12815 0 511 511
ReadX 12815 0 530 530
Close 12820
Close 12817
Close 12818
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12829
Close 12829
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12830
QUERY_FILE_INFORMATION 12830
ReadX 12830 0 64 64
Close 12848
Close 12849
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12851
ReadX 12851 0 511 511
ReadX 12851 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12863
ReadX 12863 0 41 41
ReadX 12851 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12886
ReadX 12886 0 511 511
ReadX 12886 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12886
WriteX 12870 2048 2048 2048
WriteX 12870 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12902
ReadX 12902 0 511 511
ReadX 12902 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12902
Close 12870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12904
Close 12904
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12905
QUERY_FILE_INFORMATION 12905
ReadX 12905 0 64 64
Close 12908
Close 12909
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12919
ReadX 12919 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12920
ReadX 12931 241 298 298
Close 12931
ReadX 12919 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12938 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12964
QUERY_FILE_INFORMATION 12964
ReadX 12964 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12966
Close 12966
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12964 1568 512 512
ReadX 12964 1536 512 512
ReadX 12964 2176 384 384
ReadX 12964 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12967
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12964 288 2048 2048
ReadX 12964 2336 2048 2048
ReadX 12964 4384 2048 2048
ReadX 12970 2560 2048 2048
ReadX 12970 4608 2048 2048
ReadX 12970 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 12973 8192 4096 4096
Close 12972
Close 12973
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12974
WriteX 12974 15359 1 1
QUERY_FILE_INFORMATION 12974
WriteX 12975 0 512 512
QUERY_FILE_INFORMATION 12970
QUERY_FILE_INFORMATION 12970
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 12970
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12976
Close 12976
WriteX 12980 2560 512 512
WriteX 12980 0 512 512
QUERY_FILE_INFORMATION 12980
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12981
QUERY_FILE_INFORMATION 12981
ReadX 12981 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12983
Close 12983
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12984
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 12981 2560 2048 2048
ReadX 12981 4608 2048 2048
ReadX 12981 6656 2048 2048
ReadX 12987 5632 2048 2048
ReadX 12987 7680 2048 2048
ReadX 12987 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12989
WriteX 12989 11990 1 1
QUERY_FILE_INFORMATION 12989
WriteX 12990 0 512 512
QUERY_FILE_INFORMATION 12987
QUERY_FILE_INFORMATION 12987
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 12987
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12991
Close 12991
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12996
Close 12996
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13002
QUERY_FILE_INFORMATION 13002
ReadX 13002 528 2048 2048
ReadX 13002 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13006
Close 13006
ReadX 13002 1384 2048 2048
ReadX 13002 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13010
Close 13010
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13014
Close 13014
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13020
Close 13020
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13026
Close 13026
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13055
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13057
Close 13057
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13063
Close 13063
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13081
Close 13081
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13100
Close 13100
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13103 8192 512 512
ReadX 13103 8704 512 512
Close 13103
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13104
Close 13104
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13109
ReadX 13109 0 8192 8192
Close 13109
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13110
Close 13110
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13113 16384 8192 8192
ReadX 13113 24576 8192 8192
Close 13113
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13115
Close 13115
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13117
WriteX 13117 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13132
QUERY_FILE_INFORMATION 13132
Close 13132
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13133
Close 13133
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13135
WriteX 13135 0 28489 28489
Close 13135
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13136
Close 13136
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13139
ReadX 13139 0 8192 8192
Close 13139
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13140
Close 13140
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13143 65536 8192 8192
Close 13143
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13145
Close 13145
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13147
WriteX 13147 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13151
QUERY_FILE_INFORMATION 13151
Close 13151
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13152
Close 13152
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13154
WriteX 13154 0 30183 30183
Close 13154
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13155
Close 13155
WriteX 13156 1532 510 510
WriteX 13156 2042 168 168
Close 13156
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13157
Close 13157
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13161
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13162
QUERY_FILE_INFORMATION 13162
ReadX 13162 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13163
Close 13163
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13164
WriteX 13164 1535 1 1
QUERY_FILE_INFORMATION 13164
Close 13165
WriteX 13164 0 4096 4096
Close 13164
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13166
Close 13166
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13168
WriteX 13168 1535 1 1
QUERY_FILE_INFORMATION 13168
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13170 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13172
Close 13172
QUERY_FILE_INFORMATION 13174
WriteX 13174 0 53077 53077
Close 13174
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13175
WriteX 13175 1535 1 1
QUERY_FILE_INFORMATION 13175
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13179
Close 13179
WriteX 13181 0 7983 7983
Close 13181
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13183
Close 13183
WriteX 13185 458687 65 65
WriteX 13185 458752 46731 46731
Close 13185
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13186
WriteX 13186 1535 1 1
QUERY_FILE_INFORMATION 13186
Close 13188
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13189
QUERY_FILE_INFORMATION 13189
ReadX 13189 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13190
Close 13190
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13191
WriteX 13191 2047 1 1
QUERY_FILE_INFORMATION 13191
Close 13192
WriteX 13191 0 42388 42388
Close 13191
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13193
Close 13193
QUERY_FILE_INFORMATION 13194
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13195
WriteX 13195 2047 1 1
QUERY_FILE_INFORMATION 13195
QUERY_FILE_INFORMATION 13197
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13199
Close 13199
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13209
Close 13209
Close 13212
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13215
Close 13215
Close 13218
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13221
Close 13221
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13225
Close 13225
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13229
Close 13229
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13233
Close 13233
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13237
Close 13237
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13241
Close 13241
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13245
Close 13245
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13249
Close 13249
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13251
Close 13251
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13253
Close 13253
Close 13255
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 13267
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13270
Close 13270
Close 13273
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13276
Close 13276
Close 13279
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13282
Close 13282
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13286
Close 13286
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13290
Close 13290
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13294
Close 13294
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13298
Close 13298
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13302
Close 13302
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13305
Close 13305
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13309
Close 13309
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13313
Close 13313
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13352
Close 13352
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13354
WriteX 13354 15 1 1
WriteX 13354 0 10575 10575
Flush 13354
Close 13354
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13355
Close 13355
Close 13349
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13362
Close 13362
WriteX 13364 589824 35257 35257
Close 13364
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13366
Close 13366
ReadX 13375 1025 2048 2048
ReadX 13375 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13377
Close 13377
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13379
WriteX 13379 15 1 1
WriteX 13379 0 11588 11588
Flush 13379
Close 13379
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13380
Close 13380
ReadX 13385 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13387
Close 13387
ReadX 13374 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13391
Close 13391
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13401
Close 13401
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13402
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13402 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13405
ReadX 13405 0 511 511
ReadX 13402 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13402
Close 13403
Close 13404
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13409
ReadX 13409 0 511 511
ReadX 13406 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13410
FIND_FIRST \clients\client1\~dmtmp\*
Close 13410
ReadX 13426 293 2 2
Close 13426
ReadX 13422 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13422
Close 13423
Close 13424
Close 13411
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13427
Close 13427
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13428
ReadX 13428 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13429
ReadX 13437 293 2 2
Close 13437
ReadX 13433 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13465
ReadX 13465 0 511 511
ReadX 13465 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13465
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13466
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13472
Close 13472
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13473
ReadX 13473 0 511 511
ReadX 13473 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13493
ReadX 13493 0 41 41
ReadX 13481 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 13500 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13501
Close 13501
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13502
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13502 0 511 511
ReadX 13519 241 298 298
Close 13519
ReadX 13507 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 13554 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13555
ReadX 13555 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13555
Close 13554
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13573
Close 13573
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13574
ReadX 13574 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13575
ReadX 13591 241 298 298
Close 13591
ReadX 13579 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 13598 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
Close 13599
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13600
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13600 0 511 511
ReadX 13609 293 2 2
Close 13609
ReadX 13605 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 13616 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13617
Close 13617
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13618
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13618 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13638
ReadX 13638 0 41 41
ReadX 13626 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13668
ReadX 13668 0 511 511
ReadX 13668 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13668
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13692
Close 13692
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13693
ReadX 13693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13694
ReadX 13697 293 2 2
Close 13697
ReadX 13693 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 13693 384 2048 2048
ReadX 13693 768 16384 16384
ReadX 13693 1792 14336 14336
Close 13694
Close 13695
Close 13696
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13698
Close 13698
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13699
ReadX 13699 0 511 511
ReadX 13699 0 530 530
Close 13704
Close 13701
Close 13702
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13713
Close 13713
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13714
QUERY_FILE_INFORMATION 13714
ReadX 13714 0 64 64
Close 13732
Close 13733
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13735
ReadX 13735 0 511 511
ReadX 13735 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13747
ReadX 13747 0 41 41
ReadX 13735 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13770
ReadX 13770 0 511 511
ReadX 13770 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13770
WriteX 13754 2048 2048 2048
WriteX 13754 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13786
ReadX 13786 0 511 511
ReadX 13786 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13786
Close 13754
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13788
Close 13788
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13789
QUERY_FILE_INFORMATION 13789
ReadX 13789 0 64 64
Close 13792
Close 13793
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13803
ReadX 13803 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13804
ReadX 13815 241 298 298
Close 13815
ReadX 13803 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13822 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13848
QUERY_FILE_INFORMATION 13848
ReadX 13848 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13850
Close 13850
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13848 1568 512 512
ReadX 13848 1536 512 512
ReadX 13848 2176 384 384
ReadX 13848 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13851
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13848 288 2048 2048
ReadX 13848 2336 2048 2048
ReadX 13848 4384 2048 2048
ReadX 13854 2560 2048 2048
ReadX 13854 4608 2048 2048
ReadX 13854 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 13857 8192 4096 4096
Close 13856
Close 13857
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13858
WriteX 13858 15359 1 1
QUERY_FILE_INFORMATION 13858
WriteX 13859 0 512 512
QUERY_FILE_INFORMATION 13854
QUERY_FILE_INFORMATION 13854
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 13854
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13860
Close 13860
WriteX 13864 2560 512 512
WriteX 13864 0 512 512
QUERY_FILE_INFORMATION 13864
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13865
QUERY_FILE_INFORMATION 13865
ReadX 13865 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13867
Close 13867
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13868
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 13865 2560 2048 2048
ReadX 13865 4608 2048 2048
ReadX 13865 6656 2048 2048
ReadX 13871 5632 2048 2048
ReadX 13871 7680 2048 2048
ReadX 13871 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13873
WriteX 13873 11990 1 1
QUERY_FILE_INFORMATION 13873
WriteX 13874 0 512 512
QUERY_FILE_INFORMATION 13871
QUERY_FILE_INFORMATION 13871
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 13871
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13875
Close 13875
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13880
Close 13880
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13886
QUERY_FILE_INFORMATION 13886
ReadX 13886 528 2048 2048
ReadX 13886 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13890
Close 13890
ReadX 13886 1384 2048 2048
ReadX 13886 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13894
Close 13894
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13898
Close 13898
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13904
Close 13904
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13910
Close 13910
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13939
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13941
Close 13941
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13947
Close 13947
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13965
Close 13965
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13984
Close 13984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13987 8192 512 512
ReadX 13987 8704 512 512
Close 13987
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13988
Close 13988
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13993
ReadX 13993 0 8192 8192
Close 13993
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13994
Close 13994
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13997 16384 8192 8192
ReadX 13997 24576 8192 8192
Close 13997
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13999
Close 13999
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14001
WriteX 14001 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14016
QUERY_FILE_INFORMATION 14016
Close 14016
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14017
Close 14017
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14019
WriteX 14019 0 28489 28489
Close 14019
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14020
Close 14020
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14023
ReadX 14023 0 8192 8192
Close 14023
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14024
Close 14024
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 14027 65536 8192 8192
Close 14027
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14029
Close 14029
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14031
WriteX 14031 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14035
QUERY_FILE_INFORMATION 14035
Close 14035
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14036
Close 14036
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14038
WriteX 14038 0 30183 30183
Close 14038
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14039
Close 14039
WriteX 14040 1532 510 510
WriteX 14040 2042 168 168
Close 14040
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14041
Close 14041
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14045
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14046
QUERY_FILE_INFORMATION 14046
ReadX 14046 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 14047
Close 14047
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 14048
WriteX 14048 1535 1 1
QUERY_FILE_INFORMATION 14048
Close 14049
WriteX 14048 0 4096 4096
Close 14048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 14050
Close 14050
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 14052
WriteX 14052 1535 1 1
QUERY_FILE_INFORMATION 14052
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14054 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14056
Close 14056
QUERY_FILE_INFORMATION 14058
WriteX 14058 0 53077 53077
Close 14058
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 14059
WriteX 14059 1535 1 1
QUERY_FILE_INFORMATION 14059
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14063
Close 14063
WriteX 14065 0 7983 7983
Close 14065
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14067
Close 14067
WriteX 14069 458687 65 65
WriteX 14069 458752 46731 46731
Close 14069
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 14070
WriteX 14070 1535 1 1
QUERY_FILE_INFORMATION 14070
Close 14072
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14073
QUERY_FILE_INFORMATION 14073
ReadX 14073 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14074
Close 14074
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14075
WriteX 14075 2047 1 1
QUERY_FILE_INFORMATION 14075
Close 14076
WriteX 14075 0 42388 42388
Close 14075
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14077
Close 14077
QUERY_FILE_INFORMATION 14078
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14079
WriteX 14079 2047 1 1
QUERY_FILE_INFORMATION 14079
QUERY_FILE_INFORMATION 14081
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14083
Close 14083
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14093
Close 14093
Close 12327
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12330
Close 12330
Close 12333
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12336
Close 12336
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12340
Close 12340
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12344
Close 12344
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12348
Close 12348
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12352
Close 12352
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12356
Close 12356
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12360
Close 12360
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12364
Close 12364
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12366
Close 12366
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12368
Close 12368
Close 12370
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 12382
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12385
Close 12385
Close 12388
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12391
Close 12391
Close 12394
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12397
Close 12397
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12401
Close 12401
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12405
Close 12405
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12409
Close 12409
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12413
Close 12413
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12417
Close 12417
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12420
Close 12420
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12424
Close 12424
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12428
Close 12428
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12467
Close 12467
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12469
WriteX 12469 15 1 1
WriteX 12469 0 10575 10575
Flush 12469
Close 12469
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12470
Close 12470
Close 12464
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12477
Close 12477
WriteX 12479 589824 35257 35257
Close 12479
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12481
Close 12481
ReadX 12490 1025 2048 2048
ReadX 12490 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12492
Close 12492
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12494
WriteX 12494 15 1 1
WriteX 12494 0 11588 11588
Flush 12494
Close 12494
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12495
Close 12495
ReadX 12500 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12502
Close 12502
ReadX 12489 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12506
Close 12506
Close 12515
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12516
Close 12516
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12517
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12517 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12520
ReadX 12520 0 511 511
ReadX 12517 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12517
Close 12518
Close 12519
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12524
ReadX 12524 0 511 511
ReadX 12521 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12525
FIND_FIRST \clients\client1\~dmtmp\*
Close 12525
ReadX 12541 293 2 2
Close 12541
ReadX 12537 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12537
Close 12538
Close 12539
Close 12526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12542
Close 12542
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12543
ReadX 12543 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12544
ReadX 12552 293 2 2
Close 12552
ReadX 12548 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12580
ReadX 12580 0 511 511
ReadX 12580 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12580
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12581
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12587
Close 12587
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12588
ReadX 12588 0 511 511
ReadX 12588 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12608
ReadX 12608 0 41 41
ReadX 12596 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 12615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12616
Close 12616
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12617
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12617 0 511 511
ReadX 12634 241 298 298
Close 12634
ReadX 12622 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 12669 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12670
ReadX 12670 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12670
Close 12669
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12688
Close 12688
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12689
ReadX 12689 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12690
ReadX 12706 241 298 298
Close 12706
ReadX 12694 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 12713 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12714
Close 12714
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12715 0 511 511
ReadX 12724 293 2 2
Close 12724
ReadX 12720 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 12731 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12732
Close 12732
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12733
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12733 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12753
ReadX 12753 0 41 41
ReadX 12741 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12783
ReadX 12783 0 511 511
ReadX 12783 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12783
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12807
Close 12807
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12808
ReadX 12808 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12809
ReadX 12812 293 2 2
Close 12812
ReadX 12808 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 12808 384 2048 2048
ReadX 12808 768 16384 16384
ReadX 12808 1792 14336 14336
Close 12809
Close 12810
Close 12811
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12813
Close 12813
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12814
ReadX 12814 0 511 511
ReadX 12814 0 530 530
Close 12819
Close 12816
Close 12817
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12828
Close 12828
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12829
QUERY_FILE_INFORMATION 12829
ReadX 12829 0 64 64
Close 12847
Close 12848
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12850
ReadX 12850 0 511 511
ReadX 12850 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12862
ReadX 12862 0 41 41
ReadX 12850 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12885
ReadX 12885 0 511 511
ReadX 12885 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12885
WriteX 12869 2048 2048 2048
WriteX 12869 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12901
ReadX 12901 0 511 511
ReadX 12901 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12901
Close 12869
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12903
Close 12903
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12904
QUERY_FILE_INFORMATION 12904
ReadX 12904 0 64 64
Close 12907
Close 12908
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12918
ReadX 12918 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12919
ReadX 12930 241 298 298
Close 12930
ReadX 12918 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12937 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12963
QUERY_FILE_INFORMATION 12963
ReadX 12963 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12965
Close 12965
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12963 1568 512 512
ReadX 12963 1536 512 512
ReadX 12963 2176 384 384
ReadX 12963 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12966
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12963 288 2048 2048
ReadX 12963 2336 2048 2048
ReadX 12963 4384 2048 2048
ReadX 12969 2560 2048 2048
ReadX 12969 4608 2048 2048
ReadX 12969 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 12972 8192 4096 4096
Close 12971
Close 12972
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12973
WriteX 12973 15359 1 1
QUERY_FILE_INFORMATION 12973
WriteX 12974 0 512 512
QUERY_FILE_INFORMATION 12969
QUERY_FILE_INFORMATION 12969
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 12969
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12975
Close 12975
WriteX 12979 2560 512 512
WriteX 12979 0 512 512
QUERY_FILE_INFORMATION 12979
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12982
Close 12982
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12983
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 12980 2560 2048 2048
ReadX 12980 4608 2048 2048
ReadX 12980 6656 2048 2048
ReadX 12986 5632 2048 2048
ReadX 12986 7680 2048 2048
ReadX 12986 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12988
WriteX 12988 11990 1 1
QUERY_FILE_INFORMATION 12988
WriteX 12989 0 512 512
QUERY_FILE_INFORMATION 12986
QUERY_FILE_INFORMATION 12986
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 12986
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12990
Close 12990
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12995
Close 12995
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13001
QUERY_FILE_INFORMATION 13001
ReadX 13001 528 2048 2048
ReadX 13001 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13005
Close 13005
ReadX 13001 1384 2048 2048
ReadX 13001 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13009
Close 13009
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13013
Close 13013
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13019
Close 13019
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13025
Close 13025
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13054
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13056
Close 13056
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13062
Close 13062
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13080
Close 13080
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13099
Close 13099
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13102 8192 512 512
ReadX 13102 8704 512 512
Close 13102
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13103
Close 13103
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13108
ReadX 13108 0 8192 8192
Close 13108
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13109
Close 13109
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13112 16384 8192 8192
ReadX 13112 24576 8192 8192
Close 13112
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13114
Close 13114
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13116
WriteX 13116 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13131
QUERY_FILE_INFORMATION 13131
Close 13131
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13132
Close 13132
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13134
WriteX 13134 0 28489 28489
Close 13134
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13135
Close 13135
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13138
ReadX 13138 0 8192 8192
Close 13138
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13139
Close 13139
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13142 65536 8192 8192
Close 13142
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13144
Close 13144
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13146
WriteX 13146 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13150
QUERY_FILE_INFORMATION 13150
Close 13150
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13151
Close 13151
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13153
WriteX 13153 0 30183 30183
Close 13153
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13154
Close 13154
WriteX 13155 1532 510 510
WriteX 13155 2042 168 168
Close 13155
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13156
Close 13156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13160
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13161
QUERY_FILE_INFORMATION 13161
ReadX 13161 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13162
Close 13162
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13163
WriteX 13163 1535 1 1
QUERY_FILE_INFORMATION 13163
Close 13164
WriteX 13163 0 4096 4096
Close 13163
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13165
Close 13165
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13167
WriteX 13167 1535 1 1
QUERY_FILE_INFORMATION 13167
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13169 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13171
Close 13171
QUERY_FILE_INFORMATION 13173
WriteX 13173 0 53077 53077
Close 13173
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13174
WriteX 13174 1535 1 1
QUERY_FILE_INFORMATION 13174
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13178
Close 13178
WriteX 13180 0 7983 7983
Close 13180
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13182
Close 13182
WriteX 13184 458687 65 65
WriteX 13184 458752 46731 46731
Close 13184
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13185
WriteX 13185 1535 1 1
QUERY_FILE_INFORMATION 13185
Close 13187
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13188
QUERY_FILE_INFORMATION 13188
ReadX 13188 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13189
Close 13189
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13190
WriteX 13190 2047 1 1
QUERY_FILE_INFORMATION 13190
Close 13191
WriteX 13190 0 42388 42388
Close 13190
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13192
Close 13192
QUERY_FILE_INFORMATION 13193
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13194
WriteX 13194 2047 1 1
QUERY_FILE_INFORMATION 13194
QUERY_FILE_INFORMATION 13196
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13198
Close 13198
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13208
Close 13208
Close 13211
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13214
Close 13214
Close 13217
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13220
Close 13220
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13224
Close 13224
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13228
Close 13228
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13232
Close 13232
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13236
Close 13236
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13240
Close 13240
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13244
Close 13244
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13248
Close 13248
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13250
Close 13250
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13252
Close 13252
Close 13254
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 13266
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13269
Close 13269
Close 13272
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13275
Close 13275
Close 13278
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13281
Close 13281
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13285
Close 13285
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13289
Close 13289
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13293
Close 13293
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13297
Close 13297
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13301
Close 13301
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13304
Close 13304
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13308
Close 13308
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13312
Close 13312
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13351
Close 13351
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13353
WriteX 13353 15 1 1
WriteX 13353 0 10575 10575
Flush 13353
Close 13353
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13354
Close 13354
Close 13348
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13361
Close 13361
WriteX 13363 589824 35257 35257
Close 13363
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13365
Close 13365
ReadX 13374 1025 2048 2048
ReadX 13374 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13376
Close 13376
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13378
WriteX 13378 15 1 1
WriteX 13378 0 11588 11588
Flush 13378
Close 13378
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13379
Close 13379
ReadX 13384 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13386
Close 13386
ReadX 13373 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13390
Close 13390
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13400
Close 13400
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13401
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13401 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13404
ReadX 13404 0 511 511
ReadX 13401 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13401
Close 13402
Close 13403
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13408
ReadX 13408 0 511 511
ReadX 13405 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13409
FIND_FIRST \clients\client1\~dmtmp\*
Close 13409
ReadX 13425 293 2 2
Close 13425
ReadX 13421 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13421
Close 13422
Close 13423
Close 13410
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13426
Close 13426
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13427
ReadX 13427 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13428
ReadX 13436 293 2 2
Close 13436
ReadX 13432 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13464
ReadX 13464 0 511 511
ReadX 13464 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13464
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13465
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13471
Close 13471
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13472
ReadX 13472 0 511 511
ReadX 13472 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13492
ReadX 13492 0 41 41
ReadX 13480 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 13499 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13500
Close 13500
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13501
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13501 0 511 511
ReadX 13518 241 298 298
Close 13518
ReadX 13506 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 13553 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13554
ReadX 13554 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13554
Close 13553
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13572
Close 13572
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13573
ReadX 13573 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13574
ReadX 13590 241 298 298
Close 13590
ReadX 13578 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 13597 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13598
Close 13598
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13599 0 511 511
ReadX 13608 293 2 2
Close 13608
ReadX 13604 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 13615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13616
Close 13616
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13617
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13617 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13637
ReadX 13637 0 41 41
ReadX 13625 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13667
ReadX 13667 0 511 511
ReadX 13667 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13667
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13691
Close 13691
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13692
ReadX 13692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13693
ReadX 13696 293 2 2
Close 13696
ReadX 13692 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 13692 384 2048 2048
ReadX 13692 768 16384 16384
ReadX 13692 1792 14336 14336
Close 13693
Close 13694
Close 13695
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13697
Close 13697
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13698
ReadX 13698 0 511 511
ReadX 13698 0 530 530
Close 13703
Close 13700
Close 13701
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13712
Close 13712
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13713
QUERY_FILE_INFORMATION 13713
ReadX 13713 0 64 64
Close 13731
Close 13732
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13734
ReadX 13734 0 511 511
ReadX 13734 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13746
ReadX 13746 0 41 41
ReadX 13734 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13769
ReadX 13769 0 511 511
ReadX 13769 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13769
WriteX 13753 2048 2048 2048
WriteX 13753 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13785
ReadX 13785 0 511 511
ReadX 13785 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13785
Close 13753
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13787
Close 13787
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13788
QUERY_FILE_INFORMATION 13788
ReadX 13788 0 64 64
Close 13791
Close 13792
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13802
ReadX 13802 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13803
ReadX 13814 241 298 298
Close 13814
ReadX 13802 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13821 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13847
QUERY_FILE_INFORMATION 13847
ReadX 13847 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13849
Close 13849
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13847 1568 512 512
ReadX 13847 1536 512 512
ReadX 13847 2176 384 384
ReadX 13847 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13850
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13847 288 2048 2048
ReadX 13847 2336 2048 2048
ReadX 13847 4384 2048 2048
ReadX 13853 2560 2048 2048
ReadX 13853 4608 2048 2048
ReadX 13853 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 13856 8192 4096 4096
Close 13855
Close 13856
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13857
WriteX 13857 15359 1 1
QUERY_FILE_INFORMATION 13857
WriteX 13858 0 512 512
QUERY_FILE_INFORMATION 13853
QUERY_FILE_INFORMATION 13853
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 13853
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13859
Close 13859
WriteX 13863 2560 512 512
WriteX 13863 0 512 512
QUERY_FILE_INFORMATION 13863
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13864
QUERY_FILE_INFORMATION 13864
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13866
Close 13866
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13867
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 13864 2560 2048 2048
ReadX 13864 4608 2048 2048
ReadX 13864 6656 2048 2048
ReadX 13870 5632 2048 2048
ReadX 13870 7680 2048 2048
ReadX 13870 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13872
WriteX 13872 11990 1 1
QUERY_FILE_INFORMATION 13872
WriteX 13873 0 512 512
QUERY_FILE_INFORMATION 13870
QUERY_FILE_INFORMATION 13870
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 13870
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13874
Close 13874
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13879
Close 13879
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13885
QUERY_FILE_INFORMATION 13885
ReadX 13885 528 2048 2048
ReadX 13885 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13889
Close 13889
ReadX 13885 1384 2048 2048
ReadX 13885 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13893
Close 13893
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13897
Close 13897
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13903
Close 13903
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13909
Close 13909
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13938
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13940
Close 13940
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13946
Close 13946
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13964
Close 13964
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13983
Close 13983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13986 8192 512 512
ReadX 13986 8704 512 512
Close 13986
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13987
Close 13987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13992
ReadX 13992 0 8192 8192
Close 13992
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13993
Close 13993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13996 16384 8192 8192
ReadX 13996 24576 8192 8192
Close 13996
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13998
Close 13998
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14000
WriteX 14000 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14015
QUERY_FILE_INFORMATION 14015
Close 14015
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14016
Close 14016
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14018
WriteX 14018 0 28489 28489
Close 14018
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14019
Close 14019
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14022
ReadX 14022 0 8192 8192
Close 14022
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14023
Close 14023
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 14026 65536 8192 8192
Close 14026
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14030
WriteX 14030 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14034
QUERY_FILE_INFORMATION 14034
Close 14034
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14035
Close 14035
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14037
WriteX 14037 0 30183 30183
Close 14037
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14038
Close 14038
WriteX 14039 1532 510 510
WriteX 14039 2042 168 168
Close 14039
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14040
Close 14040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14044
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14045
QUERY_FILE_INFORMATION 14045
ReadX 14045 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 14046
Close 14046
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 14047
WriteX 14047 1535 1 1
QUERY_FILE_INFORMATION 14047
Close 14048
WriteX 14047 0 4096 4096
Close 14047
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 14049
Close 14049
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 14051
WriteX 14051 1535 1 1
QUERY_FILE_INFORMATION 14051
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14053 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14055
Close 14055
QUERY_FILE_INFORMATION 14057
WriteX 14057 0 53077 53077
Close 14057
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 14058
WriteX 14058 1535 1 1
QUERY_FILE_INFORMATION 14058
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14062
Close 14062
WriteX 14064 0 7983 7983
Close 14064
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14066
Close 14066
WriteX 14068 458687 65 65
WriteX 14068 458752 46731 46731
Close 14068
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 14069
WriteX 14069 1535 1 1
QUERY_FILE_INFORMATION 14069
Close 14071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14072
QUERY_FILE_INFORMATION 14072
ReadX 14072 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14073
Close 14073
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14074
WriteX 14074 2047 1 1
QUERY_FILE_INFORMATION 14074
Close 14075
WriteX 14074 0 42388 42388
Close 14074
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14076
Close 14076
QUERY_FILE_INFORMATION 14077
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14078
WriteX 14078 2047 1 1
QUERY_FILE_INFORMATION 14078
QUERY_FILE_INFORMATION 14080
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14082
Close 14082
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14092
Close 14092
Close 14095
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 5811
Close 5811
Close 5814
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5817
Close 5817
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5821
Close 5821
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5825
Close 5825
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5829
Close 5829
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5833
Close 5833
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5837
Close 5837
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5841
Close 5841
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 5845
Close 5845
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 5847
Close 5847
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 5849
Close 5849
Close 5851
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 5863
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 5866
Close 5866
Close 5869
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 5872
Close 5872
Close 5875
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5878
Close 5878
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5882
Close 5882
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5886
Close 5886
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5890
Close 5890
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 5894
Close 5894
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 5898
Close 5898
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5901
Close 5901
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5905
Close 5905
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5909
Close 5909
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 5948
Close 5948
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5950
WriteX 5950 15 1 1
WriteX 5950 0 10575 10575
Flush 5950
Close 5950
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5951
Close 5951
Close 5945
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 5958
Close 5958
WriteX 5960 589824 35257 35257
Close 5960
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 5962
Close 5962
ReadX 5971 1025 2048 2048
ReadX 5971 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 5973
Close 5973
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5975
WriteX 5975 15 1 1
WriteX 5975 0 11588 11588
Flush 5975
Close 5975
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5976
Close 5976
ReadX 5981 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 5983
Close 5983
ReadX 5970 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 5987
Close 5987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 5997
Close 5997
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 5998
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 5998 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6001
ReadX 6001 0 511 511
ReadX 5998 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 5998
Close 5999
Close 6000
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6005
ReadX 6005 0 511 511
ReadX 6002 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 6006
FIND_FIRST \clients\client1\~dmtmp\*
Close 6006
ReadX 6022 293 2 2
Close 6022
ReadX 6018 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6018
Close 6019
Close 6020
Close 6007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6023
Close 6023
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6024
ReadX 6024 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6025
ReadX 6033 293 2 2
Close 6033
ReadX 6029 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6061
ReadX 6061 0 511 511
ReadX 6061 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6061
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6062
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6068
Close 6068
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6069
ReadX 6069 0 511 511
ReadX 6069 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6089
ReadX 6089 0 41 41
ReadX 6077 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 6096 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6097
Close 6097
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6098
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6098 0 511 511
ReadX 6115 241 298 298
Close 6115
ReadX 6103 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 6150 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 6151
ReadX 6151 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6151
Close 6150
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6169
Close 6169
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6170
ReadX 6170 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6171
ReadX 6187 241 298 298
Close 6187
ReadX 6175 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 6194 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6195
Close 6195
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6196
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6196 0 511 511
ReadX 6205 293 2 2
Close 6205
ReadX 6201 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 6212 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6213
Close 6213
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6214
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6214 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6234
ReadX 6234 0 41 41
ReadX 6222 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6264
ReadX 6264 0 511 511
ReadX 6264 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6264
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6288
Close 6288
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6289
ReadX 6289 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6290
ReadX 6293 293 2 2
Close 6293
ReadX 6289 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 6289 384 2048 2048
ReadX 6289 768 16384 16384
ReadX 6289 1792 14336 14336
Close 6290
Close 6291
Close 6292
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6294
Close 6294
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6295
ReadX 6295 0 511 511
ReadX 6295 0 530 530
Close 6300
Close 6297
Close 6298
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6309
Close 6309
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6310
QUERY_FILE_INFORMATION 6310
ReadX 6310 0 64 64
Close 6328
Close 6329
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6331
ReadX 6331 0 511 511
ReadX 6331 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6343
ReadX 6343 0 41 41
ReadX 6331 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6366
ReadX 6366 0 511 511
ReadX 6366 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6366
WriteX 6350 2048 2048 2048
WriteX 6350 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6382
ReadX 6382 0 511 511
ReadX 6382 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6382
Close 6350
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6384
Close 6384
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6385
QUERY_FILE_INFORMATION 6385
ReadX 6385 0 64 64
Close 6388
Close 6389
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6399
ReadX 6399 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6400
ReadX 6411 241 298 298
Close 6411
ReadX 6399 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 6418 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 6444
QUERY_FILE_INFORMATION 6444
ReadX 6444 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 6446
Close 6446
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 6444 1568 512 512
ReadX 6444 1536 512 512
ReadX 6444 2176 384 384
ReadX 6444 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 6447
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 6444 288 2048 2048
ReadX 6444 2336 2048 2048
ReadX 6444 4384 2048 2048
ReadX 6450 2560 2048 2048
ReadX 6450 4608 2048 2048
ReadX 6450 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 6453 8192 4096 4096
Close 6452
Close 6453
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 6454
WriteX 6454 15359 1 1
QUERY_FILE_INFORMATION 6454
WriteX 6455 0 512 512
QUERY_FILE_INFORMATION 6450
QUERY_FILE_INFORMATION 6450
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 6450
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 6456
Close 6456
WriteX 6460 2560 512 512
WriteX 6460 0 512 512
QUERY_FILE_INFORMATION 6460
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 6461
QUERY_FILE_INFORMATION 6461
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 6463
Close 6463
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 6464
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 6461 2560 2048 2048
ReadX 6461 4608 2048 2048
ReadX 6461 6656 2048 2048
ReadX 6467 5632 2048 2048
ReadX 6467 7680 2048 2048
ReadX 6467 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 6469
WriteX 6469 11990 1 1
QUERY_FILE_INFORMATION 6469
WriteX 6470 0 512 512
QUERY_FILE_INFORMATION 6467
QUERY_FILE_INFORMATION 6467
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 6467
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 6471
Close 6471
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 6476
Close 6476
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 6482
QUERY_FILE_INFORMATION 6482
ReadX 6482 528 2048 2048
ReadX 6482 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 6486
Close 6486
ReadX 6482 1384 2048 2048
ReadX 6482 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 6490
Close 6490
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 6494
Close 6494
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6500
Close 6500
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 6506
Close 6506
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 6535
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6537
Close 6537
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 6543
Close 6543
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 6561
Close 6561
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6580
Close 6580
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 6583 8192 512 512
ReadX 6583 8704 512 512
Close 6583
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6584
Close 6584
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 6589
ReadX 6589 0 8192 8192
Close 6589
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6590
Close 6590
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 6593 16384 8192 8192
ReadX 6593 24576 8192 8192
Close 6593
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 6595
Close 6595
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 6597
WriteX 6597 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 6612
QUERY_FILE_INFORMATION 6612
Close 6612
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 6613
Close 6613
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 6615
WriteX 6615 0 28489 28489
Close 6615
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 6616
Close 6616
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 6619
ReadX 6619 0 8192 8192
Close 6619
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6620
Close 6620
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 6623 65536 8192 8192
Close 6623
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 6625
Close 6625
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 6627
WriteX 6627 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 6631
QUERY_FILE_INFORMATION 6631
Close 6631
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 6632
Close 6632
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 6634
WriteX 6634 0 30183 30183
Close 6634
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 6635
Close 6635
WriteX 6636 1532 510 510
WriteX 6636 2042 168 168
Close 6636
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6637
Close 6637
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 6641
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 6642
QUERY_FILE_INFORMATION 6642
ReadX 6642 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 6643
Close 6643
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 6644
WriteX 6644 1535 1 1
QUERY_FILE_INFORMATION 6644
Close 6645
WriteX 6644 0 4096 4096
Close 6644
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 6646
Close 6646
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 6648
WriteX 6648 1535 1 1
QUERY_FILE_INFORMATION 6648
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6650 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 6652
Close 6652
QUERY_FILE_INFORMATION 6654
WriteX 6654 0 53077 53077
Close 6654
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 6655
WriteX 6655 1535 1 1
QUERY_FILE_INFORMATION 6655
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 6659
Close 6659
WriteX 6661 0 7983 7983
Close 6661
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 6663
Close 6663
WriteX 6665 458687 65 65
WriteX 6665 458752 46731 46731
Close 6665
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 6666
WriteX 6666 1535 1 1
QUERY_FILE_INFORMATION 6666
Close 6668
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 6669
QUERY_FILE_INFORMATION 6669
ReadX 6669 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 6670
Close 6670
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 6671
WriteX 6671 2047 1 1
QUERY_FILE_INFORMATION 6671
Close 6672
WriteX 6671 0 42388 42388
Close 6671
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 6673
Close 6673
QUERY_FILE_INFORMATION 6674
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 6675
WriteX 6675 2047 1 1
QUERY_FILE_INFORMATION 6675
QUERY_FILE_INFORMATION 6677
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 6679
Close 6679
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 6689
Close 6689
Close 6692
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 6695
Close 6695
Close 6698
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6701
Close 6701
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6705
Close 6705
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6709
Close 6709
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6713
Close 6713
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6717
Close 6717
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6721
Close 6721
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6725
Close 6725
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 6729
Close 6729
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 6731
Close 6731
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 6733
Close 6733
Close 6735
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 6747
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 6750
Close 6750
Close 6753
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 6756
Close 6756
Close 6759
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6762
Close 6762
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6766
Close 6766
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6770
Close 6770
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6774
Close 6774
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 6778
Close 6778
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 6782
Close 6782
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6785
Close 6785
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6789
Close 6789
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6793
Close 6793
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 6832
Close 6832
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6834
WriteX 6834 15 1 1
WriteX 6834 0 10575 10575
Flush 6834
Close 6834
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6835
Close 6835
Close 6829
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 6842
Close 6842
WriteX 6844 589824 35257 35257
Close 6844
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 6846
Close 6846
ReadX 6855 1025 2048 2048
ReadX 6855 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 6857
Close 6857
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6859
WriteX 6859 15 1 1
WriteX 6859 0 11588 11588
Flush 6859
Close 6859
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6860
Close 6860
ReadX 6865 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 6867
Close 6867
ReadX 6854 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 6871
Close 6871
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6881
Close 6881
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6882
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6882 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6885
ReadX 6885 0 511 511
ReadX 6882 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6882
Close 6883
Close 6884
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6889
ReadX 6889 0 511 511
ReadX 6886 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 6890
FIND_FIRST \clients\client1\~dmtmp\*
Close 6890
ReadX 6906 293 2 2
Close 6906
ReadX 6902 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6902
Close 6903
Close 6904
Close 6891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6907
Close 6907
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6908
ReadX 6908 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6909
ReadX 6917 293 2 2
Close 6917
ReadX 6913 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6945
ReadX 6945 0 511 511
ReadX 6945 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6945
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6946
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6952
Close 6952
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6953
ReadX 6953 0 511 511
ReadX 6953 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6973
ReadX 6973 0 41 41
ReadX 6961 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 6980 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6981
Close 6981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6982
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6982 0 511 511
ReadX 6999 241 298 298
Close 6999
ReadX 6987 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 7034 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 7035
ReadX 7035 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7035
Close 7034
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7053
Close 7053
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7054
ReadX 7054 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7055
ReadX 7071 241 298 298
Close 7071
ReadX 7059 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 7078 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7079
Close 7079
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7080
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7080 0 511 511
ReadX 7089 293 2 2
Close 7089
ReadX 7085 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 7096 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7097
Close 7097
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7098
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7098 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7118
ReadX 7118 0 41 41
ReadX 7106 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7148
ReadX 7148 0 511 511
ReadX 7148 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7148
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7172
Close 7172
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7173
ReadX 7173 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7174
ReadX 7177 293 2 2
Close 7177
ReadX 7173 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 7173 384 2048 2048
ReadX 7173 768 16384 16384
ReadX 7173 1792 14336 14336
Close 7174
Close 7175
Close 7176
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7178
Close 7178
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7179
ReadX 7179 0 511 511
ReadX 7179 0 530 530
Close 7184
Close 7181
Close 7182
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7193
Close 7193
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7194
QUERY_FILE_INFORMATION 7194
ReadX 7194 0 64 64
Close 7212
Close 7213
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7215
ReadX 7215 0 511 511
ReadX 7215 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7227
ReadX 7227 0 41 41
ReadX 7215 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7250
ReadX 7250 0 511 511
ReadX 7250 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7250
WriteX 7234 2048 2048 2048
WriteX 7234 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 7266
ReadX 7266 0 511 511
ReadX 7266 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7266
Close 7234
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7268
Close 7268
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 7269
QUERY_FILE_INFORMATION 7269
ReadX 7269 0 64 64
Close 7272
Close 7273
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7283
ReadX 7283 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7284
ReadX 7295 241 298 298
Close 7295
ReadX 7283 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 7302 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 7328
QUERY_FILE_INFORMATION 7328
ReadX 7328 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 7330
Close 7330
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 7328 1568 512 512
ReadX 7328 1536 512 512
ReadX 7328 2176 384 384
ReadX 7328 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 7331
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 7328 288 2048 2048
ReadX 7328 2336 2048 2048
ReadX 7328 4384 2048 2048
ReadX 7334 2560 2048 2048
ReadX 7334 4608 2048 2048
ReadX 7334 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 7337 8192 4096 4096
Close 7336
Close 7337
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 7338
WriteX 7338 15359 1 1
QUERY_FILE_INFORMATION 7338
WriteX 7339 0 512 512
QUERY_FILE_INFORMATION 7334
QUERY_FILE_INFORMATION 7334
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 7334
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 7340
Close 7340
WriteX 7344 2560 512 512
WriteX 7344 0 512 512
QUERY_FILE_INFORMATION 7344
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 7345
QUERY_FILE_INFORMATION 7345
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 7347
Close 7347
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 7348
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 7345 2560 2048 2048
ReadX 7345 4608 2048 2048
ReadX 7345 6656 2048 2048
ReadX 7351 5632 2048 2048
ReadX 7351 7680 2048 2048
ReadX 7351 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 7353
WriteX 7353 11990 1 1
QUERY_FILE_INFORMATION 7353
WriteX 7354 0 512 512
QUERY_FILE_INFORMATION 7351
QUERY_FILE_INFORMATION 7351
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 7351
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 7355
Close 7355
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 7360
Close 7360
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 7366
QUERY_FILE_INFORMATION 7366
ReadX 7366 528 2048 2048
ReadX 7366 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 7370
Close 7370
ReadX 7366 1384 2048 2048
ReadX 7366 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 7374
Close 7374
ReadX 7366 2432 2048 2048
ReadX 7366 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 7378
Close 7378
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 7384
Close 7384
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 7390
Close 7390
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 7419
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 7421
Close 7421
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 7427
Close 7427
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 7445
Close 7445
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7464
Close 7464
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 7467 8192 512 512
ReadX 7467 8704 512 512
Close 7467
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7468
Close 7468
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 7473
ReadX 7473 0 8192 8192
Close 7473
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7474
Close 7474
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 7477 16384 8192 8192
ReadX 7477 24576 8192 8192
Close 7477
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 7479
Close 7479
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 7481
WriteX 7481 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 7496
QUERY_FILE_INFORMATION 7496
Close 7496
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 7497
Close 7497
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 7499
WriteX 7499 0 28489 28489
Close 7499
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 7500
Close 7500
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 7503
ReadX 7503 0 8192 8192
Close 7503
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7504
Close 7504
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 7507 65536 8192 8192
Close 7507
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 7509
Close 7509
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 7511
WriteX 7511 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 7515
QUERY_FILE_INFORMATION 7515
Close 7515
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 7516
Close 7516
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 7518
WriteX 7518 0 30183 30183
Close 7518
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 7519
Close 7519
WriteX 7520 1532 510 510
WriteX 7520 2042 168 168
Close 7520
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 7521
Close 7521
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 7525
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 7526
QUERY_FILE_INFORMATION 7526
ReadX 7526 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 7527
Close 7527
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 7528
WriteX 7528 1535 1 1
QUERY_FILE_INFORMATION 7528
Close 7529
WriteX 7528 0 4096 4096
Close 7528
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 7530
Close 7530
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 7532
WriteX 7532 1535 1 1
QUERY_FILE_INFORMATION 7532
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 7534 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 7536
Close 7536
QUERY_FILE_INFORMATION 7538
WriteX 7538 0 53077 53077
Close 7538
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 7539
WriteX 7539 1535 1 1
QUERY_FILE_INFORMATION 7539
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 7543
Close 7543
WriteX 7545 0 7983 7983
Close 7545
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 7547
Close 7547
WriteX 7549 458687 65 65
WriteX 7549 458752 46731 46731
Close 7549
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 7550
WriteX 7550 1535 1 1
QUERY_FILE_INFORMATION 7550
Close 7552
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 7553
QUERY_FILE_INFORMATION 7553
ReadX 7553 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 7554
Close 7554
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 7555
WriteX 7555 2047 1 1
QUERY_FILE_INFORMATION 7555
Close 7556
WriteX 7555 0 42388 42388
Close 7555
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 7557
Close 7557
QUERY_FILE_INFORMATION 7558
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 7559
WriteX 7559 2047 1 1
QUERY_FILE_INFORMATION 7559
QUERY_FILE_INFORMATION 7561
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 7563
Close 7563
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 7573
Close 7573
Close 7576
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 7579
Close 7579
Close 7582
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7585
Close 7585
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7589
Close 7589
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7593
Close 7593
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 7597
Close 7597
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 7601
Close 7601
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 7605
Close 7605
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 7609
Close 7609
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 7613
Close 7613
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 7615
Close 7615
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 7617
Close 7617
Close 7619
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 7631
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 7634
Close 7634
Close 7637
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 7640
Close 7640
Close 7643
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7646
Close 7646
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7650
Close 7650
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7654
Close 7654
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 7658
Close 7658
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 7662
Close 7662
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 7666
Close 7666
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 7669
Close 7669
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 7673
Close 7673
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 7677
Close 7677
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 7716
Close 7716
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 7718
WriteX 7718 15 1 1
WriteX 7718 0 10575 10575
Flush 7718
Close 7718
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 7719
Close 7719
Close 7713
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 7726
Close 7726
WriteX 7728 589824 35257 35257
Close 7728
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 7730
Close 7730
ReadX 7739 1025 2048 2048
ReadX 7739 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 7741
Close 7741
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 7743
WriteX 7743 15 1 1
WriteX 7743 0 11588 11588
Flush 7743
Close 7743
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 7744
Close 7744
ReadX 7749 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 7751
Close 7751
ReadX 7738 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 7755
Close 7755
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7765
Close 7765
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7766
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7766 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7769
ReadX 7769 0 511 511
ReadX 7766 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7766
Close 7767
Close 7768
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 7773
ReadX 7773 0 511 511
ReadX 7770 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 7774
FIND_FIRST \clients\client1\~dmtmp\*
Close 7774
ReadX 7790 293 2 2
Close 7790
ReadX 7786 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7786
Close 7787
Close 7788
Close 7775
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7791
Close 7791
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7792
ReadX 7792 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 7793
ReadX 7801 293 2 2
Close 7801
ReadX 7797 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 7829
ReadX 7829 0 511 511
ReadX 7829 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7829
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7830
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7836
Close 7836
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7837
ReadX 7837 0 511 511
ReadX 7837 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 7857
ReadX 7857 0 41 41
ReadX 7845 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 7864 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7865
Close 7865
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7866
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7866 0 511 511
ReadX 7883 241 298 298
Close 7883
ReadX 7871 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 7918 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 7919
ReadX 7919 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 7919
Close 7918
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7937
Close 7937
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 7938
ReadX 7938 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 7939
ReadX 7955 241 298 298
Close 7955
ReadX 7943 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 7962 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7963
Close 7963
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 7964
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7964 0 511 511
ReadX 7973 293 2 2
Close 7973
ReadX 7969 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 7980 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7981
Close 7981
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 7982
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 7982 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8002
ReadX 8002 0 41 41
ReadX 7990 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8032
ReadX 8032 0 511 511
ReadX 8032 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8032
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8056
Close 8056
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8057
ReadX 8057 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8058
ReadX 8061 293 2 2
Close 8061
ReadX 8057 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 8057 384 2048 2048
ReadX 8057 768 16384 16384
ReadX 8057 1792 14336 14336
Close 8058
Close 8059
Close 8060
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8062
Close 8062
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8063
ReadX 8063 0 511 511
ReadX 8063 0 530 530
Close 8068
Close 8065
Close 8066
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8077
Close 8077
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8078
QUERY_FILE_INFORMATION 8078
ReadX 8078 0 64 64
Close 8096
Close 8097
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8099
ReadX 8099 0 511 511
ReadX 8099 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8111
ReadX 8111 0 41 41
ReadX 8099 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8134
ReadX 8134 0 511 511
ReadX 8134 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8134
WriteX 8118 2048 2048 2048
WriteX 8118 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8150
ReadX 8150 0 511 511
ReadX 8150 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8150
Close 8118
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8152
Close 8152
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8153
QUERY_FILE_INFORMATION 8153
ReadX 8153 0 64 64
Close 8156
Close 8157
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8167
ReadX 8167 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8168
ReadX 8179 241 298 298
Close 8179
ReadX 8167 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 8186 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 8212
QUERY_FILE_INFORMATION 8212
ReadX 8212 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 8214
Close 8214
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 8212 1568 512 512
ReadX 8212 1536 512 512
ReadX 8212 2176 384 384
ReadX 8212 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 8215
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 8212 288 2048 2048
ReadX 8212 2336 2048 2048
ReadX 8212 4384 2048 2048
ReadX 8218 2560 2048 2048
ReadX 8218 4608 2048 2048
ReadX 8218 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 8221 8192 4096 4096
Close 8220
Close 8221
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 8222
WriteX 8222 15359 1 1
QUERY_FILE_INFORMATION 8222
WriteX 8223 0 512 512
QUERY_FILE_INFORMATION 8218
QUERY_FILE_INFORMATION 8218
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 8218
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 8224
Close 8224
WriteX 8228 2560 512 512
WriteX 8228 0 512 512
QUERY_FILE_INFORMATION 8228
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 8229
QUERY_FILE_INFORMATION 8229
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 8231
Close 8231
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 8232
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 8229 2560 2048 2048
ReadX 8229 4608 2048 2048
ReadX 8229 6656 2048 2048
ReadX 8235 5632 2048 2048
ReadX 8235 7680 2048 2048
ReadX 8235 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 8237
WriteX 8237 11990 1 1
QUERY_FILE_INFORMATION 8237
WriteX 8238 0 512 512
QUERY_FILE_INFORMATION 8235
QUERY_FILE_INFORMATION 8235
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 8235
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 8239
Close 8239
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 8244
Close 8244
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 8250
QUERY_FILE_INFORMATION 8250
ReadX 8250 528 2048 2048
ReadX 8250 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 8254
Close 8254
ReadX 8250 1384 2048 2048
ReadX 8250 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 8258
Close 8258
ReadX 8250 2432 2048 2048
ReadX 8250 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 8262
Close 8262
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 8268
Close 8268
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 8274
Close 8274
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 8303
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 8305
Close 8305
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 8311
Close 8311
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 8329
Close 8329
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8348
Close 8348
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 8351 8192 512 512
ReadX 8351 8704 512 512
Close 8351
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8352
Close 8352
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 8357
ReadX 8357 0 8192 8192
Close 8357
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8358
Close 8358
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 8361 16384 8192 8192
ReadX 8361 24576 8192 8192
Close 8361
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 8363
Close 8363
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 8365
WriteX 8365 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 8380
QUERY_FILE_INFORMATION 8380
Close 8380
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 8381
Close 8381
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 8383
WriteX 8383 0 28489 28489
Close 8383
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 8384
Close 8384
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 8387
ReadX 8387 0 8192 8192
Close 8387
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8388
Close 8388
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 8391 65536 8192 8192
Close 8391
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 8393
Close 8393
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 8395
WriteX 8395 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 8399
QUERY_FILE_INFORMATION 8399
Close 8399
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 8400
Close 8400
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 8402
WriteX 8402 0 30183 30183
Close 8402
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 8403
Close 8403
WriteX 8404 1532 510 510
WriteX 8404 2042 168 168
Close 8404
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 8405
Close 8405
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 8409
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 8410
QUERY_FILE_INFORMATION 8410
ReadX 8410 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 8411
Close 8411
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 8412
WriteX 8412 1535 1 1
QUERY_FILE_INFORMATION 8412
Close 8413
WriteX 8412 0 4096 4096
Close 8412
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 8414
Close 8414
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 8416
WriteX 8416 1535 1 1
QUERY_FILE_INFORMATION 8416
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 8418 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 8420
Close 8420
QUERY_FILE_INFORMATION 8422
WriteX 8422 0 53077 53077
Close 8422
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 8423
WriteX 8423 1535 1 1
QUERY_FILE_INFORMATION 8423
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 8427
Close 8427
WriteX 8429 0 7983 7983
Close 8429
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 8431
Close 8431
WriteX 8433 458687 65 65
WriteX 8433 458752 46731 46731
Close 8433
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 8434
WriteX 8434 1535 1 1
QUERY_FILE_INFORMATION 8434
Close 8436
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 8437
QUERY_FILE_INFORMATION 8437
ReadX 8437 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 8438
Close 8438
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 8439
WriteX 8439 2047 1 1
QUERY_FILE_INFORMATION 8439
Close 8440
WriteX 8439 0 42388 42388
Close 8439
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 8441
Close 8441
QUERY_FILE_INFORMATION 8442
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 8443
WriteX 8443 2047 1 1
QUERY_FILE_INFORMATION 8443
QUERY_FILE_INFORMATION 8445
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 8447
Close 8447
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 8457
Close 8457
Close 8460
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 8463
Close 8463
Close 8466
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8469
Close 8469
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8473
Close 8473
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8477
Close 8477
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 8481
Close 8481
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 8485
Close 8485
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 8489
Close 8489
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 8493
Close 8493
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 8497
Close 8497
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 8499
Close 8499
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 8501
Close 8501
Close 8503
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 8515
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 8518
Close 8518
Close 8521
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 8524
Close 8524
Close 8527
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8530
Close 8530
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8534
Close 8534
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8538
Close 8538
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 8542
Close 8542
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 8546
Close 8546
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 8550
Close 8550
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 8553
Close 8553
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 8557
Close 8557
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 8561
Close 8561
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 8600
Close 8600
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 8602
WriteX 8602 15 1 1
WriteX 8602 0 10575 10575
Flush 8602
Close 8602
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 8603
Close 8603
Close 8597
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 8610
Close 8610
WriteX 8612 589824 35257 35257
Close 8612
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 8614
Close 8614
ReadX 8623 1025 2048 2048
ReadX 8623 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 8625
Close 8625
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 8627
WriteX 8627 15 1 1
WriteX 8627 0 11588 11588
Flush 8627
Close 8627
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 8628
Close 8628
ReadX 8633 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 8635
Close 8635
ReadX 8622 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 8639
Close 8639
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8649
Close 8649
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8650
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8650 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8653
ReadX 8653 0 511 511
ReadX 8650 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8650
Close 8651
Close 8652
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 8657
ReadX 8657 0 511 511
ReadX 8654 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 8658
FIND_FIRST \clients\client1\~dmtmp\*
Close 8658
ReadX 8674 293 2 2
Close 8674
ReadX 8670 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8670
Close 8671
Close 8672
Close 8659
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8675
Close 8675
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8676
ReadX 8676 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8677
ReadX 8685 293 2 2
Close 8685
ReadX 8681 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 8713
ReadX 8713 0 511 511
ReadX 8713 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8713
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8714
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8720
Close 8720
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8721
ReadX 8721 0 511 511
ReadX 8721 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8741
ReadX 8741 0 41 41
ReadX 8729 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 8748 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8749
Close 8749
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8750
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8750 0 511 511
ReadX 8767 241 298 298
Close 8767
ReadX 8755 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 8802 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 8803
ReadX 8803 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8803
Close 8802
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8821
Close 8821
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 8822
ReadX 8822 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 8823
ReadX 8839 241 298 298
Close 8839
ReadX 8827 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 8846 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8847
Close 8847
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8848
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8848 0 511 511
ReadX 8857 293 2 2
Close 8857
ReadX 8853 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 8864 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8865
Close 8865
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8866
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 8866 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8886
ReadX 8886 0 41 41
ReadX 8874 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 8916
ReadX 8916 0 511 511
ReadX 8916 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 8916
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8940
Close 8940
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 8941
ReadX 8941 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 8942
ReadX 8945 293 2 2
Close 8945
ReadX 8941 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 8941 384 2048 2048
ReadX 8941 768 16384 16384
ReadX 8941 1792 14336 14336
Close 8942
Close 8943
Close 8944
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8946
Close 8946
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8947
ReadX 8947 0 511 511
ReadX 8947 0 530 530
Close 8952
Close 8949
Close 8950
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8961
Close 8961
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 8962
QUERY_FILE_INFORMATION 8962
ReadX 8962 0 64 64
Close 8980
Close 8981
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 8983
ReadX 8983 0 511 511
ReadX 8983 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 8995
ReadX 8995 0 41 41
ReadX 8983 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9018
ReadX 9018 0 511 511
ReadX 9018 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9018
WriteX 9002 2048 2048 2048
WriteX 9002 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9034
ReadX 9034 0 511 511
ReadX 9034 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9034
Close 9002
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9036
Close 9036
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9037
QUERY_FILE_INFORMATION 9037
ReadX 9037 0 64 64
Close 9040
Close 9041
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9051
ReadX 9051 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9052
ReadX 9063 241 298 298
Close 9063
ReadX 9051 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 9070 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 9096
QUERY_FILE_INFORMATION 9096
ReadX 9096 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 9098
Close 9098
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 9096 1568 512 512
ReadX 9096 1536 512 512
ReadX 9096 2176 384 384
ReadX 9096 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 9099
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 9096 288 2048 2048
ReadX 9096 2336 2048 2048
ReadX 9096 4384 2048 2048
ReadX 9102 2560 2048 2048
ReadX 9102 4608 2048 2048
ReadX 9102 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 9105 8192 4096 4096
Close 9104
Close 9105
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 9106
WriteX 9106 15359 1 1
QUERY_FILE_INFORMATION 9106
WriteX 9107 0 512 512
QUERY_FILE_INFORMATION 9102
QUERY_FILE_INFORMATION 9102
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 9102
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 9108
Close 9108
WriteX 9112 2560 512 512
WriteX 9112 0 512 512
QUERY_FILE_INFORMATION 9112
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 9113
QUERY_FILE_INFORMATION 9113
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 9115
Close 9115
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 9116
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 9113 2560 2048 2048
ReadX 9113 4608 2048 2048
ReadX 9113 6656 2048 2048
ReadX 9119 5632 2048 2048
ReadX 9119 7680 2048 2048
ReadX 9119 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 9121
WriteX 9121 11990 1 1
QUERY_FILE_INFORMATION 9121
WriteX 9122 0 512 512
QUERY_FILE_INFORMATION 9119
QUERY_FILE_INFORMATION 9119
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 9119
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 9123
Close 9123
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 9128
Close 9128
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 9134
QUERY_FILE_INFORMATION 9134
ReadX 9134 528 2048 2048
ReadX 9134 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 9138
Close 9138
ReadX 9134 1384 2048 2048
ReadX 9134 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 9142
Close 9142
ReadX 9134 2432 2048 2048
ReadX 9134 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 9146
Close 9146
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 9152
Close 9152
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 9158
Close 9158
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 9187
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 9189
Close 9189
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 9195
Close 9195
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 9213
Close 9213
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9232
Close 9232
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 9235 8192 512 512
ReadX 9235 8704 512 512
Close 9235
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9236
Close 9236
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 9241
ReadX 9241 0 8192 8192
Close 9241
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9242
Close 9242
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 9245 16384 8192 8192
ReadX 9245 24576 8192 8192
Close 9245
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 9247
Close 9247
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 9249
WriteX 9249 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 9264
QUERY_FILE_INFORMATION 9264
Close 9264
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 9265
Close 9265
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 9267
WriteX 9267 0 28489 28489
Close 9267
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 9268
Close 9268
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 9271
ReadX 9271 0 8192 8192
Close 9271
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9272
Close 9272
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 9275 65536 8192 8192
Close 9275
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 9277
Close 9277
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 9279
WriteX 9279 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 9283
QUERY_FILE_INFORMATION 9283
Close 9283
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 9284
Close 9284
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 9286
WriteX 9286 0 30183 30183
Close 9286
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 9287
Close 9287
WriteX 9288 1532 510 510
WriteX 9288 2042 168 168
Close 9288
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 9289
Close 9289
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 9293
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 9294
QUERY_FILE_INFORMATION 9294
ReadX 9294 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 9295
Close 9295
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 9296
WriteX 9296 1535 1 1
QUERY_FILE_INFORMATION 9296
Close 9297
WriteX 9296 0 4096 4096
Close 9296
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 9298
Close 9298
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 9300
WriteX 9300 1535 1 1
QUERY_FILE_INFORMATION 9300
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 9302 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 9304
Close 9304
QUERY_FILE_INFORMATION 9306
WriteX 9306 0 53077 53077
Close 9306
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 9307
WriteX 9307 1535 1 1
QUERY_FILE_INFORMATION 9307
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 9311
Close 9311
WriteX 9313 0 7983 7983
Close 9313
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 9315
Close 9315
WriteX 9317 458687 65 65
WriteX 9317 458752 46731 46731
Close 9317
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 9318
WriteX 9318 1535 1 1
QUERY_FILE_INFORMATION 9318
Close 9320
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 9321
QUERY_FILE_INFORMATION 9321
ReadX 9321 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 9322
Close 9322
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 9323
WriteX 9323 2047 1 1
QUERY_FILE_INFORMATION 9323
Close 9324
WriteX 9323 0 42388 42388
Close 9323
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 9325
Close 9325
QUERY_FILE_INFORMATION 9326
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 9327
WriteX 9327 2047 1 1
QUERY_FILE_INFORMATION 9327
QUERY_FILE_INFORMATION 9329
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 9331
Close 9331
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 9341
Close 9341
Close 9344
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 9347
Close 9347
Close 9350
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9353
Close 9353
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9357
Close 9357
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9361
Close 9361
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 9365
Close 9365
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 9369
Close 9369
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 9373
Close 9373
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 9377
Close 9377
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 9381
Close 9381
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 9383
Close 9383
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 9385
Close 9385
Close 9387
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 9399
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 9402
Close 9402
Close 9405
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 9408
Close 9408
Close 9411
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9414
Close 9414
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9418
Close 9418
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9422
Close 9422
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 9426
Close 9426
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 9430
Close 9430
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 9434
Close 9434
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 9437
Close 9437
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 9441
Close 9441
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 9445
Close 9445
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 9484
Close 9484
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 9486
WriteX 9486 15 1 1
WriteX 9486 0 10575 10575
Flush 9486
Close 9486
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 9487
Close 9487
Close 9481
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 9494
Close 9494
WriteX 9496 589824 35257 35257
Close 9496
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 9498
Close 9498
ReadX 9507 1025 2048 2048
ReadX 9507 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 9509
Close 9509
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 9511
WriteX 9511 15 1 1
WriteX 9511 0 11588 11588
Flush 9511
Close 9511
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 11
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 9512
Close 9512
ReadX 9517 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 9519
Close 9519
ReadX 9506 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 9523
Close 9523
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9533
Close 9533
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9534
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9534 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9537
ReadX 9537 0 511 511
ReadX 9534 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9534
Close 9535
Close 9536
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 9541
ReadX 9541 0 511 511
ReadX 9538 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 9542
FIND_FIRST \clients\client1\~dmtmp\*
Close 9542
ReadX 9558 293 2 2
Close 9558
ReadX 9554 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9554
Close 9555
Close 9556
Close 9543
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9559
Close 9559
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9560
ReadX 9560 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9561
ReadX 9569 293 2 2
Close 9569
ReadX 9565 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 9597
ReadX 9597 0 511 511
ReadX 9597 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9597
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9598
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9604
Close 9604
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9605
ReadX 9605 0 511 511
ReadX 9605 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9625
ReadX 9625 0 41 41
ReadX 9613 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 9632 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9633
Close 9633
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9634
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9634 0 511 511
ReadX 9651 241 298 298
Close 9651
ReadX 9639 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 9686 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 9687
ReadX 9687 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9687
Close 9686
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9705
Close 9705
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9706
ReadX 9706 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9707
ReadX 9723 241 298 298
Close 9723
ReadX 9711 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 9730 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9731
Close 9731
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9732
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9732 0 511 511
ReadX 9741 293 2 2
Close 9741
ReadX 9737 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 9748 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9749
Close 9749
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9750
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 9750 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9770
ReadX 9770 0 41 41
ReadX 9758 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9800
ReadX 9800 0 511 511
ReadX 9800 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9800
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9824
Close 9824
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 9825
ReadX 9825 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 9826
ReadX 9829 293 2 2
Close 9829
ReadX 9825 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 9825 384 2048 2048
ReadX 9825 768 16384 16384
ReadX 9825 1792 14336 14336
Close 9826
Close 9827
Close 9828
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9830
Close 9830
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9831
ReadX 9831 0 511 511
ReadX 9831 0 530 530
Close 9836
Close 9833
Close 9834
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9845
Close 9845
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9846
QUERY_FILE_INFORMATION 9846
ReadX 9846 0 64 64
Close 9864
Close 9865
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 9867
ReadX 9867 0 511 511
ReadX 9867 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 9879
ReadX 9879 0 41 41
ReadX 9867 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9902
ReadX 9902 0 511 511
ReadX 9902 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9902
WriteX 9886 2048 2048 2048
WriteX 9886 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 9918
ReadX 9918 0 511 511
ReadX 9918 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 9918
Close 9886
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9920
Close 9920
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 9921
QUERY_FILE_INFORMATION 9921
ReadX 9921 0 64 64
Close 9924
Close 9925
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 9935
ReadX 9935 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 9936
ReadX 9947 241 298 298
Close 9947
ReadX 9935 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 9954 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 9980
QUERY_FILE_INFORMATION 9980
ReadX 9980 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 9982
Close 9982
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 9980 1568 512 512
ReadX 9980 1536 512 512
ReadX 9980 2176 384 384
ReadX 9980 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 9983
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 9980 288 2048 2048
ReadX 9980 2336 2048 2048
ReadX 9980 4384 2048 2048
ReadX 9986 2560 2048 2048
ReadX 9986 4608 2048 2048
ReadX 9986 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 9989 8192 4096 4096
Close 9988
Close 9989
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 9990
WriteX 9990 15359 1 1
QUERY_FILE_INFORMATION 9990
WriteX 9991 0 512 512
QUERY_FILE_INFORMATION 9986
QUERY_FILE_INFORMATION 9986
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 9986
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 9992
Close 9992
WriteX 9996 2560 512 512
WriteX 9996 0 512 512
QUERY_FILE_INFORMATION 9996
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 9997
QUERY_FILE_INFORMATION 9997
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 9999
Close 9999
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 10000
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 9997 2560 2048 2048
ReadX 9997 4608 2048 2048
ReadX 9997 6656 2048 2048
ReadX 10003 5632 2048 2048
ReadX 10003 7680 2048 2048
ReadX 10003 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 10005
WriteX 10005 11990 1 1
QUERY_FILE_INFORMATION 10005
WriteX 10006 0 512 512
QUERY_FILE_INFORMATION 10003
QUERY_FILE_INFORMATION 10003
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 10003
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 10007
Close 10007
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 10012
Close 10012
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 10018
QUERY_FILE_INFORMATION 10018
ReadX 10018 528 2048 2048
ReadX 10018 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 10022
Close 10022
ReadX 10018 1384 2048 2048
ReadX 10018 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 10026
Close 10026
ReadX 10018 2432 2048 2048
ReadX 10018 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 10030
Close 10030
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10036
Close 10036
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10042
Close 10042
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 10071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10073
Close 10073
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10079
Close 10079
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10097
Close 10097
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10116
Close 10116
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 10119 8192 512 512
ReadX 10119 8704 512 512
Close 10119
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10120
Close 10120
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 10125
ReadX 10125 0 8192 8192
Close 10125
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10126
Close 10126
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 10129 16384 8192 8192
ReadX 10129 24576 8192 8192
Close 10129
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 10131
Close 10131
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 10133
WriteX 10133 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 10148
QUERY_FILE_INFORMATION 10148
Close 10148
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 10149
Close 10149
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 10151
WriteX 10151 0 28489 28489
Close 10151
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 10152
Close 10152
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 10155
ReadX 10155 0 8192 8192
Close 10155
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10156
Close 10156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 10159 65536 8192 8192
Close 10159
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 10161
Close 10161
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 10163
WriteX 10163 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 10167
QUERY_FILE_INFORMATION 10167
Close 10167
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 10168
Close 10168
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 10170
WriteX 10170 0 30183 30183
Close 10170
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 10171
Close 10171
WriteX 10172 1532 510 510
WriteX 10172 2042 168 168
Close 10172
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 10173
Close 10173
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 10177
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 10178
QUERY_FILE_INFORMATION 10178
ReadX 10178 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 10179
Close 10179
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 10180
WriteX 10180 1535 1 1
QUERY_FILE_INFORMATION 10180
Close 10181
WriteX 10180 0 4096 4096
Close 10180
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 10182
Close 10182
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 10184
WriteX 10184 1535 1 1
QUERY_FILE_INFORMATION 10184
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 10186 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 10188
Close 10188
QUERY_FILE_INFORMATION 10190
WriteX 10190 0 53077 53077
Close 10190
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 10191
WriteX 10191 1535 1 1
QUERY_FILE_INFORMATION 10191
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 10195
Close 10195
WriteX 10197 0 7983 7983
Close 10197
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 10199
Close 10199
WriteX 10201 458687 65 65
WriteX 10201 458752 46731 46731
Close 10201
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 10202
WriteX 10202 1535 1 1
QUERY_FILE_INFORMATION 10202
Close 10204
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 10205
QUERY_FILE_INFORMATION 10205
ReadX 10205 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 10206
Close 10206
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 10207
WriteX 10207 2047 1 1
QUERY_FILE_INFORMATION 10207
Close 10208
WriteX 10207 0 42388 42388
Close 10207
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 10209
Close 10209
QUERY_FILE_INFORMATION 10210
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 10211
WriteX 10211 2047 1 1
QUERY_FILE_INFORMATION 10211
QUERY_FILE_INFORMATION 10213
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 10215
Close 10215
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 10225
Close 10225
Close 10228
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 10231
Close 10231
Close 10234
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10237
Close 10237
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10241
Close 10241
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10245
Close 10245
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 10249
Close 10249
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 10253
Close 10253
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 10257
Close 10257
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 10261
Close 10261
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 10265
Close 10265
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 10267
Close 10267
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 10269
Close 10269
Close 10271
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 10283
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 10286
Close 10286
Close 10289
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 10292
Close 10292
Close 10295
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10298
Close 10298
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10302
Close 10302
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10306
Close 10306
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 10310
Close 10310
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 10314
Close 10314
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 10318
Close 10318
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 10321
Close 10321
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 10325
Close 10325
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 10329
Close 10329
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 10368
Close 10368
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 10370
WriteX 10370 15 1 1
WriteX 10370 0 10575 10575
Flush 10370
Close 10370
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 10371
Close 10371
Close 10365
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 10378
Close 10378
WriteX 10380 589824 35257 35257
Close 10380
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 10382
Close 10382
ReadX 10391 1025 2048 2048
ReadX 10391 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 10393
Close 10393
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 10395
WriteX 10395 15 1 1
WriteX 10395 0 11588 11588
Flush 10395
Close 10395
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 10396
Close 10396
ReadX 10401 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 10403
Close 10403
ReadX 10390 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 10407
Close 10407
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10417
Close 10417
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10418
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10418 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10421
ReadX 10421 0 511 511
ReadX 10418 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 10418
Close 10419
Close 10420
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 10425
ReadX 10425 0 511 511
ReadX 10422 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 10426
FIND_FIRST \clients\client1\~dmtmp\*
Close 10426
ReadX 10442 293 2 2
Close 10442
ReadX 10438 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 10438
Close 10439
Close 10440
Close 10427
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10443
Close 10443
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10444
ReadX 10444 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10445
ReadX 10453 293 2 2
Close 10453
ReadX 10449 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 10481
ReadX 10481 0 511 511
ReadX 10481 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 10481
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10482
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10488
Close 10488
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10489
ReadX 10489 0 511 511
ReadX 10489 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10509
ReadX 10509 0 41 41
ReadX 10497 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 10516 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10517
Close 10517
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10518
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10518 0 511 511
ReadX 10535 241 298 298
Close 10535
ReadX 10523 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 10570 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 10571
ReadX 10571 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 10571
Close 10570
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10589
Close 10589
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10590
ReadX 10590 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10591
ReadX 10607 241 298 298
Close 10607
ReadX 10595 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 10614 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10615
Close 10615
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10616
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10616 0 511 511
ReadX 10625 293 2 2
Close 10625
ReadX 10621 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 10632 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10633
Close 10633
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10634
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 10634 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10654
ReadX 10654 0 41 41
ReadX 10642 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10684
ReadX 10684 0 511 511
ReadX 10684 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 10684
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10708
Close 10708
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 10709
ReadX 10709 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 10710
ReadX 10713 293 2 2
Close 10713
ReadX 10709 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 10709 384 2048 2048
ReadX 10709 768 16384 16384
ReadX 10709 1792 14336 14336
Close 10710
Close 10711
Close 10712
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10714
Close 10714
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10715
ReadX 10715 0 511 511
ReadX 10715 0 530 530
Close 10720
Close 10717
Close 10718
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10729
Close 10729
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10730
QUERY_FILE_INFORMATION 10730
ReadX 10730 0 64 64
Close 10748
Close 10749
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 10751
ReadX 10751 0 511 511
ReadX 10751 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 10763
ReadX 10763 0 41 41
ReadX 10751 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10786
ReadX 10786 0 511 511
ReadX 10786 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 10786
WriteX 10770 2048 2048 2048
WriteX 10770 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 10802
ReadX 10802 0 511 511
ReadX 10802 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 10802
Close 10770
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10804
Close 10804
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 10805
QUERY_FILE_INFORMATION 10805
ReadX 10805 0 64 64
Close 10808
Close 10809
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 10819
ReadX 10819 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 10820
ReadX 10831 241 298 298
Close 10831
ReadX 10819 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 10838 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 10864
QUERY_FILE_INFORMATION 10864
ReadX 10864 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 10866
Close 10866
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 10864 1568 512 512
ReadX 10864 1536 512 512
ReadX 10864 2176 384 384
ReadX 10864 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 10867
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 10864 288 2048 2048
ReadX 10864 2336 2048 2048
ReadX 10864 4384 2048 2048
ReadX 10870 2560 2048 2048
ReadX 10870 4608 2048 2048
ReadX 10870 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 10873 8192 4096 4096
Close 10872
Close 10873
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 10874
WriteX 10874 15359 1 1
QUERY_FILE_INFORMATION 10874
WriteX 10875 0 512 512
QUERY_FILE_INFORMATION 10870
QUERY_FILE_INFORMATION 10870
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 10870
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 10876
Close 10876
WriteX 10880 2560 512 512
WriteX 10880 0 512 512
QUERY_FILE_INFORMATION 10880
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 10881
QUERY_FILE_INFORMATION 10881
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 10883
Close 10883
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 10884
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 10881 2560 2048 2048
ReadX 10881 4608 2048 2048
ReadX 10881 6656 2048 2048
ReadX 10887 5632 2048 2048
ReadX 10887 7680 2048 2048
ReadX 10887 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 10889
WriteX 10889 11990 1 1
QUERY_FILE_INFORMATION 10889
WriteX 10890 0 512 512
QUERY_FILE_INFORMATION 10887
QUERY_FILE_INFORMATION 10887
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 10887
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 10891
Close 10891
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 10896
Close 10896
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 10902
QUERY_FILE_INFORMATION 10902
ReadX 10902 528 2048 2048
ReadX 10902 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 10906
Close 10906
ReadX 10902 1384 2048 2048
ReadX 10902 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 10910
Close 10910
ReadX 10902 2432 2048 2048
ReadX 10902 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 10914
Close 10914
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 10920
Close 10920
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 10926
Close 10926
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 10955
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 10957
Close 10957
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 10963
Close 10963
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 10981
Close 10981
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11000
Close 11000
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 11003 8192 512 512
ReadX 11003 8704 512 512
Close 11003
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11004
Close 11004
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 11009
ReadX 11009 0 8192 8192
Close 11009
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11010
Close 11010
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 11013 16384 8192 8192
ReadX 11013 24576 8192 8192
Close 11013
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 11015
Close 11015
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 11017
WriteX 11017 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 11032
QUERY_FILE_INFORMATION 11032
Close 11032
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 11033
Close 11033
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 11035
WriteX 11035 0 28489 28489
Close 11035
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 11036
Close 11036
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 11039
ReadX 11039 0 8192 8192
Close 11039
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11040
Close 11040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 11043 65536 8192 8192
Close 11043
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 11045
Close 11045
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 11047
WriteX 11047 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 11051
QUERY_FILE_INFORMATION 11051
Close 11051
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 11052
Close 11052
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 11054
WriteX 11054 0 30183 30183
Close 11054
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 11055
Close 11055
WriteX 11056 1532 510 510
WriteX 11056 2042 168 168
Close 11056
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 11057
Close 11057
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1
-QUERY_PATH_INFORMATION \clients\client1\mixfile
+QUERY_PATH_INFORMATION \clients\client1\mixfile 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD
FIND_FIRST \clients\client1\~dmtmp\WORD\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC