Deltree \clients\client1
-NTCreateX \clients 0x1 0x3 12114 1
+NTCreateX \clients 0x1 0x3 12114 1001
Close 12114 1
NTCreateX \clients\client1 0x1 0x2 12115
Close 12115
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13569
QUERY_FILE_INFORMATION 13569
ReadX 13569 0 512 512
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12661
ReadX 12661 0 41 41
ReadX 12649 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1111
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12691
ReadX 12691 0 511 511
ReadX 12691 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12691
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
Close 12715
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12716
ReadX 12716 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12717
ReadX 12720 293 2 2
Close 12720
ReadX 12716 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 12716 384 2048 2048
ReadX 12716 768 16384 16384
ReadX 12716 1792 14336 14336
Close 12717
Close 12718
Close 12719
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12721
Close 12721
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12722
ReadX 12722 0 511 511
ReadX 12722 0 530 530
Close 12727
Close 12724
Close 12725
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12736
Close 12736
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12737
QUERY_FILE_INFORMATION 12737
ReadX 12737 0 64 64
Close 12755
Close 12756
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12758
ReadX 12758 0 511 511
ReadX 12758 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12770
ReadX 12770 0 41 41
ReadX 12758 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12793
ReadX 12793 0 511 511
ReadX 12793 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12793
WriteX 12777 2048 2048 2048
WriteX 12777 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12809
ReadX 12809 0 511 511
ReadX 12809 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12809
Close 12777
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12811
Close 12811
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12812
QUERY_FILE_INFORMATION 12812
ReadX 12812 0 64 64
Close 12815
Close 12816
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12826
ReadX 12826 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12827
ReadX 12838 241 298 298
Close 12838
ReadX 12826 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12845 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12871
QUERY_FILE_INFORMATION 12871
ReadX 12871 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12873
Close 12873
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12871 1568 512 512
ReadX 12871 1536 512 512
ReadX 12871 2176 384 384
ReadX 12871 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12874
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12871 288 2048 2048
ReadX 12871 2336 2048 2048
ReadX 12871 4384 2048 2048
ReadX 12877 2560 2048 2048
ReadX 12877 4608 2048 2048
ReadX 12877 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 12880 8192 4096 4096
Close 12879
Close 12880
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12881
WriteX 12881 15359 1 1
QUERY_FILE_INFORMATION 12881
WriteX 12882 0 512 512
QUERY_FILE_INFORMATION 12877
QUERY_FILE_INFORMATION 12877
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 12877
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12883
Close 12883
WriteX 12887 2560 512 512
WriteX 12887 0 512 512
QUERY_FILE_INFORMATION 12887
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12888
QUERY_FILE_INFORMATION 12888
ReadX 12888 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12890
Close 12890
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12891
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 12888 2560 2048 2048
ReadX 12888 4608 2048 2048
ReadX 12888 6656 2048 2048
ReadX 12894 5632 2048 2048
ReadX 12894 7680 2048 2048
ReadX 12894 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12896
WriteX 12896 11990 1 1
QUERY_FILE_INFORMATION 12896
WriteX 12897 0 512 512
QUERY_FILE_INFORMATION 12894
QUERY_FILE_INFORMATION 12894
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 12894
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12898
Close 12898
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12903
Close 12903
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 12909
QUERY_FILE_INFORMATION 12909
ReadX 12909 528 2048 2048
ReadX 12909 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 12913
Close 12913
ReadX 12909 1384 2048 2048
ReadX 12909 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 12917
Close 12917
ReadX 12909 2432 2048 2048
ReadX 12909 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 12921
Close 12921
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 12927
Close 12927
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 12933
Close 12933
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 12962
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 12964
Close 12964
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 12970
Close 12970
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 12988
Close 12988
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13007
Close 13007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13010 8192 512 512
ReadX 13010 8704 512 512
Close 13010
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13011
Close 13011
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13016
ReadX 13016 0 8192 8192
Close 13016
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13017
Close 13017
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13020 16384 8192 8192
ReadX 13020 24576 8192 8192
Close 13020
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13022
Close 13022
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13024
WriteX 13024 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13039
QUERY_FILE_INFORMATION 13039
Close 13039
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13040
Close 13040
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13042
WriteX 13042 0 28489 28489
Close 13042
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13043
Close 13043
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13046
ReadX 13046 0 8192 8192
Close 13046
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13047
Close 13047
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13050 65536 8192 8192
Close 13050
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13052
Close 13052
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13054
WriteX 13054 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13058
QUERY_FILE_INFORMATION 13058
Close 13058
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13059
Close 13059
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13061
WriteX 13061 0 30183 30183
Close 13061
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13062
Close 13062
WriteX 13063 1532 510 510
WriteX 13063 2042 168 168
Close 13063
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13064
Close 13064
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13068
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13069
QUERY_FILE_INFORMATION 13069
ReadX 13069 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13070
Close 13070
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13071
WriteX 13071 1535 1 1
QUERY_FILE_INFORMATION 13071
Close 13072
WriteX 13071 0 4096 4096
Close 13071
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13073
Close 13073
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13075
WriteX 13075 1535 1 1
QUERY_FILE_INFORMATION 13075
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13077 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13079
Close 13079
QUERY_FILE_INFORMATION 13081
WriteX 13081 0 53077 53077
Close 13081
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13082
WriteX 13082 1535 1 1
QUERY_FILE_INFORMATION 13082
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13086
Close 13086
WriteX 13088 0 7983 7983
Close 13088
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13090
Close 13090
WriteX 13092 458687 65 65
WriteX 13092 458752 46731 46731
Close 13092
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13093
WriteX 13093 1535 1 1
QUERY_FILE_INFORMATION 13093
Close 13095
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13096
QUERY_FILE_INFORMATION 13096
ReadX 13096 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13097
Close 13097
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13098
WriteX 13098 2047 1 1
QUERY_FILE_INFORMATION 13098
Close 13099
WriteX 13098 0 42388 42388
Close 13098
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13100
Close 13100
QUERY_FILE_INFORMATION 13101
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13102
WriteX 13102 2047 1 1
QUERY_FILE_INFORMATION 13102
QUERY_FILE_INFORMATION 13104
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13106
Close 13106
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13116
Close 13116
Close 13119
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13122
Close 13122
Close 13125
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13128
Close 13128
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13132
Close 13132
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13136
Close 13136
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13140
Close 13140
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13144
Close 13144
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13148
Close 13148
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13152
Close 13152
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13156
Close 13156
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13158
Close 13158
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13160
Close 13160
Close 13162
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 13174
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13177
Close 13177
Close 13180
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13183
Close 13183
Close 13186
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13189
Close 13189
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13193
Close 13193
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13197
Close 13197
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13201
Close 13201
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13205
Close 13205
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13209
Close 13209
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13212
Close 13212
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13216
Close 13216
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13220
Close 13220
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13259
Close 13259
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13261
WriteX 13261 15 1 1
WriteX 13261 0 10575 10575
Flush 13261
Close 13261
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13262
Close 13262
Close 13256
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13269
Close 13269
WriteX 13271 589824 35257 35257
Close 13271
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13273
Close 13273
ReadX 13282 1025 2048 2048
ReadX 13282 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13284
Close 13284
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13286
WriteX 13286 15 1 1
WriteX 13286 0 11588 11588
Flush 13286
Close 13286
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13287
Close 13287
ReadX 13292 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13294
Close 13294
ReadX 13281 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13298
Close 13298
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13308
Close 13308
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13309
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13309 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13312
ReadX 13312 0 511 511
ReadX 13309 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13309
Close 13310
Close 13311
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13316
ReadX 13316 0 511 511
ReadX 13313 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13317
FIND_FIRST \clients\client1\~dmtmp\*
Close 13317
ReadX 13333 293 2 2
Close 13333
ReadX 13329 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13329
Close 13330
Close 13331
Close 13318
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13334
Close 13334
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13335
ReadX 13335 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13336
ReadX 13344 293 2 2
Close 13344
ReadX 13340 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13372
ReadX 13372 0 511 511
ReadX 13372 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13372
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13373
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13379
Close 13379
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13380
ReadX 13380 0 511 511
ReadX 13380 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13400
ReadX 13400 0 41 41
ReadX 13388 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 13407 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13408
Close 13408
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13409
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13409 0 511 511
ReadX 13426 241 298 298
Close 13426
ReadX 13414 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 13461 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13462
ReadX 13462 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13462
Close 13461
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13480
Close 13480
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13481
ReadX 13481 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13482
ReadX 13498 241 298 298
Close 13498
ReadX 13486 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 13505 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13506
Close 13506
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13507
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13507 0 511 511
ReadX 13516 293 2 2
Close 13516
ReadX 13512 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 13523 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13524
Close 13524
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13525
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13525 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13545
ReadX 13545 0 41 41
ReadX 13533 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13575
ReadX 13575 0 511 511
ReadX 13575 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13575
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
Close 13599
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13600
ReadX 13600 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13601
ReadX 13604 293 2 2
Close 13604
ReadX 13600 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 13600 384 2048 2048
ReadX 13600 768 16384 16384
ReadX 13600 1792 14336 14336
Close 13601
Close 13602
Close 13603
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13605
Close 13605
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13606
ReadX 13606 0 511 511
ReadX 13606 0 530 530
Close 13611
Close 13608
Close 13609
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13620
Close 13620
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13621
QUERY_FILE_INFORMATION 13621
ReadX 13621 0 64 64
Close 13639
Close 13640
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13642
ReadX 13642 0 511 511
ReadX 13642 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13654
ReadX 13654 0 41 41
ReadX 13642 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13677
ReadX 13677 0 511 511
ReadX 13677 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13677
WriteX 13661 2048 2048 2048
WriteX 13661 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13693
ReadX 13693 0 511 511
ReadX 13693 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13693
Close 13661
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13695
Close 13695
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13696
QUERY_FILE_INFORMATION 13696
ReadX 13696 0 64 64
Close 13699
Close 13700
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13710
ReadX 13710 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13711
ReadX 13722 241 298 298
Close 13722
ReadX 13710 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13729 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13755
QUERY_FILE_INFORMATION 13755
ReadX 13755 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13757
Close 13757
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13755 1568 512 512
ReadX 13755 1536 512 512
ReadX 13755 2176 384 384
ReadX 13755 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13758
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13755 288 2048 2048
ReadX 13755 2336 2048 2048
ReadX 13755 4384 2048 2048
ReadX 13761 2560 2048 2048
ReadX 13761 4608 2048 2048
ReadX 13761 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 13764 8192 4096 4096
Close 13763
Close 13764
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13765
WriteX 13765 15359 1 1
QUERY_FILE_INFORMATION 13765
WriteX 13766 0 512 512
QUERY_FILE_INFORMATION 13761
QUERY_FILE_INFORMATION 13761
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 13761
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13767
Close 13767
WriteX 13771 2560 512 512
WriteX 13771 0 512 512
QUERY_FILE_INFORMATION 13771
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13772
QUERY_FILE_INFORMATION 13772
ReadX 13772 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13774
Close 13774
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13775
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 13772 2560 2048 2048
ReadX 13772 4608 2048 2048
ReadX 13772 6656 2048 2048
ReadX 13778 5632 2048 2048
ReadX 13778 7680 2048 2048
ReadX 13778 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13780
WriteX 13780 11990 1 1
QUERY_FILE_INFORMATION 13780
WriteX 13781 0 512 512
QUERY_FILE_INFORMATION 13778
QUERY_FILE_INFORMATION 13778
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 13778
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13782
Close 13782
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13787
Close 13787
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13793
QUERY_FILE_INFORMATION 13793
ReadX 13793 528 2048 2048
ReadX 13793 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13797
Close 13797
ReadX 13793 1384 2048 2048
ReadX 13793 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13801
Close 13801
ReadX 13793 2432 2048 2048
ReadX 13793 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13805
Close 13805
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13811
Close 13811
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13817
Close 13817
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13846
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13848
Close 13848
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13854
Close 13854
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13872
Close 13872
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13891
Close 13891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13894 8192 512 512
ReadX 13894 8704 512 512
Close 13894
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13895
Close 13895
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13900
ReadX 13900 0 8192 8192
Close 13900
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13901
Close 13901
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13904 16384 8192 8192
ReadX 13904 24576 8192 8192
Close 13904
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13906
Close 13906
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13908
WriteX 13908 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13923
QUERY_FILE_INFORMATION 13923
Close 13923
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13924
Close 13924
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13926
WriteX 13926 0 28489 28489
Close 13926
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13927
Close 13927
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13930
ReadX 13930 0 8192 8192
Close 13930
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13931
Close 13931
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13934 65536 8192 8192
Close 13934
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13936
Close 13936
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13938
WriteX 13938 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13942
QUERY_FILE_INFORMATION 13942
Close 13942
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13943
Close 13943
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13945
WriteX 13945 0 30183 30183
Close 13945
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13946
Close 13946
WriteX 13947 1532 510 510
WriteX 13947 2042 168 168
Close 13947
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13948
Close 13948
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13952
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13953
QUERY_FILE_INFORMATION 13953
ReadX 13953 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13954
Close 13954
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13955
WriteX 13955 1535 1 1
QUERY_FILE_INFORMATION 13955
Close 13956
WriteX 13955 0 4096 4096
Close 13955
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13957
Close 13957
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13959
WriteX 13959 1535 1 1
QUERY_FILE_INFORMATION 13959
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13961 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13963
Close 13963
QUERY_FILE_INFORMATION 13965
WriteX 13965 0 53077 53077
Close 13965
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13966
WriteX 13966 1535 1 1
QUERY_FILE_INFORMATION 13966
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13970
Close 13970
WriteX 13972 0 7983 7983
Close 13972
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13974
Close 13974
WriteX 13976 458687 65 65
WriteX 13976 458752 46731 46731
Close 13976
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13977
WriteX 13977 1535 1 1
QUERY_FILE_INFORMATION 13977
Close 13979
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13980
QUERY_FILE_INFORMATION 13980
ReadX 13980 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13981
Close 13981
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13982
WriteX 13982 2047 1 1
QUERY_FILE_INFORMATION 13982
Close 13983
WriteX 13982 0 42388 42388
Close 13982
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13984
Close 13984
QUERY_FILE_INFORMATION 13985
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13986
WriteX 13986 2047 1 1
QUERY_FILE_INFORMATION 13986
QUERY_FILE_INFORMATION 13988
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13990
Close 13990
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14000
Close 14000
Close 14003
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 14006
Close 14006
Close 14009
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14012
Close 14012
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14016
Close 14016
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14020
Close 14020
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 14024
Close 14024
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14032
Close 14032
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 14036
Close 14036
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 14040
Close 14040
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 14042
Close 14042
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 14044
Close 14044
Close 14046
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 14058
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 14061
Close 14061
Close 14064
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 14067
Close 14067
Close 14070
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14073
Close 14073
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14077
Close 14077
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14081
Close 14081
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 14085
Close 14085
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14089
Close 14089
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 14093
Close 14093
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12421
Close 12421
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12425
Close 12425
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12429
Close 12429
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12468
Close 12468
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12470
WriteX 12470 15 1 1
WriteX 12470 0 10575 10575
Flush 12470
Close 12470
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12471
Close 12471
Close 12465
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12478
Close 12478
WriteX 12480 589824 35257 35257
Close 12480
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12482
Close 12482
ReadX 12491 1025 2048 2048
ReadX 12491 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12493
Close 12493
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12495
WriteX 12495 15 1 1
WriteX 12495 0 11588 11588
Flush 12495
Close 12495
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12496
Close 12496
ReadX 12501 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12503
Close 12503
ReadX 12490 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12507
Close 12507
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12517
Close 12517
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12518
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12518 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12521
ReadX 12521 0 511 511
ReadX 12518 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12518
Close 12519
Close 12520
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12525
ReadX 12525 0 511 511
ReadX 12522 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12526
FIND_FIRST \clients\client1\~dmtmp\*
Close 12526
ReadX 12542 293 2 2
Close 12542
ReadX 12538 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12538
Close 12539
Close 12540
Close 12527
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12543
Close 12543
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12544
ReadX 12544 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12545
ReadX 12553 293 2 2
Close 12553
ReadX 12549 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12581
ReadX 12581 0 511 511
ReadX 12581 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12581
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12582
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12588
Close 12588
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12589
ReadX 12589 0 511 511
ReadX 12589 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12609
ReadX 12609 0 41 41
ReadX 12597 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 12616 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12617
Close 12617
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12618
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12618 0 511 511
ReadX 12635 241 298 298
Close 12635
ReadX 12623 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 12670 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12671
ReadX 12671 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12671
Close 12670
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12689
Close 12689
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12690
ReadX 12690 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12691
ReadX 12707 241 298 298
Close 12707
ReadX 12695 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 12714 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
Close 12715
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12716
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12716 0 511 511
ReadX 12725 293 2 2
Close 12725
ReadX 12721 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 12732 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12733
Close 12733
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12734
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12734 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12754
ReadX 12754 0 41 41
ReadX 12742 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12784
ReadX 12784 0 511 511
ReadX 12784 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12784
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12808
Close 12808
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12809
ReadX 12809 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12810
ReadX 12813 293 2 2
Close 12813
ReadX 12809 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 12809 384 2048 2048
ReadX 12809 768 16384 16384
ReadX 12809 1792 14336 14336
Close 12810
Close 12811
Close 12812
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12814
Close 12814
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12815
ReadX 12815 0 511 511
ReadX 12815 0 530 530
Close 12820
Close 12817
Close 12818
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12829
Close 12829
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12830
QUERY_FILE_INFORMATION 12830
ReadX 12830 0 64 64
Close 12848
Close 12849
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12851
ReadX 12851 0 511 511
ReadX 12851 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12863
ReadX 12863 0 41 41
ReadX 12851 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12886
ReadX 12886 0 511 511
ReadX 12886 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12886
WriteX 12870 2048 2048 2048
WriteX 12870 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12902
ReadX 12902 0 511 511
ReadX 12902 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12902
Close 12870
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12904
Close 12904
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12905
QUERY_FILE_INFORMATION 12905
ReadX 12905 0 64 64
Close 12908
Close 12909
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12919
ReadX 12919 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12920
ReadX 12931 241 298 298
Close 12931
ReadX 12919 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12938 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12964
QUERY_FILE_INFORMATION 12964
ReadX 12964 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12966
Close 12966
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12964 1568 512 512
ReadX 12964 1536 512 512
ReadX 12964 2176 384 384
ReadX 12964 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12967
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12964 288 2048 2048
ReadX 12964 2336 2048 2048
ReadX 12964 4384 2048 2048
ReadX 12970 2560 2048 2048
ReadX 12970 4608 2048 2048
ReadX 12970 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 12973 8192 4096 4096
Close 12972
Close 12973
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12974
WriteX 12974 15359 1 1
QUERY_FILE_INFORMATION 12974
WriteX 12975 0 512 512
QUERY_FILE_INFORMATION 12970
QUERY_FILE_INFORMATION 12970
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 12970
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12976
Close 12976
WriteX 12980 2560 512 512
WriteX 12980 0 512 512
QUERY_FILE_INFORMATION 12980
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12981
QUERY_FILE_INFORMATION 12981
ReadX 12981 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12983
Close 12983
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12984
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 12981 2560 2048 2048
ReadX 12981 4608 2048 2048
ReadX 12981 6656 2048 2048
ReadX 12987 5632 2048 2048
ReadX 12987 7680 2048 2048
ReadX 12987 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12989
WriteX 12989 11990 1 1
QUERY_FILE_INFORMATION 12989
WriteX 12990 0 512 512
QUERY_FILE_INFORMATION 12987
QUERY_FILE_INFORMATION 12987
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 12987
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12991
Close 12991
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12996
Close 12996
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13002
QUERY_FILE_INFORMATION 13002
ReadX 13002 528 2048 2048
ReadX 13002 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13006
Close 13006
ReadX 13002 1384 2048 2048
ReadX 13002 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13010
Close 13010
ReadX 13002 2432 2048 2048
ReadX 13002 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13014
Close 13014
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13020
Close 13020
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13026
Close 13026
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13055
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13057
Close 13057
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13063
Close 13063
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13081
Close 13081
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13100
Close 13100
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13103 8192 512 512
ReadX 13103 8704 512 512
Close 13103
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13104
Close 13104
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13109
ReadX 13109 0 8192 8192
Close 13109
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13110
Close 13110
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13113 16384 8192 8192
ReadX 13113 24576 8192 8192
Close 13113
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13115
Close 13115
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13117
WriteX 13117 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13132
QUERY_FILE_INFORMATION 13132
Close 13132
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13133
Close 13133
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13135
WriteX 13135 0 28489 28489
Close 13135
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13136
Close 13136
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13139
ReadX 13139 0 8192 8192
Close 13139
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13140
Close 13140
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13143 65536 8192 8192
Close 13143
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13145
Close 13145
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13147
WriteX 13147 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13151
QUERY_FILE_INFORMATION 13151
Close 13151
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13152
Close 13152
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13154
WriteX 13154 0 30183 30183
Close 13154
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13155
Close 13155
WriteX 13156 1532 510 510
WriteX 13156 2042 168 168
Close 13156
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13157
Close 13157
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13161
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13162
QUERY_FILE_INFORMATION 13162
ReadX 13162 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13163
Close 13163
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13164
WriteX 13164 1535 1 1
QUERY_FILE_INFORMATION 13164
Close 13165
WriteX 13164 0 4096 4096
Close 13164
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13166
Close 13166
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13168
WriteX 13168 1535 1 1
QUERY_FILE_INFORMATION 13168
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13170 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13172
Close 13172
QUERY_FILE_INFORMATION 13174
WriteX 13174 0 53077 53077
Close 13174
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13175
WriteX 13175 1535 1 1
QUERY_FILE_INFORMATION 13175
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13179
Close 13179
WriteX 13181 0 7983 7983
Close 13181
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13183
Close 13183
WriteX 13185 458687 65 65
WriteX 13185 458752 46731 46731
Close 13185
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13186
WriteX 13186 1535 1 1
QUERY_FILE_INFORMATION 13186
Close 13188
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13189
QUERY_FILE_INFORMATION 13189
ReadX 13189 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13190
Close 13190
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13191
WriteX 13191 2047 1 1
QUERY_FILE_INFORMATION 13191
Close 13192
WriteX 13191 0 42388 42388
Close 13191
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13193
Close 13193
QUERY_FILE_INFORMATION 13194
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13195
WriteX 13195 2047 1 1
QUERY_FILE_INFORMATION 13195
QUERY_FILE_INFORMATION 13197
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13199
Close 13199
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13209
Close 13209
Close 13212
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13215
Close 13215
Close 13218
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13221
Close 13221
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13225
Close 13225
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13229
Close 13229
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13233
Close 13233
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13237
Close 13237
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13241
Close 13241
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13245
Close 13245
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13249
Close 13249
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13251
Close 13251
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13253
Close 13253
Close 13255
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 13267
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13270
Close 13270
Close 13273
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13276
Close 13276
Close 13279
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13282
Close 13282
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13286
Close 13286
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13290
Close 13290
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13294
Close 13294
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13298
Close 13298
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13302
Close 13302
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13305
Close 13305
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13309
Close 13309
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13313
Close 13313
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13352
Close 13352
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13354
WriteX 13354 15 1 1
WriteX 13354 0 10575 10575
Flush 13354
Close 13354
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13355
Close 13355
Close 13349
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13362
Close 13362
WriteX 13364 589824 35257 35257
Close 13364
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13366
Close 13366
ReadX 13375 1025 2048 2048
ReadX 13375 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13377
Close 13377
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13379
WriteX 13379 15 1 1
WriteX 13379 0 11588 11588
Flush 13379
Close 13379
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13380
Close 13380
ReadX 13385 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13387
Close 13387
ReadX 13374 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13391
Close 13391
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13401
Close 13401
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13402
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13402 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13405
ReadX 13405 0 511 511
ReadX 13402 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13402
Close 13403
Close 13404
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13409
ReadX 13409 0 511 511
ReadX 13406 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13410
FIND_FIRST \clients\client1\~dmtmp\*
Close 13410
ReadX 13426 293 2 2
Close 13426
ReadX 13422 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13422
Close 13423
Close 13424
Close 13411
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13427
Close 13427
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13428
ReadX 13428 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13429
ReadX 13437 293 2 2
Close 13437
ReadX 13433 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13465
ReadX 13465 0 511 511
ReadX 13465 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13465
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13466
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13472
Close 13472
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13473
ReadX 13473 0 511 511
ReadX 13473 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13493
ReadX 13493 0 41 41
ReadX 13481 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 13500 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13501
Close 13501
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13502
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13502 0 511 511
ReadX 13519 241 298 298
Close 13519
ReadX 13507 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 13554 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13555
ReadX 13555 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13555
Close 13554
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13573
Close 13573
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13574
ReadX 13574 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13575
ReadX 13591 241 298 298
Close 13591
ReadX 13579 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 13598 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
Close 13599
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13600
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13600 0 511 511
ReadX 13609 293 2 2
Close 13609
ReadX 13605 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 13616 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13617
Close 13617
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13618
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13618 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13638
ReadX 13638 0 41 41
ReadX 13626 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13668
ReadX 13668 0 511 511
ReadX 13668 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13668
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13692
Close 13692
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13693
ReadX 13693 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13694
ReadX 13697 293 2 2
Close 13697
ReadX 13693 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 13693 384 2048 2048
ReadX 13693 768 16384 16384
ReadX 13693 1792 14336 14336
Close 13694
Close 13695
Close 13696
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13698
Close 13698
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13699
ReadX 13699 0 511 511
ReadX 13699 0 530 530
Close 13704
Close 13701
Close 13702
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13713
Close 13713
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13714
QUERY_FILE_INFORMATION 13714
ReadX 13714 0 64 64
Close 13732
Close 13733
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13735
ReadX 13735 0 511 511
ReadX 13735 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13747
ReadX 13747 0 41 41
ReadX 13735 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13770
ReadX 13770 0 511 511
ReadX 13770 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13770
WriteX 13754 2048 2048 2048
WriteX 13754 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13786
ReadX 13786 0 511 511
ReadX 13786 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13786
Close 13754
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13788
Close 13788
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13789
QUERY_FILE_INFORMATION 13789
ReadX 13789 0 64 64
Close 13792
Close 13793
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13803
ReadX 13803 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13804
ReadX 13815 241 298 298
Close 13815
ReadX 13803 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13822 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13848
QUERY_FILE_INFORMATION 13848
ReadX 13848 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13850
Close 13850
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13848 1568 512 512
ReadX 13848 1536 512 512
ReadX 13848 2176 384 384
ReadX 13848 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13851
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13848 288 2048 2048
ReadX 13848 2336 2048 2048
ReadX 13848 4384 2048 2048
ReadX 13854 2560 2048 2048
ReadX 13854 4608 2048 2048
ReadX 13854 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 13857 8192 4096 4096
Close 13856
Close 13857
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13858
WriteX 13858 15359 1 1
QUERY_FILE_INFORMATION 13858
WriteX 13859 0 512 512
QUERY_FILE_INFORMATION 13854
QUERY_FILE_INFORMATION 13854
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 13854
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13860
Close 13860
WriteX 13864 2560 512 512
WriteX 13864 0 512 512
QUERY_FILE_INFORMATION 13864
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13865
QUERY_FILE_INFORMATION 13865
ReadX 13865 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13867
Close 13867
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 11
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13868
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 13865 2560 2048 2048
ReadX 13865 4608 2048 2048
ReadX 13865 6656 2048 2048
ReadX 13871 5632 2048 2048
ReadX 13871 7680 2048 2048
ReadX 13871 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13873
WriteX 13873 11990 1 1
QUERY_FILE_INFORMATION 13873
WriteX 13874 0 512 512
QUERY_FILE_INFORMATION 13871
QUERY_FILE_INFORMATION 13871
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 13871
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13875
Close 13875
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13880
Close 13880
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13886
QUERY_FILE_INFORMATION 13886
ReadX 13886 528 2048 2048
ReadX 13886 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13890
Close 13890
ReadX 13886 1384 2048 2048
ReadX 13886 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13894
Close 13894
ReadX 13886 2432 2048 2048
ReadX 13886 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13898
Close 13898
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13904
Close 13904
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13910
Close 13910
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13939
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13941
Close 13941
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13947
Close 13947
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13965
Close 13965
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13984
Close 13984
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13987 8192 512 512
ReadX 13987 8704 512 512
Close 13987
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13988
Close 13988
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13993
ReadX 13993 0 8192 8192
Close 13993
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13994
Close 13994
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13997 16384 8192 8192
ReadX 13997 24576 8192 8192
Close 13997
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13999
Close 13999
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14001
WriteX 14001 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14016
QUERY_FILE_INFORMATION 14016
Close 14016
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14017
Close 14017
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14019
WriteX 14019 0 28489 28489
Close 14019
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14020
Close 14020
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14023
ReadX 14023 0 8192 8192
Close 14023
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14024
Close 14024
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 14027 65536 8192 8192
Close 14027
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14029
Close 14029
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14031
WriteX 14031 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14035
QUERY_FILE_INFORMATION 14035
Close 14035
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14036
Close 14036
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14038
WriteX 14038 0 30183 30183
Close 14038
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14039
Close 14039
WriteX 14040 1532 510 510
WriteX 14040 2042 168 168
Close 14040
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14041
Close 14041
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14045
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14046
QUERY_FILE_INFORMATION 14046
ReadX 14046 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 14047
Close 14047
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 14048
WriteX 14048 1535 1 1
QUERY_FILE_INFORMATION 14048
Close 14049
WriteX 14048 0 4096 4096
Close 14048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 14050
Close 14050
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 14052
WriteX 14052 1535 1 1
QUERY_FILE_INFORMATION 14052
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14054 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14056
Close 14056
QUERY_FILE_INFORMATION 14058
WriteX 14058 0 53077 53077
Close 14058
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 14059
WriteX 14059 1535 1 1
QUERY_FILE_INFORMATION 14059
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14063
Close 14063
WriteX 14065 0 7983 7983
Close 14065
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14067
Close 14067
WriteX 14069 458687 65 65
WriteX 14069 458752 46731 46731
Close 14069
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 14070
WriteX 14070 1535 1 1
QUERY_FILE_INFORMATION 14070
Close 14072
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14073
QUERY_FILE_INFORMATION 14073
ReadX 14073 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14074
Close 14074
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14075
WriteX 14075 2047 1 1
QUERY_FILE_INFORMATION 14075
Close 14076
WriteX 14075 0 42388 42388
Close 14075
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14077
Close 14077
QUERY_FILE_INFORMATION 14078
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14079
WriteX 14079 2047 1 1
QUERY_FILE_INFORMATION 14079
QUERY_FILE_INFORMATION 14081
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14083
Close 14083
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14093
Close 14093
Close 12327
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 12330
Close 12330
Close 12333
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12336
Close 12336
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12340
Close 12340
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12344
Close 12344
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 12348
Close 12348
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12352
Close 12352
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12356
Close 12356
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 12360
Close 12360
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 12364
Close 12364
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 12366
Close 12366
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 12368
Close 12368
Close 12370
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 12382
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 12385
Close 12385
Close 12388
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 12391
Close 12391
Close 12394
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12397
Close 12397
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12401
Close 12401
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12405
Close 12405
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 12409
Close 12409
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12413
Close 12413
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 12417
Close 12417
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12420
Close 12420
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12424
Close 12424
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 12428
Close 12428
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 12467
Close 12467
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12469
WriteX 12469 15 1 1
WriteX 12469 0 10575 10575
Flush 12469
Close 12469
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12470
Close 12470
Close 12464
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 12477
Close 12477
WriteX 12479 589824 35257 35257
Close 12479
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 12481
Close 12481
ReadX 12490 1025 2048 2048
ReadX 12490 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 12492
Close 12492
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 12494
WriteX 12494 15 1 1
WriteX 12494 0 11588 11588
Flush 12494
Close 12494
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 12495
Close 12495
ReadX 12500 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 12502
Close 12502
ReadX 12489 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 12506
Close 12506
Close 12515
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12516
Close 12516
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12517
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12517 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12520
ReadX 12520 0 511 511
ReadX 12517 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12517
Close 12518
Close 12519
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 12524
ReadX 12524 0 511 511
ReadX 12521 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 12525
FIND_FIRST \clients\client1\~dmtmp\*
Close 12525
ReadX 12541 293 2 2
Close 12541
ReadX 12537 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12537
Close 12538
Close 12539
Close 12526
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12542
Close 12542
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12543
ReadX 12543 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12544
ReadX 12552 293 2 2
Close 12552
ReadX 12548 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 12580
ReadX 12580 0 511 511
ReadX 12580 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12580
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12581
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12587
Close 12587
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12588
ReadX 12588 0 511 511
ReadX 12588 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12608
ReadX 12608 0 41 41
ReadX 12596 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 12615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12616
Close 12616
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12617
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12617 0 511 511
ReadX 12634 241 298 298
Close 12634
ReadX 12622 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 12669 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 12670
ReadX 12670 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12670
Close 12669
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12688
Close 12688
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12689
ReadX 12689 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12690
ReadX 12706 241 298 298
Close 12706
ReadX 12694 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 12713 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12714
Close 12714
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12715
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12715 0 511 511
ReadX 12724 293 2 2
Close 12724
ReadX 12720 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 12731 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12732
Close 12732
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12733
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 12733 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12753
ReadX 12753 0 41 41
ReadX 12741 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12783
ReadX 12783 0 511 511
ReadX 12783 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12783
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12807
Close 12807
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 12808
ReadX 12808 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 12809
ReadX 12812 293 2 2
Close 12812
ReadX 12808 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 12808 384 2048 2048
ReadX 12808 768 16384 16384
ReadX 12808 1792 14336 14336
Close 12809
Close 12810
Close 12811
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12813
Close 12813
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12814
ReadX 12814 0 511 511
ReadX 12814 0 530 530
Close 12819
Close 12816
Close 12817
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12828
Close 12828
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12829
QUERY_FILE_INFORMATION 12829
ReadX 12829 0 64 64
Close 12847
Close 12848
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 12850
ReadX 12850 0 511 511
ReadX 12850 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 12862
ReadX 12862 0 41 41
ReadX 12850 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12885
ReadX 12885 0 511 511
ReadX 12885 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12885
WriteX 12869 2048 2048 2048
WriteX 12869 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 12901
ReadX 12901 0 511 511
ReadX 12901 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 12901
Close 12869
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12903
Close 12903
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 12904
QUERY_FILE_INFORMATION 12904
ReadX 12904 0 64 64
Close 12907
Close 12908
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 12918
ReadX 12918 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 12919
ReadX 12930 241 298 298
Close 12930
ReadX 12918 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 12937 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 12963
QUERY_FILE_INFORMATION 12963
ReadX 12963 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 12965
Close 12965
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12963 1568 512 512
ReadX 12963 1536 512 512
ReadX 12963 2176 384 384
ReadX 12963 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 12966
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 12963 288 2048 2048
ReadX 12963 2336 2048 2048
ReadX 12963 4384 2048 2048
ReadX 12969 2560 2048 2048
ReadX 12969 4608 2048 2048
ReadX 12969 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 12972 8192 4096 4096
Close 12971
Close 12972
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 12973
WriteX 12973 15359 1 1
QUERY_FILE_INFORMATION 12973
WriteX 12974 0 512 512
QUERY_FILE_INFORMATION 12969
QUERY_FILE_INFORMATION 12969
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 12969
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 12975
Close 12975
WriteX 12979 2560 512 512
WriteX 12979 0 512 512
QUERY_FILE_INFORMATION 12979
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 12980
QUERY_FILE_INFORMATION 12980
ReadX 12980 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 12982
Close 12982
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 12983
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 12980 2560 2048 2048
ReadX 12980 4608 2048 2048
ReadX 12980 6656 2048 2048
ReadX 12986 5632 2048 2048
ReadX 12986 7680 2048 2048
ReadX 12986 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 12988
WriteX 12988 11990 1 1
QUERY_FILE_INFORMATION 12988
WriteX 12989 0 512 512
QUERY_FILE_INFORMATION 12986
QUERY_FILE_INFORMATION 12986
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 12986
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 12990
Close 12990
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 12995
Close 12995
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13001
QUERY_FILE_INFORMATION 13001
ReadX 13001 528 2048 2048
ReadX 13001 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13005
Close 13005
ReadX 13001 1384 2048 2048
ReadX 13001 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13009
Close 13009
ReadX 13001 2432 2048 2048
ReadX 13001 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13013
Close 13013
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13019
Close 13019
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13025
Close 13025
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13054
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13056
Close 13056
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13062
Close 13062
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13080
Close 13080
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13099
Close 13099
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13102 8192 512 512
ReadX 13102 8704 512 512
Close 13102
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13103
Close 13103
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13108
ReadX 13108 0 8192 8192
Close 13108
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13109
Close 13109
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13112 16384 8192 8192
ReadX 13112 24576 8192 8192
Close 13112
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13114
Close 13114
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13116
WriteX 13116 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 13131
QUERY_FILE_INFORMATION 13131
Close 13131
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 13132
Close 13132
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13134
WriteX 13134 0 28489 28489
Close 13134
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13135
Close 13135
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 13138
ReadX 13138 0 8192 8192
Close 13138
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13139
Close 13139
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13142 65536 8192 8192
Close 13142
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13144
Close 13144
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 13146
WriteX 13146 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 13150
QUERY_FILE_INFORMATION 13150
Close 13150
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 13151
Close 13151
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 13153
WriteX 13153 0 30183 30183
Close 13153
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 13154
Close 13154
WriteX 13155 1532 510 510
WriteX 13155 2042 168 168
Close 13155
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13156
Close 13156
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 13160
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 13161
QUERY_FILE_INFORMATION 13161
ReadX 13161 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 13162
Close 13162
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 13163
WriteX 13163 1535 1 1
QUERY_FILE_INFORMATION 13163
Close 13164
WriteX 13163 0 4096 4096
Close 13163
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 13165
Close 13165
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 13167
WriteX 13167 1535 1 1
QUERY_FILE_INFORMATION 13167
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 13169 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 13171
Close 13171
QUERY_FILE_INFORMATION 13173
WriteX 13173 0 53077 53077
Close 13173
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 13174
WriteX 13174 1535 1 1
QUERY_FILE_INFORMATION 13174
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 13178
Close 13178
WriteX 13180 0 7983 7983
Close 13180
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 13182
Close 13182
WriteX 13184 458687 65 65
WriteX 13184 458752 46731 46731
Close 13184
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 13185
WriteX 13185 1535 1 1
QUERY_FILE_INFORMATION 13185
Close 13187
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 13188
QUERY_FILE_INFORMATION 13188
ReadX 13188 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 13189
Close 13189
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 13190
WriteX 13190 2047 1 1
QUERY_FILE_INFORMATION 13190
Close 13191
WriteX 13190 0 42388 42388
Close 13190
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 13192
Close 13192
QUERY_FILE_INFORMATION 13193
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 13194
WriteX 13194 2047 1 1
QUERY_FILE_INFORMATION 13194
QUERY_FILE_INFORMATION 13196
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 13198
Close 13198
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 13208
Close 13208
Close 13211
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 13214
Close 13214
Close 13217
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13220
Close 13220
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13224
Close 13224
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13228
Close 13228
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 13232
Close 13232
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13236
Close 13236
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13240
Close 13240
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 13244
Close 13244
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 13248
Close 13248
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 13250
Close 13250
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 13252
Close 13252
Close 13254
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 13266
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 13269
Close 13269
Close 13272
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 13275
Close 13275
Close 13278
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13281
Close 13281
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13285
Close 13285
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13289
Close 13289
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 13293
Close 13293
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13297
Close 13297
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 13301
Close 13301
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13304
Close 13304
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13308
Close 13308
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 13312
Close 13312
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 13351
Close 13351
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13353
WriteX 13353 15 1 1
WriteX 13353 0 10575 10575
Flush 13353
Close 13353
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13354
Close 13354
Close 13348
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 13361
Close 13361
WriteX 13363 589824 35257 35257
Close 13363
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 13365
Close 13365
ReadX 13374 1025 2048 2048
ReadX 13374 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 13376
Close 13376
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 13378
WriteX 13378 15 1 1
WriteX 13378 0 11588 11588
Flush 13378
Close 13378
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 13379
Close 13379
ReadX 13384 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 13386
Close 13386
ReadX 13373 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 13390
Close 13390
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13400
Close 13400
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13401
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13401 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13404
ReadX 13404 0 511 511
ReadX 13401 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13401
Close 13402
Close 13403
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 13408
ReadX 13408 0 511 511
ReadX 13405 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 13409
FIND_FIRST \clients\client1\~dmtmp\*
Close 13409
ReadX 13425 293 2 2
Close 13425
ReadX 13421 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13421
Close 13422
Close 13423
Close 13410
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13426
Close 13426
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13427
ReadX 13427 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13428
ReadX 13436 293 2 2
Close 13436
ReadX 13432 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 13464
ReadX 13464 0 511 511
ReadX 13464 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13464
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13465
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13471
Close 13471
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13472
ReadX 13472 0 511 511
ReadX 13472 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13492
ReadX 13492 0 41 41
ReadX 13480 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 13499 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13500
Close 13500
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13501
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13501 0 511 511
ReadX 13518 241 298 298
Close 13518
ReadX 13506 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 13553 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 13554
ReadX 13554 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13554
Close 13553
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13572
Close 13572
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13573
ReadX 13573 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13574
ReadX 13590 241 298 298
Close 13590
ReadX 13578 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 13597 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13598
Close 13598
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13599
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13599 0 511 511
ReadX 13608 293 2 2
Close 13608
ReadX 13604 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 13615 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13616
Close 13616
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13617
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 13617 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13637
ReadX 13637 0 41 41
ReadX 13625 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13667
ReadX 13667 0 511 511
ReadX 13667 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13667
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13691
Close 13691
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 13692
ReadX 13692 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 13693
ReadX 13696 293 2 2
Close 13696
ReadX 13692 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 13692 384 2048 2048
ReadX 13692 768 16384 16384
ReadX 13692 1792 14336 14336
Close 13693
Close 13694
Close 13695
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13697
Close 13697
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13698
ReadX 13698 0 511 511
ReadX 13698 0 530 530
Close 13703
Close 13700
Close 13701
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13712
Close 13712
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13713
QUERY_FILE_INFORMATION 13713
ReadX 13713 0 64 64
Close 13731
Close 13732
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 13734
ReadX 13734 0 511 511
ReadX 13734 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 13746
ReadX 13746 0 41 41
ReadX 13734 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13769
ReadX 13769 0 511 511
ReadX 13769 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13769
WriteX 13753 2048 2048 2048
WriteX 13753 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 13785
ReadX 13785 0 511 511
ReadX 13785 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 13785
Close 13753
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13787
Close 13787
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 13788
QUERY_FILE_INFORMATION 13788
ReadX 13788 0 64 64
Close 13791
Close 13792
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 13802
ReadX 13802 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 13803
ReadX 13814 241 298 298
Close 13814
ReadX 13802 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 13821 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 13847
QUERY_FILE_INFORMATION 13847
ReadX 13847 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 13849
Close 13849
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13847 1568 512 512
ReadX 13847 1536 512 512
ReadX 13847 2176 384 384
ReadX 13847 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 13850
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 13847 288 2048 2048
ReadX 13847 2336 2048 2048
ReadX 13847 4384 2048 2048
ReadX 13853 2560 2048 2048
ReadX 13853 4608 2048 2048
ReadX 13853 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 13856 8192 4096 4096
Close 13855
Close 13856
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 13857
WriteX 13857 15359 1 1
QUERY_FILE_INFORMATION 13857
WriteX 13858 0 512 512
QUERY_FILE_INFORMATION 13853
QUERY_FILE_INFORMATION 13853
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 13853
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 13859
Close 13859
WriteX 13863 2560 512 512
WriteX 13863 0 512 512
QUERY_FILE_INFORMATION 13863
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 13864
QUERY_FILE_INFORMATION 13864
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 13866
Close 13866
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 13867
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 13864 2560 2048 2048
ReadX 13864 4608 2048 2048
ReadX 13864 6656 2048 2048
ReadX 13870 5632 2048 2048
ReadX 13870 7680 2048 2048
ReadX 13870 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 13872
WriteX 13872 11990 1 1
QUERY_FILE_INFORMATION 13872
WriteX 13873 0 512 512
QUERY_FILE_INFORMATION 13870
QUERY_FILE_INFORMATION 13870
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 13870
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 13874
Close 13874
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 13879
Close 13879
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 13885
QUERY_FILE_INFORMATION 13885
ReadX 13885 528 2048 2048
ReadX 13885 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 13889
Close 13889
ReadX 13885 1384 2048 2048
ReadX 13885 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 13893
Close 13893
ReadX 13885 2432 2048 2048
ReadX 13885 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 13897
Close 13897
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 13903
Close 13903
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 13909
Close 13909
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 13938
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 13940
Close 13940
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 13946
Close 13946
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 13964
Close 13964
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13983
Close 13983
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13986 8192 512 512
ReadX 13986 8704 512 512
Close 13986
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13987
Close 13987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 13992
ReadX 13992 0 8192 8192
Close 13992
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 13993
Close 13993
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 13996 16384 8192 8192
ReadX 13996 24576 8192 8192
Close 13996
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 13998
Close 13998
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 14000
WriteX 14000 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 14015
QUERY_FILE_INFORMATION 14015
Close 14015
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 14016
Close 14016
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14018
WriteX 14018 0 28489 28489
Close 14018
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14019
Close 14019
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 14022
ReadX 14022 0 8192 8192
Close 14022
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14023
Close 14023
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 14026 65536 8192 8192
Close 14026
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14028
Close 14028
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 14030
WriteX 14030 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 14034
QUERY_FILE_INFORMATION 14034
Close 14034
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 14035
Close 14035
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 14037
WriteX 14037 0 30183 30183
Close 14037
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 14038
Close 14038
WriteX 14039 1532 510 510
WriteX 14039 2042 168 168
Close 14039
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 14040
Close 14040
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 14044
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 14045
QUERY_FILE_INFORMATION 14045
ReadX 14045 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 14046
Close 14046
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 14047
WriteX 14047 1535 1 1
QUERY_FILE_INFORMATION 14047
Close 14048
WriteX 14047 0 4096 4096
Close 14047
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 14049
Close 14049
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 14051
WriteX 14051 1535 1 1
QUERY_FILE_INFORMATION 14051
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 14053 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 14055
Close 14055
QUERY_FILE_INFORMATION 14057
WriteX 14057 0 53077 53077
Close 14057
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 14058
WriteX 14058 1535 1 1
QUERY_FILE_INFORMATION 14058
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 14062
Close 14062
WriteX 14064 0 7983 7983
Close 14064
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 14066
Close 14066
WriteX 14068 458687 65 65
WriteX 14068 458752 46731 46731
Close 14068
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 14069
WriteX 14069 1535 1 1
QUERY_FILE_INFORMATION 14069
Close 14071
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 14072
QUERY_FILE_INFORMATION 14072
ReadX 14072 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 14073
Close 14073
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 14074
WriteX 14074 2047 1 1
QUERY_FILE_INFORMATION 14074
Close 14075
WriteX 14074 0 42388 42388
Close 14074
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 14076
Close 14076
QUERY_FILE_INFORMATION 14077
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 14078
WriteX 14078 2047 1 1
QUERY_FILE_INFORMATION 14078
QUERY_FILE_INFORMATION 14080
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 14082
Close 14082
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 14092
Close 14092
Close 14095
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 5811
Close 5811
Close 5814
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5817
Close 5817
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5821
Close 5821
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5825
Close 5825
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 5829
Close 5829
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5833
Close 5833
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5837
Close 5837
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 5841
Close 5841
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 5845
Close 5845
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 5847
Close 5847
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 5849
Close 5849
Close 5851
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 5863
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 5866
Close 5866
Close 5869
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 5872
Close 5872
Close 5875
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5878
Close 5878
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5882
Close 5882
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5886
Close 5886
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 5890
Close 5890
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 5894
Close 5894
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 5898
Close 5898
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5901
Close 5901
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5905
Close 5905
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 5909
Close 5909
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 5948
Close 5948
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5950
WriteX 5950 15 1 1
WriteX 5950 0 10575 10575
Flush 5950
Close 5950
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5951
Close 5951
Close 5945
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 5958
Close 5958
WriteX 5960 589824 35257 35257
Close 5960
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 5962
Close 5962
ReadX 5971 1025 2048 2048
ReadX 5971 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 5973
Close 5973
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 5975
WriteX 5975 15 1 1
WriteX 5975 0 11588 11588
Flush 5975
Close 5975
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 5976
Close 5976
ReadX 5981 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 5983
Close 5983
ReadX 5970 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 5987
Close 5987
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 5997
Close 5997
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 5998
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 5998 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6001
ReadX 6001 0 511 511
ReadX 5998 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 5998
Close 5999
Close 6000
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6005
ReadX 6005 0 511 511
ReadX 6002 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 6006
FIND_FIRST \clients\client1\~dmtmp\*
Close 6006
ReadX 6022 293 2 2
Close 6022
ReadX 6018 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6018
Close 6019
Close 6020
Close 6007
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6023
Close 6023
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6024
ReadX 6024 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6025
ReadX 6033 293 2 2
Close 6033
ReadX 6029 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6061
ReadX 6061 0 511 511
ReadX 6061 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6061
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6062
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6068
Close 6068
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6069
ReadX 6069 0 511 511
ReadX 6069 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6089
ReadX 6089 0 41 41
ReadX 6077 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 6096 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6097
Close 6097
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6098
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6098 0 511 511
ReadX 6115 241 298 298
Close 6115
ReadX 6103 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
ReadX 6150 0 572 572
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.MB 0x40 0x1 6151
ReadX 6151 0 41 41
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6151
Close 6150
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CLASSROL 1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
Unlink \clients\client1\~dmtmp\PARADOX\__414F2.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6169
Close 6169
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6170
ReadX 6170 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6171
ReadX 6187 241 298 298
Close 6187
ReadX 6175 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__42B96.FAM 0x40 0x1 -1
ReadX 6194 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6195
Close 6195
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6196
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6196 0 511 511
ReadX 6205 293 2 2
Close 6205
ReadX 6201 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43212.FAM 0x40 0x1 -1
ReadX 6212 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6213
Close 6213
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6214
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6214 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6234
ReadX 6234 0 41 41
ReadX 6222 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__43904.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6264
ReadX 6264 0 511 511
ReadX 6264 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6264
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\SCHED 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__42B96.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43212.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__43904.DB
Unlink \clients\client1\~dmtmp\PARADOX\__43904.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6288
Close 6288
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6289
ReadX 6289 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6290
ReadX 6293 293 2 2
Close 6293
ReadX 6289 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
ReadX 6289 384 2048 2048
ReadX 6289 768 16384 16384
ReadX 6289 1792 14336 14336
Close 6290
Close 6291
Close 6292
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6294
Close 6294
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6295
ReadX 6295 0 511 511
ReadX 6295 0 530 530
Close 6300
Close 6297
Close 6298
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\PXTOOLS.FT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6309
Close 6309
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6310
QUERY_FILE_INFORMATION 6310
ReadX 6310 0 64 64
Close 6328
Close 6329
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6331
ReadX 6331 0 511 511
ReadX 6331 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6343
ReadX 6343 0 41 41
ReadX 6331 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__50172.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6366
ReadX 6366 0 511 511
ReadX 6366 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6366
WriteX 6350 2048 2048 2048
WriteX 6350 0 88 88
NTCreateX \clients\client1\~dmtmp\PARADOX\ANSWER.DB 0x40 0x1 6382
ReadX 6382 0 511 511
ReadX 6382 2048 4096 4096
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ANSWER.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6382
Close 6350
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__50172.DB
Unlink \clients\client1\~dmtmp\PARADOX\__50172.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6384
Close 6384
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.FSL 0x40 0x1 6385
QUERY_FILE_INFORMATION 6385
ReadX 6385 0 64 64
Close 6388
Close 6389
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\QUENRD 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6399
ReadX 6399 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.PX 0x40 0x1 6400
ReadX 6411 241 298 298
Close 6411
ReadX 6399 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52E2B.FAM 0x40 0x1 -1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52E2B.DB
ReadX 6418 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__52EF7.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__52EF7.FAM 0x40 0x1 -1
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TEMPLATES 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\STARTUP 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\CHAP10.DOC
NTCreateX \clients\client1\~dmtmp\WORD\CHAP10.DOC 0x40 0x1 6444
QUERY_FILE_INFORMATION 6444
ReadX 6444 0 512 512
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT 1
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x40 0x2 6446
Close 6446
Unlink \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 6444 1568 512 512
ReadX 6444 1536 512 512
ReadX 6444 2176 384 384
ReadX 6444 1600 416 416
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0000.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0000.TMP 0x40 0x2 6447
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\HANDOUT.DOC 1
ReadX 6444 288 2048 2048
ReadX 6444 2336 2048 2048
ReadX 6444 4384 2048 2048
ReadX 6450 2560 2048 2048
ReadX 6450 4608 2048 2048
ReadX 6450 6656 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\BASEMACH.DOC
ReadX 6453 8192 4096 4096
Close 6452
Close 6453
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\RESULTS.XLS 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD0003.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD0003.TMP 0x40 0x2 6454
WriteX 6454 15359 1 1
QUERY_FILE_INFORMATION 6454
WriteX 6455 0 512 512
QUERY_FILE_INFORMATION 6450
QUERY_FILE_INFORMATION 6450
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL0004.TMP 1
Close 6450
NTCreateX \clients\client1\~dmtmp\WORD\HANDOUT.DOC 0x200000 0x1 6456
Close 6456
WriteX 6460 2560 512 512
WriteX 6460 0 512 512
QUERY_FILE_INFORMATION 6460
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FOO 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\FACTS.DOC
NTCreateX \clients\client1\~dmtmp\WORD\FACTS.DOC 0x40 0x1 6461
QUERY_FILE_INFORMATION 6461
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x40 0x2 6463
Close 6463
Unlink \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD3497.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD3497.TMP 0x40 0x2 6464
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS.DOC 1
ReadX 6461 2560 2048 2048
ReadX 6461 4608 2048 2048
ReadX 6461 6656 2048 2048
ReadX 6467 5632 2048 2048
ReadX 6467 7680 2048 2048
ReadX 6467 9728 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRD1119.TMP 1
NTCreateX \clients\client1\~dmtmp\WORD\~WRD1119.TMP 0x40 0x2 6469
WriteX 6469 11990 1 1
QUERY_FILE_INFORMATION 6469
WriteX 6470 0 512 512
QUERY_FILE_INFORMATION 6467
QUERY_FILE_INFORMATION 6467
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\~WRL1146.TMP 1
Close 6467
NTCreateX \clients\client1\~dmtmp\WORD\TIPS.DOC 0x200000 0x1 6471
Close 6471
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORD\TIPS 1
NTCreateX \clients\client1\~dmtmp\WORD\FSA4230.TMP 0x40 0x2 6476
Close 6476
Unlink \clients\client1\~dmtmp\WORD\FSA4230.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\FASTENER.MDB
NTCreateX \clients\client1\~dmtmp\ACCESS\FASTENER.MDB 0x40 0x1 6482
QUERY_FILE_INFORMATION 6482
ReadX 6482 528 2048 2048
ReadX 6482 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\INV.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\INV.PRN 0x40 0x2 6486
Close 6486
ReadX 6482 1384 2048 2048
ReadX 6482 2432 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\SALES.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\SALES.PRN 0x40 0x2 6490
Close 6490
ReadX 6482 2432 2048 2048
ReadX 6482 1384 2048 2048
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\ACCESS\LABELS.PRN 1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\ACCESS\LABELS.PRN 0x40 0x2 6494
Close 6494
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\PCBENCHM.PPT 0x40 0x1 6500
Close 6500
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT 0x40 0x2 6506
Close 6506
Unlink \clients\client1\~dmtmp\PWRPNT\NEWPCB.PPT
Close 6535
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TIPS.PPT
NTCreateX \clients\client1\~dmtmp\PWRPNT\TIPS.PPT 0x40 0x1 6537
Close 6537
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT 0x40 0x2 6543
Close 6543
Unlink \clients\client1\~dmtmp\PWRPNT\NEWTIPS.PPT
Unlink \clients\client1\~dmtmp\PWRPNT\PPTC241.TMP
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\Designs 1
NTCreateX \clients\client1\~dmtmp\Designs 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PWRPNT\TRIDOTS.PPT 1
NTCreateX \clients\client1\~dmtmp\PWRPNT\TRIDOTS.POT 0x40 0x1 6561
Close 6561
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6580
Close 6580
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 6583 8192 512 512
ReadX 6583 8704 512 512
Close 6583
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\CDRMENU.CFG 1
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6584
Close 6584
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC1.CDR 0x40 0x1 6589
ReadX 6589 0 8192 8192
Close 6589
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6590
Close 6590
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 6593 16384 8192 8192
ReadX 6593 24576 8192 8192
Close 6593
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 6595
Close 6595
Unlink \clients\client1\~dmtmp\COREL\GRAPH1.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x2 6597
WriteX 6597 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x40 0x1 6612
QUERY_FILE_INFORMATION 6612
Close 6612
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH1.CDR 0x200000 0x1 6613
Close 6613
Rename \clients\client1\~dmtmp\COREL\GRAPH1.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 6615
WriteX 6615 0 28489 28489
Close 6615
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH1.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 6616
Close 6616
NTCreateX \clients\client1\~dmtmp\COREL\GRAPHIC2.CDR 0x40 0x1 6619
ReadX 6619 0 8192 8192
Close 6619
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6620
Close 6620
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
ReadX 6623 65536 8192 8192
Close 6623
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 6625
Close 6625
Unlink \clients\client1\~dmtmp\COREL\GRAPH2.CDR
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.CDR 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x2 6627
WriteX 6627 8191 1 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x40 0x1 6631
QUERY_FILE_INFORMATION 6631
Close 6631
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\GRAPH2.CDR 0x200000 0x1 6632
Close 6632
Rename \clients\client1\~dmtmp\COREL\GRAPH2.CDR \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
QUERY_FILE_INFORMATION 6634
WriteX 6634 0 30183 30183
Close 6634
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\GRAPH2.BAK 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x200000 0x1 6635
Close 6635
WriteX 6636 1532 510 510
WriteX 6636 2042 168 168
Close 6636
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 1
NTCreateX \clients\client1\~dmtmp\COREL\@@@CDRW.TMP 0x40 0x2 6637
Close 6637
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\COREL\@@@CDRW.TMP
Close 6641
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\XLSTART\XL5GALRY.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\PCMAGCD.XLS 0x40 0x1 6642
QUERY_FILE_INFORMATION 6642
ReadX 6642 0 512 512
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 0x40 0x2 6643
Close 6643
Unlink \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x40 0x2 6644
WriteX 6644 1535 1 1
QUERY_FILE_INFORMATION 6644
Close 6645
WriteX 6644 0 4096 4096
Close 6644
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\5D7C0000
NTCreateX \clients\client1\~dmtmp\EXCEL\5D7C0000 0x200000 0x1 6646
Close 6646
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\0BBC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\0BBC0000 0x40 0x2 6648
WriteX 6648 1535 1 1
QUERY_FILE_INFORMATION 6648
FIND_FIRST \clients\client1\~dmtmp\<.JNK
ReadX 6650 4096 512 512
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS1.PRN 0x40 0x2 6652
Close 6652
QUERY_FILE_INFORMATION 6654
WriteX 6654 0 53077 53077
Close 6654
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\51EC0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\51EC0000 0x40 0x2 6655
WriteX 6655 1535 1 1
QUERY_FILE_INFORMATION 6655
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS2.PRN 0x40 0x2 6659
Close 6659
WriteX 6661 0 7983 7983
Close 6661
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\RESULTS3.PRN 0x40 0x2 6663
Close 6663
WriteX 6665 458687 65 65
WriteX 6665 458752 46731 46731
Close 6665
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\62AD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\62AD0000 0x40 0x2 6666
WriteX 6666 1535 1 1
QUERY_FILE_INFORMATION 6666
Close 6668
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLA 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLT 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLM 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLC 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLW 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES.XLS 0x40 0x1 6669
QUERY_FILE_INFORMATION 6669
ReadX 6669 0 512 512
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES.XLS
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.XLS 0x40 0x2 6670
Close 6670
Unlink \clients\client1\~dmtmp\EXCEL\SALES1.XLS
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x40 0x2 6671
WriteX 6671 2047 1 1
QUERY_FILE_INFORMATION 6671
Close 6672
WriteX 6671 0 42388 42388
Close 6671
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.XLS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\E0BD0000
NTCreateX \clients\client1\~dmtmp\EXCEL\E0BD0000 0x200000 0x1 6673
Close 6673
QUERY_FILE_INFORMATION 6674
FIND_FIRST \clients\client1\~dmtmp\<.JNK
FIND_FIRST \clients\client1\~dmtmp\<.JNK
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\BEED0000 1
NTCreateX \clients\client1\~dmtmp\EXCEL\BEED0000 0x40 0x2 6675
WriteX 6675 2047 1 1
QUERY_FILE_INFORMATION 6675
QUERY_FILE_INFORMATION 6677
FIND_FIRST \clients\client1\~dmtmp\<.JNK
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\EXCEL\SALES1.PRN 1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\EXCEL\SALES1.PRN 0x40 0x2 6679
Close 6679
Unlink \clients\client1\~dmtmp\PM\PMC162.TMP
QUERY_FS_INFORMATION 259
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC175.TMP 0x40 0x2 6689
Close 6689
Close 6692
Unlink \clients\client1\~dmtmp\PM\PMC180.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC183.TMP 0x40 0x2 6695
Close 6695
Close 6698
Unlink \clients\client1\~dmtmp\PM\PMC183.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\B 1
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6701
Close 6701
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\B 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BE 1
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6705
Close 6705
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BEN 1
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6709
Close 6709
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BEN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENC 1
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC184.TMP 0x40 0x2 6713
Close 6713
Unlink \clients\client1\~dmtmp\PM\PMC184.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENC 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCH 1
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6717
Close 6717
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCH 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHD 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6721
Close 6721
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHD 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDE 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC185.TMP 0x40 0x2 6725
Close 6725
Unlink \clients\client1\~dmtmp\PM\PMC185.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDE 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMC186.TMP 0x40 0x2 6729
Close 6729
Unlink \clients\client1\~dmtmp\PM\PMC186.TMP
NTCreateX \clients\client1\~dmtmp\PM\BENCHDES 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BENCHDES 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\PMC1A2.TMP 0x40 0x2 6731
Close 6731
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1.PRN 1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\BDES1.PRN 0x40 0x2 6733
Close 6733
Close 6735
QUERY_FS_INFORMATION 259
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\BDES1 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\T 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\T1 0x40 0x1 -1
Close 6747
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD383.TMP 0x40 0x2 6750
Close 6750
Close 6753
Unlink \clients\client1\~dmtmp\PM\PMD383.TMP
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\P 1
NTCreateX \clients\client1\~dmtmp\P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD391.TMP 0x40 0x2 6756
Close 6756
Close 6759
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\C 1
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6762
Close 6762
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\C 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CS 1
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6766
Close 6766
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CS 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN 1
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6770
Close 6770
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD392.TMP 0x40 0x2 6774
Close 6774
Unlink \clients\client1\~dmtmp\PM\PMD392.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_ 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 6778
Close 6778
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_ 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD393.TMP 0x40 0x2 6782
Close 6782
Unlink \clients\client1\~dmtmp\PM\PMD393.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6785
Close 6785
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.P 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6789
Close 6789
Unlink \clients\client1\~dmtmp\PM\PMD394.TMP
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.P 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2.PM 1
NTCreateX \clients\client1\~dmtmp\PM\CSN1_2.PM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\PMD394.TMP 0x40 0x2 6793
Close 6793
Unlink \clients\client1\~dmtmp\PM\PMD3A4.TMP
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PM\CSN1_2A 1
FIND_FIRST \clients\client1\~dmtmp\*
NTCreateX \clients\client1\~dmtmp\PM\E 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PM\EV 0x40 0x1 -1
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 0x40 0x2 6832
Close 6832
Unlink \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6834
WriteX 6834 15 1 1
WriteX 6834 0 10575 10575
Flush 6834
Close 6834
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6835
Close 6835
Close 6829
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1A.PRN 0x40 0x2 6842
Close 6842
WriteX 6844 589824 35257 35257
Close 6844
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\BENCHS1.PRN 0x40 0x2 6846
Close 6846
ReadX 6855 1025 2048 2048
ReadX 6855 1153 1385 1385
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 0x40 0x2 6857
Close 6857
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
Unlink \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x40 0x2 6859
WriteX 6859 15 1 1
WriteX 6859 0 11588 11588
Flush 6859
Close 6859
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.LWP 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP
NTCreateX \clients\client1\~dmtmp\WORDPRO\LWPSAV0.TMP 0x200000 0x1 6860
Close 6860
ReadX 6865 1926 15 15
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.~TS
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1A.PRN 0x40 0x2 6867
Close 6867
ReadX 6854 1540 4096 4096
FIND_FIRST \clients\client1\~dmtmp\*
QUERY_FS_INFORMATION 259
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\WORDPRO\NEWS1_1B.PRN 0x40 0x2 6871
Close 6871
QUERY_PATH_INFORMATION \clients\client1\~dmtmp
FIND_FIRST \clients\client1\~dmtmp\*
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6881
Close 6881
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6882
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6882 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6885
ReadX 6885 0 511 511
ReadX 6882 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6882
Close 6883
Close 6884
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.Y04 0x40 0x1 6889
ReadX 6889 0 511 511
ReadX 6886 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S3CF99.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__S31.DB 0x40 0x2 6890
FIND_FIRST \clients\client1\~dmtmp\*
Close 6890
ReadX 6906 293 2 2
Close 6906
ReadX 6902 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6902
Close 6903
Close 6904
Close 6891
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__S31.DB
Unlink \clients\client1\~dmtmp\PARADOX\__S31.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6907
Close 6907
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\COURSES 1
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6908
ReadX 6908 0 511 511
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.PX 0x40 0x1 6909
ReadX 6917 293 2 2
Close 6917
ReadX 6913 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__3F2C4.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\CHANGED.DB 0x40 0x1 6945
ReadX 6945 0 511 511
ReadX 6945 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\CHANGED.TV 1
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\DEFAULT.TV 1
Close 6945
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\TIMECHG 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\COURSES.DB 0x40 0x1 6946
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
Unlink \clients\client1\~dmtmp\PARADOX\__3F2C4.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS.DB
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6952
Close 6952
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\STUDENTS 1
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.DB 0x40 0x1 6953
ReadX 6953 0 511 511
ReadX 6953 0 530 530
NTCreateX \clients\client1\~dmtmp\PARADOX\STUDENTS.MB 0x40 0x1 6973
ReadX 6973 0 41 41
ReadX 6961 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__40D6B.FAM 0x40 0x1 -1
ReadX 6980 0 511 511
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__40D6B.DB
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6981
Close 6981
QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX
FIND_FIRST \clients\client1\~dmtmp\*
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\ENROLL 1
NTCreateX \clients\client1\~dmtmp\PARADOX\ENROLL.DB 0x40 0x1 6982
FIND_FIRST \clients\client1\~dmtmp\*
ReadX 6982 0 511 511
ReadX 6999 241 298 298
Close 6999
ReadX 6987 2048 2048 2048
-QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB
+QUERY_PATH_INFORMATION \clients\client1\~dmtmp\PARADOX\__414F2.DB 1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.FAM 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414F2.DB 0x40 0x1 -1
NTCreateX \clients\client1\~dmtmp\PARADOX\__414