1 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 2 6:32:42 PM WINLOGON.EXE:204 DIRECTORY C:\WINNT\system32\drivers SUCCESS Change Notify 3 6:32:42 PM WINLOGON.EXE:204 DIRECTORY C:\WINNT\system32\drivers Change Notify 4 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 5 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 4096 6 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 7 6:32:42 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 8 6:32:42 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 9 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 10 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 155648 Length: 4096 11 6:32:42 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 12 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 48128 Length: 512 13 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 48128 Length: 512 14 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 15 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 16 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 13312 Length: 512 17 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 13312 Length: 512 18 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 19 6:32:42 PM taskmgr.exe:620 QUERY INFORMATION C:\utilities\filemon\Filemon.exe SUCCESS Attributes: A 20 6:32:42 PM taskmgr.exe:620 OPEN C:\utilities\filemon\Filemon.exe SUCCESS Options: Open Access: Execute 21 6:32:42 PM taskmgr.exe:620 QUERY INFORMATION C:\utilities\filemon\Filemon.exe SUCCESS Length: 167936 22 6:32:42 PM taskmgr.exe:620 CLOSE C:\utilities\filemon\Filemon.exe SUCCESS 23 6:32:42 PM taskmgr.exe:620 QUERY INFORMATION C:\utilities\filemon\Filemon.exe SUCCESS Attributes: A 24 6:32:42 PM taskmgr.exe:620 OPEN C:\utilities\filemon\Filemon.exe SUCCESS Options: Open Access: Execute 25 6:32:42 PM taskmgr.exe:620 QUERY INFORMATION C:\utilities\filemon\Filemon.exe SUCCESS Length: 167936 26 6:32:42 PM taskmgr.exe:620 CLOSE C:\utilities\filemon\Filemon.exe SUCCESS 27 6:32:42 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 28 6:32:42 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 29 6:32:42 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 30 6:32:42 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 31 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 32 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 48128 Length: 512 33 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 48128 Length: 512 34 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 35 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 101888 Length: 512 36 6:32:42 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 106496 Length: 512 37 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 106496 Length: 512 38 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10096640 Length: 4096 39 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 4096 40 6:32:42 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 4096 41 6:32:42 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 42 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 100864 Length: 512 43 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 100864 Length: 512 44 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 45 6:32:43 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 46 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5189632 Length: 32768 47 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107008 Length: 4096 48 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 49 6:32:43 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 50 6:32:43 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 51 6:32:43 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 52 6:32:43 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 53 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 54 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 108544 Length: 512 55 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 108544 Length: 512 56 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 70144 Length: 4096 57 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 58 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 111104 Length: 4096 59 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 60 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 61 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 114176 Length: 512 62 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 114176 Length: 512 63 6:32:43 PM Eudora.exe:1420 QUERY INFORMATION C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp SUCCESS Attributes: D 64 6:32:43 PM Eudora.exe:1420 QUERY INFORMATION C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\plst2 FILE NOT FOUND Attributes: Error 65 6:32:43 PM Eudora.exe:1420 CREATE C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\plst2 SUCCESS Options: OverwriteIf Access: All 66 6:32:43 PM Eudora.exe:1420 WRITE C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\plst2 SUCCESS Offset: 0 Length: 1288 67 6:32:43 PM Eudora.exe:1420 CLOSE C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\plst2 SUCCESS 68 6:32:43 PM Eudora.exe:1420 OPEN C:\Program Files\Qualcomm\Eudora\EudPriv\Ads\CInfo.dat SUCCESS Options: Open Access: All 69 6:32:43 PM Eudora.exe:1420 QUERY INFORMATION C:\Program Files\Qualcomm\Eudora\EudPriv\Ads\CInfo.dat SUCCESS FileObjectIdInformation 70 6:32:43 PM Eudora.exe:1420 DELETE C:\Program Files\Qualcomm\Eudora\EudPriv\Ads\CInfo.dat SUCCESS 71 6:32:43 PM Eudora.exe:1420 CLOSE C:\Program Files\Qualcomm\Eudora\EudPriv\Ads\CInfo.dat SUCCESS 72 6:32:43 PM Eudora.exe:1420 OPEN C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\plst2 SUCCESS Options: Open Access: All 73 6:32:43 PM Eudora.exe:1420 QUERY INFORMATION C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\plst2 SUCCESS FileObjectIdInformation 74 6:32:43 PM Eudora.exe:1420 OPEN C:\Program Files\Qualcomm\Eudora\EudPriv\Ads\CInfo.dat SUCCESS Options: Open Access: All 75 6:32:43 PM Eudora.exe:1420 SET INFORMATION C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\plst2 SUCCESS FileRenameInformation 76 6:32:43 PM Eudora.exe:1420 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14237696 Length: 4096 77 6:32:43 PM Eudora.exe:1420 CLOSE C:\Program Files\Qualcomm\Eudora\EudPriv\Ads\CInfo.dat SUCCESS 78 6:32:43 PM Eudora.exe:1420 CLOSE C:\Program Files\Qualcomm\Eudora\EudPriv\Ads\CInfo.dat SUCCESS 79 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10178560 Length: 4096 80 6:32:43 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 81 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 115200 Length: 4096 82 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 83 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 84 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 115200 Length: 512 85 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 115200 Length: 512 86 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 74240 Length: 4096 87 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 88 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5189632 Length: 4096 89 6:32:43 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 90 6:32:43 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 91 6:32:43 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 92 6:32:43 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 93 6:32:43 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 94 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 59904 Length: 512 95 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 59904 Length: 512 96 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10006528 Length: 8192 97 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 98 6:32:43 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 99 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 119296 Length: 4096 100 6:32:43 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 101 6:32:43 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 102 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 119808 Length: 512 103 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 119808 Length: 512 104 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 78336 Length: 4096 105 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 106 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 4096 107 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 108 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 109 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 124928 Length: 512 110 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 124928 Length: 512 111 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 127488 Length: 4096 112 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 113 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 114 6:32:44 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 115 6:32:44 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 116 6:32:44 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 117 6:32:44 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 118 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 129024 Length: 512 119 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 129024 Length: 512 120 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 89600 Length: 512 121 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 89600 Length: 512 122 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 131584 Length: 4096 123 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 124 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 125 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 133120 Length: 512 126 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 133120 Length: 512 127 6:32:44 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 128 6:32:44 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 129 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 135680 Length: 4096 130 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 131 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 132 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 135680 Length: 512 133 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 135680 Length: 512 134 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 139776 Length: 4096 135 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 136 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 137 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 142848 Length: 512 138 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 142848 Length: 512 139 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 92672 Length: 512 140 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 92672 Length: 512 141 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 23552 Length: 512 142 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 23552 Length: 512 143 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 55296 Length: 512 144 6:32:44 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 145 6:32:44 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 146 6:32:44 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 147 6:32:44 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 148 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 55296 Length: 512 149 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 82432 Length: 4096 150 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 151 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 32768 Length: 512 152 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 32768 Length: 512 153 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 86528 Length: 4096 154 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 155 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 82432 Length: 512 156 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 82432 Length: 512 157 6:32:44 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 75776 Length: 512 158 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 75776 Length: 512 159 6:32:44 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6037504 Length: 4096 160 6:32:45 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 161 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 143872 Length: 4096 162 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 163 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 164 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 147456 Length: 512 165 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 147456 Length: 512 166 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 147968 Length: 4096 167 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 168 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 169 6:32:45 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 170 6:32:45 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 171 6:32:45 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 172 6:32:45 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 173 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 148992 Length: 512 174 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 148992 Length: 512 175 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 152064 Length: 4096 176 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 177 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 178 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 152064 Length: 512 179 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 152064 Length: 512 180 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 154112 Length: 512 181 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 154112 Length: 512 182 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 156160 Length: 4096 183 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 184 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 185 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 159744 Length: 512 186 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 159744 Length: 512 187 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 160256 Length: 4096 188 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 189 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 190 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 160256 Length: 512 191 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 160256 Length: 512 192 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 30208 Length: 512 193 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 30208 Length: 512 194 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 164352 Length: 4096 195 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 196 6:32:45 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 197 6:32:45 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 198 6:32:45 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 199 6:32:45 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 200 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 201 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 167424 Length: 512 202 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 167424 Length: 512 203 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 5120 Length: 512 204 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 5120 Length: 512 205 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9998336 Length: 4096 206 6:32:45 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 207 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 168448 Length: 4096 208 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 209 6:32:45 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 210 6:32:45 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 170496 Length: 512 211 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 170496 Length: 512 212 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10096640 Length: 4096 213 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 4096 214 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10113024 Length: 8192 215 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 4096 216 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 217 6:32:46 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\Filemon.exe SUCCESS Attributes: A 218 6:32:46 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 219 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 13824 Length: 512 220 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 13824 Length: 512 221 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 172544 Length: 4096 222 6:32:46 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 223 6:32:46 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 224 6:32:46 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 225 6:32:46 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 226 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 227 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 228 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 175616 Length: 512 229 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 175616 Length: 512 230 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 30208 Length: 512 231 6:32:46 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 232 6:32:46 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 233 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 30208 Length: 512 234 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 167936 Length: 512 235 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 167936 Length: 512 236 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 108032 Length: 512 237 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 108032 Length: 512 238 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 239 6:32:46 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 240 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 126464 Length: 512 241 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 126464 Length: 512 242 6:32:46 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 138752 Length: 512 243 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 138752 Length: 512 244 6:32:46 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 245 6:32:46 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 246 6:32:46 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 247 6:32:46 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 248 6:32:46 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Options: OpenIf Sequential Access: All 249 6:32:46 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS FileStandardInformation 250 6:32:46 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Length: 262144 251 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 252 6:32:46 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 253 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.001 SUCCESS Offset: 233472 Length: 12288 254 6:32:46 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 255 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 256 6:32:46 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 257 6:32:46 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Options: OpenIf Sequential Access: All 258 6:32:46 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS FileStandardInformation 259 6:32:46 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Length: 262144 260 6:32:46 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 261 6:32:46 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.002 SUCCESS Offset: 233472 Length: 12288 262 6:32:47 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 263 6:32:47 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 264 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 265 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 266 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1179648 Length: 4096 267 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 268 6:32:47 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 269 6:32:47 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 270 6:32:47 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 271 6:32:47 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 272 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2539520 Length: 4096 273 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2547712 Length: 8192 274 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 275 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1449984 Length: 4096 276 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 277 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2555904 Length: 53248 278 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 279 6:32:47 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 280 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 281 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 282 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 283 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 284 6:32:47 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 285 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 286 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 287 6:32:47 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 288 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 289 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 290 6:32:47 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 291 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.002 SUCCESS Offset: 0 Length: 4096 292 6:32:47 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 293 6:32:47 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 294 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 295 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 296 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10035200 Length: 12288 297 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10055680 Length: 4096 298 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 8192 299 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10076160 Length: 12288 300 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 301 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 302 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 303 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10166272 Length: 8192 304 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10178560 Length: 12288 305 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10194944 Length: 16384 306 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10219520 Length: 4096 307 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 308 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6037504 Length: 4096 309 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6045696 Length: 4096 310 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 311 6:32:47 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 312 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 313 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 314 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 315 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 316 6:32:47 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 317 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 318 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 319 6:32:47 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 320 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 321 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 322 6:32:47 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 323 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.002 SUCCESS Offset: 0 Length: 4096 324 6:32:47 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 325 6:32:47 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 326 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 327 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 328 6:32:47 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 329 6:32:47 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 330 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 331 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 512 Length: 512 332 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1024 Length: 512 333 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1536 Length: 512 334 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2048 Length: 512 335 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2560 Length: 512 336 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3072 Length: 512 337 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3584 Length: 512 338 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4096 Length: 512 339 6:32:47 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 340 6:32:47 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 341 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 342 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 512 Length: 512 343 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1024 Length: 512 344 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1536 Length: 512 345 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2048 Length: 512 346 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2560 Length: 512 347 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3072 Length: 512 348 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3584 Length: 512 349 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4096 Length: 512 350 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\NetApi32.dll SUCCESS Attributes: A 351 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\NetApi32.dll SUCCESS Options: Open Access: Execute 352 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\NetApi32.dll SUCCESS 353 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\SECUR32.DLL SUCCESS Attributes: A 354 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\SECUR32.DLL SUCCESS Options: Open Access: Execute 355 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\SECUR32.DLL SUCCESS 356 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\NETRAP.DLL SUCCESS Attributes: A 357 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\NETRAP.DLL SUCCESS Options: Open Access: Execute 358 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\NETRAP.DLL SUCCESS 359 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\SAMLIB.DLL SUCCESS Attributes: A 360 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\SAMLIB.DLL SUCCESS Options: Open Access: Execute 361 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\SAMLIB.DLL SUCCESS 362 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\WS2_32.DLL SUCCESS Attributes: A 363 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\WS2_32.DLL SUCCESS Options: Open Access: Execute 364 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\WS2_32.DLL SUCCESS 365 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\WS2HELP.DLL SUCCESS Attributes: A 366 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\WS2HELP.DLL SUCCESS Options: Open Access: Execute 367 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\WS2HELP.DLL SUCCESS 368 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\DNSAPI.DLL SUCCESS Attributes: A 369 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\DNSAPI.DLL SUCCESS Options: Open Access: Execute 370 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\DNSAPI.DLL SUCCESS 371 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\WSOCK32.DLL SUCCESS Attributes: A 372 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\WSOCK32.DLL SUCCESS Options: Open Access: Execute 373 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\WSOCK32.DLL SUCCESS 374 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\ntlanman.dll SUCCESS Attributes: A 375 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\ntlanman.dll SUCCESS Options: Open Access: Execute 376 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\ntlanman.dll SUCCESS Length: 36112 377 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\ntlanman.dll SUCCESS 378 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\ntlanman.dll SUCCESS Attributes: A 379 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\ntlanman.dll SUCCESS Options: Open Access: Execute 380 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\ntlanman.dll SUCCESS 381 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\NETUI0.DLL SUCCESS Attributes: A 382 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\NETUI0.DLL SUCCESS Options: Open Access: Execute 383 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\NETUI0.DLL SUCCESS 384 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\NETUI1.DLL SUCCESS Attributes: A 385 6:32:47 PM cisvc.exe:600 OPEN C:\WINNT\System32\NETUI1.DLL SUCCESS Options: Open Access: Execute 386 6:32:47 PM cisvc.exe:600 CLOSE C:\WINNT\System32\NETUI1.DLL SUCCESS 387 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\WINNT\System32\ntlanman.dll SUCCESS Attributes: A 388 6:32:47 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 389 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 390 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 391 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 392 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 393 6:32:47 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 394 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 395 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 396 6:32:47 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 397 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 398 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 399 6:32:47 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 400 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.001 SUCCESS Offset: 0 Length: 4096 401 6:32:47 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 402 6:32:47 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 403 6:32:47 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 404 6:32:47 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 405 6:32:47 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 406 6:32:47 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 407 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 408 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 409 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4608 Length: 4096 410 6:32:47 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 411 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 412 6:32:47 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 413 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 414 6:32:47 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 415 6:32:47 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 416 6:32:47 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 417 6:32:48 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 418 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 419 6:32:48 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 420 6:32:48 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 421 6:32:48 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 422 6:32:48 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 423 6:32:48 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 424 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.001 SUCCESS Offset: 0 Length: 4096 425 6:32:48 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 426 6:32:48 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 427 6:32:48 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 428 6:32:48 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 429 6:32:48 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 430 6:32:48 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 431 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 432 6:32:48 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 433 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4608 Length: 4096 434 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 435 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 436 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 6656 Length: 512 437 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 6656 Length: 512 438 6:32:48 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 439 6:32:48 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 440 6:32:48 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Options: OpenIf Sequential Access: All 441 6:32:48 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS FileStandardInformation 442 6:32:48 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Length: 65536 443 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 444 6:32:48 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 445 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 8704 Length: 4096 446 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 447 6:32:48 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 448 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 8704 Length: 4096 449 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 450 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 451 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.002 SUCCESS Offset: 0 Length: 4096 452 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 10240 Length: 512 453 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 10240 Length: 512 454 6:32:48 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 455 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 12800 Length: 4096 456 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 457 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 458 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 459 6:32:48 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 460 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 15872 Length: 512 461 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 15872 Length: 512 462 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 12800 Length: 4096 463 6:32:48 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Options: OpenIf Sequential Access: All 464 6:32:48 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS FileStandardInformation 465 6:32:48 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Length: 65536 466 6:32:48 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 467 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.001 SUCCESS Offset: 0 Length: 4096 468 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 469 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 16896 Length: 4096 470 6:32:48 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 471 6:32:48 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 472 6:32:48 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 473 6:32:48 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 474 6:32:48 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 475 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 476 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 477 6:32:48 PM cidaemon.exe:960 QUERY SECURITY C:\Program Files\Opera7,X\Cache4\opr00375.gif SUCCESS 478 6:32:48 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 479 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 480 6:32:48 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 481 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19968 Length: 512 482 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19968 Length: 512 483 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 16896 Length: 4096 484 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 485 6:32:48 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19968 Length: 512 486 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19968 Length: 512 487 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 20992 Length: 4096 488 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 489 6:32:48 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6045696 Length: 4096 490 6:32:49 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 491 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 20992 Length: 4096 492 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 493 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 494 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 21504 Length: 512 495 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 21504 Length: 512 496 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 25088 Length: 4096 497 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 498 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 25088 Length: 4096 499 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 500 6:32:49 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 501 6:32:49 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 502 6:32:49 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 503 6:32:49 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 504 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 505 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27136 Length: 512 506 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27136 Length: 512 507 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 29184 Length: 4096 508 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 509 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 510 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33280 Length: 4096 511 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 512 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 513 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 514 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27136 Length: 512 515 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27136 Length: 512 516 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10010624 Length: 4096 517 6:32:49 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 518 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 21504 Length: 512 519 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 21504 Length: 512 520 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27136 Length: 512 521 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27136 Length: 512 522 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 32256 Length: 512 523 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 32256 Length: 512 524 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 29184 Length: 4096 525 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 526 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 37376 Length: 4096 527 6:32:49 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 528 6:32:49 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 529 6:32:49 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 530 6:32:49 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 531 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 532 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 533 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 40448 Length: 512 534 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 40448 Length: 512 535 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 4096 536 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 537 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 538 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 539 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 540 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 33280 Length: 4096 541 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 542 6:32:49 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 42496 Length: 512 543 6:32:49 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 42496 Length: 512 544 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 545 6:32:50 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 546 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 4096 547 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 548 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 549 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 512 550 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 512 551 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 37376 Length: 4096 552 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 553 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4608 Length: 512 554 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4608 Length: 512 555 6:32:50 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 556 6:32:50 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 557 6:32:50 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 558 6:32:50 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 559 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10108928 Length: 4096 560 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 4096 561 6:32:50 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 562 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 41472 Length: 4096 563 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 564 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 47104 Length: 512 565 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 47104 Length: 512 566 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10088448 Length: 4096 567 6:32:50 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 568 6:32:50 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 569 6:32:50 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 570 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 49664 Length: 4096 571 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 572 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 573 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 51712 Length: 512 574 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 51712 Length: 512 575 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 53760 Length: 4096 576 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 577 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 578 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 45568 Length: 4096 579 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 580 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6045696 Length: 4096 581 6:32:50 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 582 6:32:50 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 583 6:32:50 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 584 6:32:50 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 585 6:32:50 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 586 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 587 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 588 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 51712 Length: 512 589 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 51712 Length: 512 590 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5185536 Length: 4096 591 6:32:50 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 592 6:32:50 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 47104 Length: 512 593 6:32:50 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 47104 Length: 512 594 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 51712 Length: 512 595 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 51712 Length: 512 596 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 56320 Length: 512 597 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 56320 Length: 512 598 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 57856 Length: 4096 599 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 600 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 601 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 57856 Length: 512 602 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 57856 Length: 512 603 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 61952 Length: 4096 604 6:32:51 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 605 6:32:51 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 606 6:32:51 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 607 6:32:51 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 608 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 609 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 610 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 64000 Length: 512 611 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 64000 Length: 512 612 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 49664 Length: 4096 613 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 614 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 615 6:32:51 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 616 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 66048 Length: 4096 617 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 618 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 619 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 68608 Length: 512 620 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 68608 Length: 512 621 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5185536 Length: 4096 622 6:32:51 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 623 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 70144 Length: 4096 624 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 625 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 626 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 73728 Length: 512 627 6:32:51 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 628 6:32:51 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 629 6:32:51 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 630 6:32:51 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 631 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 73728 Length: 512 632 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 74240 Length: 4096 633 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 634 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 635 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 77824 Length: 512 636 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 77824 Length: 512 637 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 53760 Length: 4096 638 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 639 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 57856 Length: 4096 640 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 641 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 4096 642 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 643 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 644 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 79360 Length: 512 645 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 79360 Length: 512 646 6:32:51 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 82432 Length: 4096 647 6:32:51 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 648 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 649 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 84992 Length: 512 650 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 84992 Length: 512 651 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 86528 Length: 4096 652 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 653 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 654 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 87040 Length: 512 655 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 87040 Length: 512 656 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 90624 Length: 4096 657 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 658 6:32:52 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 659 6:32:52 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 660 6:32:52 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 661 6:32:52 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 662 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 663 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 90624 Length: 512 664 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 90624 Length: 512 665 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 74240 Length: 512 666 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 74240 Length: 512 667 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 94720 Length: 4096 668 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 669 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 670 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 96256 Length: 512 671 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 96256 Length: 512 672 6:32:52 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 673 6:32:52 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 674 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 67584 Length: 512 675 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 67584 Length: 512 676 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 98816 Length: 4096 677 6:32:52 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 678 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 679 6:32:52 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 680 6:32:52 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 681 6:32:52 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 682 6:32:52 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 683 6:32:52 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\pelscrll.dll SUCCESS Attributes: A 684 6:32:52 PM Filemon.exe:1128 OPEN C:\WINNT\System32\pelscrll.dll SUCCESS Options: Open Access: Execute 685 6:32:52 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\pelscrll.dll SUCCESS Length: 118784 686 6:32:52 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\pelscrll.dll SUCCESS 687 6:32:52 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\pelscrll.dll SUCCESS Attributes: A 688 6:32:52 PM Filemon.exe:1128 OPEN C:\WINNT\System32\pelscrll.dll SUCCESS Options: Open Access: Execute 689 6:32:52 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\pelscrll.dll SUCCESS 690 6:32:52 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\PELCOMM.dll SUCCESS Attributes: A 691 6:32:52 PM Filemon.exe:1128 OPEN C:\WINNT\System32\PELCOMM.dll SUCCESS Options: Open Access: Execute 692 6:32:52 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\PELCOMM.dll SUCCESS 693 6:32:52 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\PELHOOKS.dll SUCCESS Attributes: A 694 6:32:52 PM Filemon.exe:1128 OPEN C:\WINNT\System32\PELHOOKS.dll SUCCESS Options: Open Access: Execute 695 6:32:52 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\PELHOOKS.dll SUCCESS 696 6:32:52 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 61952 Length: 4096 697 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 698 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10170368 Length: 4096 699 6:32:53 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 700 6:32:53 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 701 6:32:53 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 702 6:32:53 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 703 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10178560 Length: 4096 704 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10186752 Length: 8192 705 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 8192 706 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10215424 Length: 8192 707 6:32:53 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 708 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10092544 Length: 4096 709 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10129408 Length: 4096 710 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10137600 Length: 4096 711 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 712 6:32:53 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 713 6:32:53 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 714 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 715 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10170368 Length: 4096 716 6:32:53 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 717 6:32:53 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 67584 Length: 512 718 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 67584 Length: 512 719 6:32:53 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 720 6:32:53 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 721 6:32:53 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 722 6:32:53 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 723 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 724 6:32:53 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 725 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10092544 Length: 4096 726 6:32:53 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 727 6:32:53 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 96256 Length: 512 728 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 96256 Length: 512 729 6:32:53 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10006528 Length: 4096 730 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 731 6:32:54 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 732 6:32:54 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 67584 Length: 512 733 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 67584 Length: 512 734 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2543616 Length: 12288 735 6:32:54 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 736 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 737 6:32:54 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 738 6:32:54 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 739 6:32:54 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 740 6:32:54 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 741 6:32:54 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 742 6:32:54 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102400 Length: 512 743 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102400 Length: 512 744 6:32:54 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102400 Length: 512 745 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102400 Length: 512 746 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1445888 Length: 12288 747 6:32:54 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 748 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 4096 749 6:32:54 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 750 6:32:54 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 751 6:32:54 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 752 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 753 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 66048 Length: 4096 754 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 755 6:32:54 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 756 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 757 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107008 Length: 4096 758 6:32:54 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 759 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 760 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1196032 Length: 4096 761 6:32:54 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 762 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10092544 Length: 4096 763 6:32:54 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 764 6:32:54 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 765 6:32:54 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 766 6:32:54 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 767 6:32:54 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 768 6:32:54 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 769 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 770 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10039296 Length: 4096 771 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10047488 Length: 4096 772 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10072064 Length: 4096 773 6:32:54 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 774 6:32:54 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 155648 Length: 4096 775 6:32:55 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 776 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 777 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 778 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 779 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 780 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 781 6:32:55 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 782 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 783 6:32:55 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 784 6:32:55 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 785 6:32:55 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 786 6:32:55 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 787 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 788 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 111104 Length: 4096 789 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 790 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 791 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 70144 Length: 4096 792 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 793 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 794 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 795 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 796 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 797 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1413120 Length: 4096 798 6:32:55 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 799 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10031104 Length: 4096 800 6:32:55 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 801 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 802 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 803 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 115200 Length: 4096 804 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 805 6:32:55 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 806 6:32:55 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 807 6:32:55 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 808 6:32:55 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 809 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 810 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10170368 Length: 8192 811 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 4096 812 6:32:55 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 813 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 814 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 815 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 816 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 817 6:32:55 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 113664 Length: 512 818 6:32:55 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 113664 Length: 512 819 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2551808 Length: 4096 820 6:32:56 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 821 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 822 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6049792 Length: 4096 823 6:32:56 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 824 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 119296 Length: 4096 825 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 826 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 827 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 828 6:32:56 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 829 6:32:56 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 830 6:32:56 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 831 6:32:56 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 832 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 833 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 4096 834 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 835 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 836 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1413120 Length: 4096 837 6:32:56 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 838 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10031104 Length: 4096 839 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10059776 Length: 4096 840 6:32:56 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 841 6:32:56 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 842 6:32:56 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 843 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10186752 Length: 4096 844 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 845 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 846 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10059776 Length: 4096 847 6:32:56 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 848 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 849 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 850 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 851 6:32:56 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 852 6:32:56 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 853 6:32:56 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 854 6:32:56 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 855 6:32:56 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 856 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 857 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 858 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 127488 Length: 4096 859 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 860 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 861 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 862 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 863 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 131584 Length: 4096 864 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 865 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 866 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 867 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 868 6:32:56 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 132096 Length: 512 869 6:32:56 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 132096 Length: 512 870 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 135680 Length: 4096 871 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 872 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 873 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10014720 Length: 4096 874 6:32:57 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 875 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 876 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 877 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10182656 Length: 8192 878 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 4096 879 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10211328 Length: 4096 880 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 881 6:32:57 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 882 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 883 6:32:57 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 884 6:32:57 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 885 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 886 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 887 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6049792 Length: 4096 888 6:32:57 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 889 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 890 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 891 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 892 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 893 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 894 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 895 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 896 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 897 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6049792 Length: 4096 898 6:32:57 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 899 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10186752 Length: 4096 900 6:32:57 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 901 6:32:57 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 902 6:32:57 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 903 6:32:57 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 904 6:32:57 PM explorer.exe:924 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 905 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS FileNameInformation 906 6:32:57 PM explorer.exe:924 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 907 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Length: 563 908 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Attributes: A 909 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Length: 563 910 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Length: 563 911 6:32:57 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 10 912 6:32:57 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 913 6:32:57 PM explorer.exe:924 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 914 6:32:57 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 915 6:32:57 PM explorer.exe:924 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 916 6:32:57 PM explorer.exe:924 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 917 6:32:57 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 918 6:32:57 PM explorer.exe:924 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 919 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: All 920 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe BUFFER OVERFLOW FileFsVolumeInformation 921 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe BUFFER OVERFLOW FileAllInformation 922 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS FileFsControlQueryInformation 923 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X IS DIRECTORY Options: Open Access: All 924 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X SUCCESS Options: Open Access: All 925 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X SUCCESS 926 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 927 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 928 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 929 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 930 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 931 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 932 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 933 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 934 6:32:57 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 935 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 936 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Qualcomm\Eudora\Attach SUCCESS Attributes: D 937 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 938 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 939 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 940 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 941 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 942 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 943 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 944 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 945 6:32:57 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 946 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 947 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\program files\qualcomm\eudora\embedded SUCCESS Attributes: D 948 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 949 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: program files 950 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 951 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 952 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 953 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 954 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 955 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 956 6:32:57 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 957 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 958 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\program files\qualcomm\eudora\imap SUCCESS Attributes: D 959 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 960 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: program files 961 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 962 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 963 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 964 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 965 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 966 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 967 6:32:57 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 968 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 969 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\progra~1\qualcomm\eudora\attach SUCCESS Attributes: D 970 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 971 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 972 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 973 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 974 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 975 6:32:57 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 976 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 977 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\progra~1\qualcomm\eudora\embedded SUCCESS Attributes: D 978 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 979 6:32:57 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 980 6:32:57 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 981 6:32:57 PM explorer.exe:924 CLOSE C:\ SUCCESS 982 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 983 6:32:57 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 984 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 985 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\progra~1\qualcomm\eudora\imap SUCCESS Attributes: D 986 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: All 987 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 988 6:32:57 PM explorer.exe:924 SET INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS FileBasicInformation 989 6:32:57 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 0 Length: 64 990 6:32:57 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 256 Length: 64 991 6:32:57 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 328 Length: 4 992 6:32:57 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 348 Length: 4 993 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 994 6:32:57 PM explorer.exe:924 OPEN C:\WINNT\AppPatch\LayerStorage.dat FILE NOT FOUND Options: Open Access: All 995 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: Execute 996 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 997 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 998 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 999 6:32:57 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: Execute 1000 6:32:57 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 1001 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 1002 6:32:57 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 1003 6:32:57 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 1004 6:32:57 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X SUCCESS Options: Open Directory Access: Traverse 1005 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1220608 Length: 16384 1006 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 1007 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\winmm.dll FILE NOT FOUND Attributes: Error 1008 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\winmm.dll FILE NOT FOUND Attributes: Error 1009 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\winmm.dll SUCCESS Attributes: A 1010 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\winmm.dll SUCCESS Options: Open Access: Execute 1011 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\winmm.dll SUCCESS 1012 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\winmm.dll SUCCESS Offset: 1024 Length: 8192 1013 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 1014 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1015 6:32:57 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1016 6:32:57 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1017 6:32:57 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1018 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\wsock32.dll FILE NOT FOUND Attributes: Error 1019 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\wsock32.dll FILE NOT FOUND Attributes: Error 1020 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\wsock32.dll SUCCESS Attributes: A 1021 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\wsock32.dll SUCCESS Options: Open Access: Execute 1022 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\wsock32.dll SUCCESS 1023 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\WS2_32.DLL FILE NOT FOUND Attributes: Error 1024 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\WS2_32.DLL FILE NOT FOUND Attributes: Error 1025 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\WS2_32.DLL SUCCESS Attributes: A 1026 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\WS2_32.DLL SUCCESS Options: Open Access: Execute 1027 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\WS2_32.DLL SUCCESS 1028 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\WS2HELP.DLL FILE NOT FOUND Attributes: Error 1029 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\WS2HELP.DLL FILE NOT FOUND Attributes: Error 1030 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\WS2HELP.DLL SUCCESS Attributes: A 1031 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\WS2HELP.DLL SUCCESS Options: Open Access: Execute 1032 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\WS2HELP.DLL SUCCESS 1033 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\imm32.dll FILE NOT FOUND Attributes: Error 1034 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\imm32.dll FILE NOT FOUND Attributes: Error 1035 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\imm32.dll SUCCESS Attributes: A 1036 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\imm32.dll SUCCESS Options: Open Access: Execute 1037 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\imm32.dll SUCCESS 1038 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\zip.dll SUCCESS Attributes: A 1039 6:32:57 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\zip.dll SUCCESS Options: Open Access: Execute 1040 6:32:57 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\zip.dll SUCCESS 1041 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\zip.dll SUCCESS Offset: 0 Length: 1536 1042 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10182656 Length: 8192 1043 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\zip.dll SUCCESS Offset: 33792 Length: 4096 1044 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\zip.dll SUCCESS Offset: 22016 Length: 8192 1045 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opjpeg32.dll SUCCESS Attributes: A 1046 6:32:57 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\opjpeg32.dll SUCCESS Options: Open Access: Execute 1047 6:32:57 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\opjpeg32.dll SUCCESS 1048 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 0 Length: 1536 1049 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 49152 Length: 4096 1050 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 4096 1051 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 41472 Length: 4096 1052 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\oppng32.dll SUCCESS Attributes: A 1053 6:32:57 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\oppng32.dll SUCCESS Options: Open Access: Execute 1054 6:32:57 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\oppng32.dll SUCCESS 1055 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 0 Length: 1536 1056 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10211328 Length: 4096 1057 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 60416 Length: 4608 1058 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 48640 Length: 4096 1059 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Attributes: A 1060 6:32:57 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Options: Open Access: Execute 1061 6:32:57 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\xmlparse.dll SUCCESS 1062 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Offset: 0 Length: 1536 1063 6:32:57 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1064 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Offset: 43520 Length: 4096 1065 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Offset: 28160 Length: 12288 1066 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe.Local FILE NOT FOUND Attributes: Error 1067 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\IMM32.DLL SUCCESS Attributes: A 1068 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\IMM32.DLL SUCCESS Attributes: A 1069 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\LPK.DLL FILE NOT FOUND Attributes: Error 1070 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\LPK.DLL FILE NOT FOUND Attributes: Error 1071 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\LPK.DLL SUCCESS Attributes: A 1072 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\LPK.DLL SUCCESS Options: Open Access: Execute 1073 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\LPK.DLL SUCCESS 1074 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\USP10.dll FILE NOT FOUND Attributes: Error 1075 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\USP10.dll FILE NOT FOUND Attributes: Error 1076 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\USP10.dll SUCCESS Attributes: A 1077 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\USP10.dll SUCCESS Options: Open Access: Execute 1078 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\USP10.dll SUCCESS 1079 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1186816 Length: 16384 1080 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\NVDESK32.DLL FILE NOT FOUND Attributes: Error 1081 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\NVDESK32.DLL FILE NOT FOUND Attributes: Error 1082 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\NVDESK32.DLL SUCCESS Attributes: A 1083 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\NVDESK32.DLL SUCCESS Options: Open Access: Execute 1084 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\NVDESK32.DLL SUCCESS 1085 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\winmm.dll SUCCESS Offset: 128000 Length: 16384 1086 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\serwvdrv.dll FILE NOT FOUND Attributes: Error 1087 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\serwvdrv.dll FILE NOT FOUND Attributes: Error 1088 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\serwvdrv.dll SUCCESS Attributes: A 1089 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\serwvdrv.dll SUCCESS Options: Open Access: Execute 1090 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\serwvdrv.dll SUCCESS 1091 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\serwvdrv.dll SUCCESS Offset: 0 Length: 1536 1092 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\serwvdrv.dll SUCCESS Offset: 12800 Length: 512 1093 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\umdmxfrm.dll FILE NOT FOUND Attributes: Error 1094 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\umdmxfrm.dll FILE NOT FOUND Attributes: Error 1095 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\umdmxfrm.dll SUCCESS Attributes: A 1096 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\umdmxfrm.dll SUCCESS Options: Open Access: Execute 1097 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\umdmxfrm.dll SUCCESS 1098 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\umdmxfrm.dll SUCCESS Offset: 0 Length: 1536 1099 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\umdmxfrm.dll SUCCESS Offset: 9728 Length: 1536 1100 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\umdmxfrm.dll SUCCESS Offset: 1536 Length: 4096 1101 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\serwvdrv.dll SUCCESS Offset: 13312 Length: 1536 1102 6:32:57 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 1103 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\mmdrv.dll FILE NOT FOUND Attributes: Error 1104 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\mmdrv.dll FILE NOT FOUND Attributes: Error 1105 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\mmdrv.dll SUCCESS Attributes: A 1106 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\System32\mmdrv.dll SUCCESS Options: Open Access: Execute 1107 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\mmdrv.dll SUCCESS FileNameInformation 1108 6:32:57 PM opera.exe:1304 OPEN C:\WINNT\system32\mmdrv.dll SUCCESS Options: Open Access: All 1109 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\mmdrv.dll SUCCESS Length: 12048 1110 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\mmdrv.dll SUCCESS Attributes: A 1111 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\mmdrv.dll SUCCESS Length: 12048 1112 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\mmdrv.dll SUCCESS Length: 12048 1113 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\mmdrv.dll SUCCESS Offset: 0 Length: 1024 1114 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\mmdrv.dll SUCCESS Offset: 0 Length: 4096 1115 6:32:57 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 1116 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\mmdrv.dll SUCCESS Offset: 1024 Length: 64 1117 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\mmdrv.dll SUCCESS Offset: 1088 Length: 1024 1118 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\mmdrv.dll SUCCESS Offset: 2112 Length: 2048 1119 6:32:57 PM opera.exe:1304 READ C:\WINNT\system32\mmdrv.dll SUCCESS Offset: 10000 Length: 2048 1120 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\system32\mmdrv.dll SUCCESS 1121 6:32:57 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\mmdrv.dll SUCCESS Length: 12048 1122 6:32:57 PM opera.exe:1304 READ C:\WINNT\System32\mmdrv.dll SUCCESS Offset: 0 Length: 4096 1123 6:32:57 PM opera.exe:1304 CLOSE C:\WINNT\System32\mmdrv.dll SUCCESS 1124 6:32:57 PM opera.exe:1304 READ C:\WINNT\System32\mmdrv.dll SUCCESS Offset: 1024 Length: 9216 1125 6:32:57 PM opera.exe:1304 READ C:\Program Files\Opera7,X\zip.dll SUCCESS Offset: 1536 Length: 16384 1126 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 1127 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\zip.dll SUCCESS Offset: 17920 Length: 4096 1128 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\zip.dll SUCCESS Offset: 30208 Length: 2048 1129 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\zip.dll SUCCESS Offset: 32256 Length: 1536 1130 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 1536 Length: 16384 1131 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 1132 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 17920 Length: 16384 1133 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 34304 Length: 7168 1134 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 45568 Length: 1536 1135 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Opjpeg32.dll SUCCESS Offset: 47104 Length: 2048 1136 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 1536 Length: 16384 1137 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 17920 Length: 16384 1138 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 34304 Length: 14336 1139 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 52736 Length: 4608 1140 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\Oppng32.dll SUCCESS Offset: 57344 Length: 3072 1141 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Offset: 1536 Length: 16384 1142 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 1143 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Offset: 17920 Length: 10240 1144 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 1145 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Offset: 40448 Length: 1024 1146 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Offset: 41472 Length: 2048 1147 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1536 Length: 16384 1148 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 113664 Length: 512 1149 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 17920 Length: 16384 1150 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 34304 Length: 16384 1151 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 50688 Length: 16384 1152 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 67072 Length: 16384 1153 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 83456 Length: 16384 1154 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 99840 Length: 16384 1155 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 116224 Length: 16384 1156 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 132608 Length: 16384 1157 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 148992 Length: 16384 1158 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 165376 Length: 16384 1159 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 181760 Length: 16384 1160 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 198144 Length: 16384 1161 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 214528 Length: 16384 1162 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 230912 Length: 16384 1163 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 247296 Length: 16384 1164 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 263680 Length: 16384 1165 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 280064 Length: 16384 1166 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 296448 Length: 16384 1167 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 312832 Length: 16384 1168 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 329216 Length: 16384 1169 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 345600 Length: 16384 1170 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 361984 Length: 16384 1171 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 113664 Length: 512 1172 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 378368 Length: 16384 1173 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 394752 Length: 16384 1174 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 411136 Length: 16384 1175 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 427520 Length: 16384 1176 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 443904 Length: 16384 1177 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 460288 Length: 16384 1178 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 476672 Length: 16384 1179 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 493056 Length: 16384 1180 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2555904 Length: 16384 1181 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 509440 Length: 16384 1182 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 525824 Length: 16384 1183 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 542208 Length: 16384 1184 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 558592 Length: 16384 1185 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 574976 Length: 16384 1186 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 591360 Length: 16384 1187 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 607744 Length: 16384 1188 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2576384 Length: 4096 1189 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 624128 Length: 16384 1190 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 640512 Length: 16384 1191 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 656896 Length: 16384 1192 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 673280 Length: 16384 1193 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 689664 Length: 16384 1194 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 706048 Length: 16384 1195 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 722432 Length: 16384 1196 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 738816 Length: 16384 1197 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 755200 Length: 16384 1198 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 771584 Length: 16384 1199 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 787968 Length: 16384 1200 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 804352 Length: 16384 1201 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 820736 Length: 16384 1202 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 837120 Length: 16384 1203 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 853504 Length: 16384 1204 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 869888 Length: 16384 1205 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 886272 Length: 16384 1206 6:32:58 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1207 6:32:58 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1208 6:32:58 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1209 6:32:58 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1210 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 902656 Length: 16384 1211 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 919040 Length: 16384 1212 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2584576 Length: 4096 1213 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 935424 Length: 16384 1214 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 951808 Length: 16384 1215 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 968192 Length: 16384 1216 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 984576 Length: 16384 1217 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1000960 Length: 16384 1218 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1017344 Length: 1536 1219 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1018880 Length: 16384 1220 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1035264 Length: 16384 1221 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1051648 Length: 16384 1222 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1068032 Length: 16384 1223 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1084416 Length: 16384 1224 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1100800 Length: 1536 1225 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1102336 Length: 16384 1226 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1118720 Length: 16384 1227 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1135104 Length: 16384 1228 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1151488 Length: 16384 1229 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1167872 Length: 2560 1230 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1203200 Length: 16384 1231 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 1219584 Length: 1024 1232 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\Msimg32.dll FILE NOT FOUND Attributes: Error 1233 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\Msimg32.dll FILE NOT FOUND Attributes: Error 1234 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\Msimg32.dll SUCCESS Attributes: A 1235 6:32:58 PM opera.exe:1304 OPEN C:\WINNT\System32\Msimg32.dll SUCCESS Options: Open Access: Execute 1236 6:32:58 PM opera.exe:1304 CLOSE C:\WINNT\System32\Msimg32.dll SUCCESS 1237 6:32:58 PM opera.exe:1304 READ C:\WINNT\system32\msimg32.dll SUCCESS Offset: 0 Length: 1536 1238 6:32:58 PM opera.exe:1304 READ C:\WINNT\system32\msimg32.dll SUCCESS Offset: 1536 Length: 2048 1239 6:32:58 PM opera.exe:1304 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 1240 6:32:58 PM opera.exe:1304 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 1241 6:32:58 PM opera.exe:1304 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 1242 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Attributes: A 1243 6:32:58 PM opera.exe:1304 OPEN C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Options: Open Access: Execute 1244 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Length: 40960 1245 6:32:58 PM opera.exe:1304 CLOSE C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS 1246 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Attributes: A 1247 6:32:58 PM opera.exe:1304 OPEN C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Options: Open Access: Execute 1248 6:32:58 PM opera.exe:1304 CLOSE C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS 1249 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\My Documents SUCCESS Attributes: D 1250 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 1251 6:32:58 PM opera.exe:1304 OPEN C:\ SUCCESS Options: Open Directory Access: All 1252 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\ SUCCESS FileNameInformation 1253 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\ SUCCESS FileFsVolumeInformation 1254 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\ SUCCESS FileFsAttributeInformation 1255 6:32:58 PM opera.exe:1304 CLOSE C:\ SUCCESS 1256 6:32:58 PM opera.exe:1304 OPEN C:\ SUCCESS Options: Open Directory Access: All 1257 6:32:58 PM opera.exe:1304 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 1258 6:32:58 PM opera.exe:1304 CLOSE C:\ SUCCESS 1259 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 1260 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 1261 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 1262 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 1263 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 1264 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 1265 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\~CLBCATQ.DLL FILE NOT FOUND Attributes: Error 1266 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\CLBCATQ.DLL FILE NOT FOUND Attributes: Error 1267 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\CLBCATQ.DLL FILE NOT FOUND Attributes: Error 1268 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\CLBCATQ.DLL SUCCESS Attributes: A 1269 6:32:58 PM opera.exe:1304 OPEN C:\WINNT\System32\CLBCATQ.DLL SUCCESS Options: Open Access: Execute 1270 6:32:58 PM opera.exe:1304 CLOSE C:\WINNT\System32\CLBCATQ.DLL SUCCESS 1271 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\cscui.dll FILE NOT FOUND Attributes: Error 1272 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\cscui.dll FILE NOT FOUND Attributes: Error 1273 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\cscui.dll SUCCESS Attributes: A 1274 6:32:58 PM opera.exe:1304 OPEN C:\WINNT\System32\cscui.dll SUCCESS Options: Open Access: Execute 1275 6:32:58 PM opera.exe:1304 CLOSE C:\WINNT\System32\cscui.dll SUCCESS 1276 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\CSCDLL.DLL FILE NOT FOUND Attributes: Error 1277 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\CSCDLL.DLL FILE NOT FOUND Attributes: Error 1278 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\CSCDLL.DLL SUCCESS Attributes: A 1279 6:32:58 PM opera.exe:1304 OPEN C:\WINNT\System32\CSCDLL.DLL SUCCESS Options: Open Access: Execute 1280 6:32:58 PM opera.exe:1304 CLOSE C:\WINNT\System32\CSCDLL.DLL SUCCESS 1281 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 1282 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 1283 6:32:58 PM opera.exe:1304 OPEN C:\WINNT\System32\shell32.dll SUCCESS Options: Open Access: All 1284 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 1285 6:32:58 PM opera.exe:1304 SET INFORMATION C:\WINNT\System32\shell32.dll SUCCESS FileBasicInformation 1286 6:32:58 PM opera.exe:1304 READ C:\WINNT\System32\shell32.dll SUCCESS Offset: 0 Length: 12 1287 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 1288 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 1289 6:32:58 PM opera.exe:1304 CLOSE C:\WINNT\System32\shell32.dll SUCCESS 1290 6:32:58 PM opera.exe:1304 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 1291 6:32:58 PM opera.exe:1304 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 1292 6:32:58 PM opera.exe:1304 CLOSE C:\Documents and Settings\ SUCCESS 1293 6:32:58 PM opera.exe:1304 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 1294 6:32:58 PM opera.exe:1304 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: My Documents 1295 6:32:58 PM opera.exe:1304 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 1296 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Application Data SUCCESS Attributes: DH 1297 6:32:58 PM opera.exe:1304 OPEN C:\ SUCCESS Options: Open Directory Access: All 1298 6:32:58 PM opera.exe:1304 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 1299 6:32:58 PM opera.exe:1304 CLOSE C:\ SUCCESS 1300 6:32:58 PM opera.exe:1304 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 1301 6:32:58 PM opera.exe:1304 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 1302 6:32:58 PM opera.exe:1304 CLOSE C:\Documents and Settings\ SUCCESS 1303 6:32:58 PM opera.exe:1304 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 1304 6:32:58 PM opera.exe:1304 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: Application Data 1305 6:32:58 PM opera.exe:1304 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 1306 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Options: Open Access: All 1307 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS FileNameInformation 1308 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Options: Open Access: All 1309 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Length: 3131 1310 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Attributes: A 1311 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Length: 3131 1312 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Length: 3131 1313 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Offset: 0 Length: 1024 1314 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Offset: 0 Length: 4096 1315 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Offset: 1024 Length: 2107 1316 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS 1317 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Offset: 0 Length: 4096 1318 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Offset: 0 Length: 4096 1319 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\OperaDef6.ini END OF FILE Offset: 3131 Length: 1024 1320 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\OperaDef6.ini END OF FILE Offset: 3131 Length: 4096 1321 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS 1322 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Documents and Settings\All Users\Start Menu\Programs SUCCESS Attributes: D 1323 6:32:58 PM opera.exe:1304 OPEN C:\ SUCCESS Options: Open Directory Access: All 1324 6:32:58 PM opera.exe:1304 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 1325 6:32:58 PM opera.exe:1304 CLOSE C:\ SUCCESS 1326 6:32:58 PM opera.exe:1304 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 1327 6:32:58 PM opera.exe:1304 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: All Users 1328 6:32:58 PM opera.exe:1304 CLOSE C:\Documents and Settings\ SUCCESS 1329 6:32:58 PM opera.exe:1304 OPEN C:\Documents and Settings\All Users\ SUCCESS Options: Open Directory Access: All 1330 6:32:58 PM opera.exe:1304 DIRECTORY C:\Documents and Settings\All Users\ SUCCESS FileBothDirectoryInformation: Start Menu 1331 6:32:58 PM opera.exe:1304 CLOSE C:\Documents and Settings\All Users\ SUCCESS 1332 6:32:58 PM opera.exe:1304 OPEN C:\Documents and Settings\All Users\Start Menu\ SUCCESS Options: Open Directory Access: All 1333 6:32:58 PM opera.exe:1304 DIRECTORY C:\Documents and Settings\All Users\Start Menu\ SUCCESS FileBothDirectoryInformation: Programs 1334 6:32:58 PM opera.exe:1304 CLOSE C:\Documents and Settings\All Users\Start Menu\ SUCCESS 1335 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Application Data\Opera\Opera7,X FILE NOT FOUND Attributes: Error 1336 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Options: Open Sequential Access: All 1337 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS FileObjectIdInformation 1338 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Length: 2910 1339 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Attributes: A 1340 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS FileStreamInformation 1341 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Attributes: A 1342 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS FileEaInformation 1343 6:32:58 PM opera.exe:1304 CREATE C:\Documents and Settings\Leonard Grossman\Application Data\Opera\Opera7,X\profile\sessions\Opera Software.win PATH NOT FOUND Options: Create Sequential Access: All 1344 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS 1345 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 1346 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS FileNameInformation 1347 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 1348 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 1349 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Attributes: A 1350 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 1351 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 1352 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 1024 1353 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 4096 1354 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2592768 Length: 4096 1355 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 1024 Length: 4833 1356 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 1357 6:32:58 PM opera.exe:1304 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 1358 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 1359 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 1360 6:32:58 PM opera.exe:1304 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 1361 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 1362 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 1363 6:32:58 PM opera.exe:1304 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 1364 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 1365 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 1366 6:32:58 PM opera.exe:1304 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 1367 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 1368 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 1369 6:32:58 PM opera.exe:1304 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 1370 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 1371 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 1372 6:32:58 PM opera.exe:1304 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 1373 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 1374 6:32:58 PM opera.exe:1304 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 1375 6:32:58 PM opera.exe:1304 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 1376 6:32:58 PM opera.exe:1304 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 1377 6:32:58 PM opera.exe:1304 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 1378 6:32:58 PM opera.exe:1304 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 1379 6:32:58 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 1380 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2605056 Length: 4096 1381 6:32:58 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1382 6:32:58 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1383 6:32:58 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1384 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6049792 Length: 4096 1385 6:32:58 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1386 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10186752 Length: 4096 1387 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1388 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1389 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 1390 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 1391 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1392 6:32:58 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1393 6:32:58 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1394 6:32:58 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1395 6:32:58 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1396 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1397 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 1398 6:32:58 PM cidaemon.exe:960 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00375.gif SUCCESS FileStandardInformation 1399 6:32:58 PM cidaemon.exe:960 CLOSE C:\Program Files\Opera7,X\Cache4\opr00375.gif SUCCESS 1400 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 512 1401 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2543616 Length: 4096 1402 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2551808 Length: 4096 1403 6:32:58 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1404 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 113664 Length: 512 1405 6:32:58 PM explorer.exe:924 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 1406 6:32:58 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 1407 6:32:58 PM explorer.exe:924 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 1408 6:32:58 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 113664 Length: 512 1409 6:32:58 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1410 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1411 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1412 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1413 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1414 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1415 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS Attributes: A 1416 6:32:59 PM explorer.exe:924 OPEN C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS Options: Open Access: Execute 1417 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS Length: 212992 1418 6:32:59 PM explorer.exe:924 CLOSE C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS 1419 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10031104 Length: 4096 1420 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10059776 Length: 4096 1421 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10080256 Length: 4096 1422 6:32:59 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1423 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1413120 Length: 4096 1424 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1425 6:32:59 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1426 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1427 6:32:59 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1428 6:32:59 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1429 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 1430 6:32:59 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1431 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS Attributes: A 1432 6:32:59 PM explorer.exe:924 OPEN C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS Options: Open Access: Execute 1433 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS Length: 212992 1434 6:32:59 PM explorer.exe:924 CLOSE C:\Program Files\Efficient Networks\EnterNet 300\app\ResENU.dll SUCCESS 1435 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 1436 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 1437 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1438 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1439 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1440 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1441 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 1442 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 1443 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1444 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1445 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 1446 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 1447 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1448 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1449 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 1450 6:32:59 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1451 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1452 6:32:59 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1453 6:32:59 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1454 6:32:59 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1455 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 1456 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33792 Length: 512 1457 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1458 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65536 Length: 512 1459 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1449984 Length: 4096 1460 6:32:59 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1461 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 1462 6:32:59 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1463 6:32:59 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1464 6:32:59 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1465 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2555904 Length: 8192 1466 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2605056 Length: 4096 1467 6:33:00 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1468 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 1469 6:33:00 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1470 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 1471 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107520 Length: 512 1472 6:33:00 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1473 6:33:00 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1474 6:33:00 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1475 6:33:00 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1476 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2605056 Length: 4096 1477 6:33:00 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1478 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 1479 6:33:00 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1480 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1481 6:33:00 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1482 6:33:00 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1483 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1484 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1485 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1486 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1487 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1488 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2543616 Length: 4096 1489 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2551808 Length: 4096 1490 6:33:00 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1491 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 1492 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 1493 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1494 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1495 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1496 6:33:00 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1497 6:33:00 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1498 6:33:00 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1499 6:33:00 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1500 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1501 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1502 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1503 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 1504 6:33:00 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1505 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 1506 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 512 1507 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1508 6:33:00 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 512 1509 6:33:00 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 1510 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 18944 Length: 512 1511 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 1512 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 117248 Length: 512 1513 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 1514 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 122880 Length: 512 1515 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 1516 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 128000 Length: 512 1517 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 132096 Length: 512 1518 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 132096 Length: 512 1519 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 136704 Length: 512 1520 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 136704 Length: 512 1521 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 76800 Length: 512 1522 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 76800 Length: 512 1523 6:33:01 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1524 6:33:01 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1525 6:33:01 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1526 6:33:01 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1527 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 74240 Length: 4096 1528 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1529 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6049792 Length: 4096 1530 6:33:01 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1531 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 139776 Length: 4096 1532 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1533 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1534 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 140800 Length: 512 1535 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 140800 Length: 512 1536 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 78336 Length: 4096 1537 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1538 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 85504 Length: 512 1539 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 85504 Length: 512 1540 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 143872 Length: 4096 1541 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1542 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1543 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 145408 Length: 512 1544 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 145408 Length: 512 1545 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 147968 Length: 4096 1546 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1547 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1548 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 151552 Length: 512 1549 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 151552 Length: 512 1550 6:33:01 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1551 6:33:01 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1552 6:33:01 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1553 6:33:01 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1554 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1555 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 512 1556 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 151552 Length: 512 1557 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 151552 Length: 512 1558 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 100864 Length: 512 1559 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 100864 Length: 512 1560 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 152064 Length: 4096 1561 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1562 6:33:01 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1563 6:33:01 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 155136 Length: 512 1564 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 155136 Length: 512 1565 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 156160 Length: 4096 1566 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1567 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1568 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 159232 Length: 512 1569 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 159232 Length: 512 1570 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 160256 Length: 4096 1571 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1572 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1573 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 161280 Length: 512 1574 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 161280 Length: 512 1575 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 164352 Length: 4096 1576 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1577 6:33:02 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1578 6:33:02 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1579 6:33:02 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1580 6:33:02 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1581 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1582 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 165888 Length: 512 1583 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 165888 Length: 512 1584 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 167424 Length: 512 1585 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 167424 Length: 512 1586 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1449984 Length: 4096 1587 6:33:02 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1588 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 82432 Length: 4096 1589 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1590 6:33:02 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1591 6:33:02 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1592 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9998336 Length: 4096 1593 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10006528 Length: 4096 1594 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10014720 Length: 8192 1595 6:33:02 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1596 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5128192 Length: 4096 1597 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 71168 Length: 512 1598 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 71168 Length: 512 1599 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 86528 Length: 4096 1600 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1601 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 168448 Length: 4096 1602 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1603 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1604 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 169472 Length: 512 1605 6:33:02 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1606 6:33:02 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1607 6:33:02 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1608 6:33:02 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1609 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 169472 Length: 512 1610 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10174464 Length: 16384 1611 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 4096 1612 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10211328 Length: 8192 1613 6:33:02 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1614 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6062080 Length: 32768 1615 6:33:02 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 172544 Length: 4096 1616 6:33:02 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1617 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1618 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 175104 Length: 512 1619 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 175104 Length: 512 1620 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5128192 Length: 4096 1621 6:33:03 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1622 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 176640 Length: 4096 1623 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1624 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1625 6:33:03 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1626 6:33:03 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1627 6:33:03 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1628 6:33:03 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1629 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 178688 Length: 512 1630 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 178688 Length: 512 1631 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 180736 Length: 4096 1632 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1633 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1634 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 183808 Length: 512 1635 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 183808 Length: 512 1636 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 90624 Length: 4096 1637 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1638 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 15360 Length: 512 1639 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 15360 Length: 512 1640 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10092544 Length: 8192 1641 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 8192 1642 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10129408 Length: 4096 1643 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 1644 6:33:03 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1645 6:33:03 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1646 6:33:03 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1647 6:33:03 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1648 6:33:03 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1649 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 184832 Length: 4096 1650 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1651 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1652 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 186880 Length: 512 1653 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 186880 Length: 512 1654 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 77312 Length: 512 1655 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 77312 Length: 512 1656 6:33:03 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19456 Length: 512 1657 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19456 Length: 512 1658 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6029312 Length: 4096 1659 6:33:03 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6062080 Length: 4096 1660 6:33:04 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1661 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 188928 Length: 4096 1662 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1663 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1664 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 190464 Length: 512 1665 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 190464 Length: 512 1666 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 94720 Length: 4096 1667 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1668 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10006528 Length: 4096 1669 6:33:04 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1670 6:33:04 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1671 6:33:04 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1672 6:33:04 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1673 6:33:04 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1674 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 25088 Length: 512 1675 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 25088 Length: 512 1676 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 193024 Length: 4096 1677 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1678 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1679 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 196608 Length: 512 1680 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 196608 Length: 512 1681 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 69632 Length: 512 1682 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 69632 Length: 512 1683 6:33:04 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1684 6:33:04 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1685 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 109568 Length: 512 1686 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 109568 Length: 512 1687 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 69120 Length: 512 1688 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 69120 Length: 512 1689 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 197120 Length: 4096 1690 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1691 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1692 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 198656 Length: 512 1693 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 198656 Length: 512 1694 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 16384 Length: 512 1695 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 16384 Length: 512 1696 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 200192 Length: 512 1697 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 200192 Length: 512 1698 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 192000 Length: 512 1699 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 192000 Length: 512 1700 6:33:04 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1701 6:33:04 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1702 6:33:04 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1703 6:33:04 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1704 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6033408 Length: 4096 1705 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 1706 6:33:04 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1707 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 201216 Length: 4096 1708 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1709 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1710 6:33:04 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 204288 Length: 512 1711 6:33:04 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 204288 Length: 512 1712 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10158080 Length: 4096 1713 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10190848 Length: 4096 1714 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 4096 1715 6:33:05 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1716 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 80896 Length: 512 1717 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 80896 Length: 512 1718 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 4096 1719 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 4096 1720 6:33:05 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1721 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 7680 Length: 512 1722 6:33:05 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1723 6:33:05 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1724 6:33:05 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1725 6:33:05 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1726 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 7680 Length: 512 1727 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 103424 Length: 512 1728 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 103424 Length: 512 1729 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 1730 6:33:05 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1731 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 132608 Length: 512 1732 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 132608 Length: 512 1733 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 205312 Length: 4096 1734 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1735 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1736 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 207872 Length: 512 1737 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 207872 Length: 512 1738 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 209408 Length: 4096 1739 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1740 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1741 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 210432 Length: 512 1742 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 210432 Length: 512 1743 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 213504 Length: 4096 1744 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1745 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1746 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 216064 Length: 512 1747 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 216064 Length: 512 1748 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10174464 Length: 4096 1749 6:33:05 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1750 6:33:05 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1751 6:33:05 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1752 6:33:05 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1753 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10211328 Length: 4096 1754 6:33:05 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1755 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9056256 Length: 32768 1756 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 155136 Length: 512 1757 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 155136 Length: 512 1758 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 217600 Length: 4096 1759 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1760 6:33:05 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1761 6:33:05 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 221184 Length: 512 1762 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 221184 Length: 512 1763 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10113024 Length: 4096 1764 6:33:06 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1765 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 189952 Length: 512 1766 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 189952 Length: 512 1767 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 221696 Length: 4096 1768 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1769 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1770 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 223744 Length: 512 1771 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 223744 Length: 512 1772 6:33:06 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1773 6:33:06 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1774 6:33:06 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1775 6:33:06 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1776 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6037504 Length: 4096 1777 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6045696 Length: 4096 1778 6:33:06 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1779 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 512 1780 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 512 1781 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27648 Length: 512 1782 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 27648 Length: 512 1783 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 58880 Length: 512 1784 6:33:06 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1785 6:33:06 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1786 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 58880 Length: 512 1787 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 155648 Length: 4096 1788 6:33:06 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1789 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 225792 Length: 4096 1790 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1791 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1792 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 227328 Length: 512 1793 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 227328 Length: 512 1794 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1175552 Length: 4096 1795 6:33:06 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1796 6:33:06 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1797 6:33:06 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1798 6:33:06 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1799 6:33:06 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1800 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 180736 Length: 512 1801 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 180736 Length: 512 1802 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9056256 Length: 4096 1803 6:33:06 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1804 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 229888 Length: 4096 1805 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1806 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1807 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 231936 Length: 512 1808 6:33:06 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 231936 Length: 512 1809 6:33:06 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 110080 Length: 512 1810 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 110080 Length: 512 1811 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Options: OpenIf Sequential Access: All 1812 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS FileStandardInformation 1813 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Length: 262144 1814 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 1815 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 1816 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.002 SUCCESS Offset: 241664 Length: 8192 1817 6:33:07 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 1818 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 1819 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 1820 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Options: OpenIf Sequential Access: All 1821 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS FileStandardInformation 1822 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Length: 262144 1823 6:33:07 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 1824 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.001 SUCCESS Offset: 241664 Length: 8192 1825 6:33:07 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1826 6:33:07 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1827 6:33:07 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1828 6:33:07 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1829 6:33:07 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 1830 6:33:07 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 1831 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 1832 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 1833 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 155648 Length: 4096 1834 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1835 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2543616 Length: 4096 1836 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2551808 Length: 4096 1837 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1838 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1445888 Length: 4096 1839 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1840 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2555904 Length: 20480 1841 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2580480 Length: 28672 1842 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 1843 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 1844 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 1845 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 1846 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 1847 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 1848 6:33:07 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 1849 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 1850 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 1851 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 1852 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 1853 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 1854 6:33:07 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 1855 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.002 SUCCESS Offset: 0 Length: 4096 1856 6:33:07 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 1857 6:33:07 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 1858 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 1859 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 1860 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10027008 Length: 4096 1861 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10039296 Length: 8192 1862 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10051584 Length: 4096 1863 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10059776 Length: 28672 1864 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1865 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10125312 Length: 4096 1866 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 4096 1867 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1868 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10158080 Length: 8192 1869 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10194944 Length: 4096 1870 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10203136 Length: 4096 1871 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1872 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 1873 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 1874 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 1875 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 1876 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 1877 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 1878 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 1879 6:33:07 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 1880 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 1881 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 1882 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 1883 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 1884 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 1885 6:33:07 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 1886 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.002 SUCCESS Offset: 0 Length: 4096 1887 6:33:07 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 1888 6:33:07 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1889 6:33:07 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1890 6:33:07 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1891 6:33:07 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1892 6:33:07 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 1893 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 1894 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 1895 6:33:07 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 1896 6:33:07 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 1897 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1898 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 512 Length: 512 1899 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1024 Length: 512 1900 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1536 Length: 512 1901 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2048 Length: 512 1902 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2560 Length: 512 1903 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3072 Length: 512 1904 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3584 Length: 512 1905 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4096 Length: 512 1906 6:33:07 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 1907 6:33:07 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 1908 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1909 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 512 Length: 512 1910 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1024 Length: 512 1911 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1536 Length: 512 1912 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2048 Length: 512 1913 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2560 Length: 512 1914 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3072 Length: 512 1915 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3584 Length: 512 1916 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4096 Length: 512 1917 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 1918 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 1919 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 1920 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 1921 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 1922 6:33:07 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 1923 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 1924 6:33:07 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 1925 6:33:07 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 1926 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 1927 6:33:07 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 1928 6:33:07 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 1929 6:33:07 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.001 SUCCESS Offset: 0 Length: 4096 1930 6:33:08 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 1931 6:33:08 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 1932 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 1933 6:33:08 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 1934 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4608 Length: 4096 1935 6:33:08 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1936 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1937 6:33:08 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 1938 6:33:08 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 1939 6:33:08 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 1940 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 1941 6:33:08 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 1942 6:33:08 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 1943 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 1944 6:33:08 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 1945 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 1946 6:33:08 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 1947 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 1948 6:33:08 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 1949 6:33:08 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 1950 6:33:08 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 1951 6:33:08 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 1952 6:33:08 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 1953 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.001 SUCCESS Offset: 0 Length: 4096 1954 6:33:08 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 1955 6:33:08 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 1956 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 1957 6:33:08 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 1958 6:33:08 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1959 6:33:08 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 1960 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4608 Length: 4096 1961 6:33:08 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1962 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1963 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 8704 Length: 4096 1964 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 1965 6:33:08 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 8192 Length: 512 1966 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 8192 Length: 512 1967 6:33:08 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Options: OpenIf Sequential Access: All 1968 6:33:08 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS FileStandardInformation 1969 6:33:08 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Length: 65536 1970 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 1971 6:33:08 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 1972 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 8704 Length: 4096 1973 6:33:08 PM explorer.exe:924 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 1974 6:33:08 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 1975 6:33:08 PM explorer.exe:924 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 1976 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 1977 6:33:08 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 1978 6:33:08 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 1979 6:33:08 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 1980 6:33:08 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 1981 6:33:08 PM explorer.exe:924 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 1982 6:33:08 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 1983 6:33:08 PM explorer.exe:924 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 1984 6:33:08 PM explorer.exe:924 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 1985 6:33:08 PM explorer.exe:924 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 1986 6:33:08 PM explorer.exe:924 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 1987 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: All 1988 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe BUFFER OVERFLOW FileFsVolumeInformation 1989 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe BUFFER OVERFLOW FileAllInformation 1990 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS FileFsControlQueryInformation 1991 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X IS DIRECTORY Options: Open Access: All 1992 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X SUCCESS Options: Open Access: All 1993 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X SUCCESS 1994 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 1995 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 1996 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 1997 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 1998 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 1999 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 2000 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2001 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 2002 6:33:08 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 2003 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 2004 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Qualcomm\Eudora\Attach SUCCESS Attributes: D 2005 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2006 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 2007 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2008 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2009 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2010 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 2011 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2012 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 2013 6:33:08 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 2014 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 2015 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\program files\qualcomm\eudora\embedded SUCCESS Attributes: D 2016 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2017 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: program files 2018 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2019 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2020 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2021 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 2022 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2023 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 2024 6:33:08 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 2025 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 2026 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\program files\qualcomm\eudora\imap SUCCESS Attributes: D 2027 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2028 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: program files 2029 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2030 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2031 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2032 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 2033 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2034 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 2035 6:33:08 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 2036 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 2037 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\progra~1\qualcomm\eudora\attach SUCCESS Attributes: D 2038 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2039 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2040 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 2041 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2042 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 2043 6:33:08 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 2044 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 2045 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\progra~1\qualcomm\eudora\embedded SUCCESS Attributes: D 2046 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2047 6:33:08 PM explorer.exe:924 OPEN C:\ SUCCESS Options: Open Directory Access: All 2048 6:33:08 PM explorer.exe:924 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 2049 6:33:08 PM explorer.exe:924 CLOSE C:\ SUCCESS 2050 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\ SUCCESS Options: Open Directory Access: All 2051 6:33:08 PM explorer.exe:924 DIRECTORY C:\Program Files\ SUCCESS FileBothDirectoryInformation: Opera7,X 2052 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\ SUCCESS 2053 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\progra~1\qualcomm\eudora\imap SUCCESS Attributes: D 2054 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: All 2055 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2056 6:33:08 PM explorer.exe:924 SET INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS FileBasicInformation 2057 6:33:08 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 0 Length: 64 2058 6:33:08 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 256 Length: 64 2059 6:33:08 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 328 Length: 4 2060 6:33:08 PM explorer.exe:924 READ C:\Program Files\Opera7,X\opera.exe SUCCESS Offset: 348 Length: 4 2061 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 2062 6:33:08 PM explorer.exe:924 OPEN C:\WINNT\AppPatch\LayerStorage.dat FILE NOT FOUND Options: Open Access: All 2063 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: Execute 2064 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 2065 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2066 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe SUCCESS Attributes: A 2067 6:33:08 PM explorer.exe:924 OPEN C:\Program Files\Opera7,X\opera.exe SUCCESS Options: Open Access: Execute 2068 6:33:08 PM explorer.exe:924 CLOSE C:\Program Files\Opera7,X\opera.exe SUCCESS 2069 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 2070 6:33:08 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 2071 6:33:08 PM explorer.exe:924 SET INFORMATION C:\Documents and Settings\Leonard Grossman\ntuser.dat.LOG SUCCESS Length: 4096 2072 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X SUCCESS Options: Open Directory Access: Traverse 2073 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\winmm.dll FILE NOT FOUND Attributes: Error 2074 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\winmm.dll FILE NOT FOUND Attributes: Error 2075 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\winmm.dll SUCCESS Attributes: A 2076 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\winmm.dll SUCCESS Options: Open Access: Execute 2077 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\winmm.dll SUCCESS 2078 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\wsock32.dll FILE NOT FOUND Attributes: Error 2079 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\wsock32.dll FILE NOT FOUND Attributes: Error 2080 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\wsock32.dll SUCCESS Attributes: A 2081 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\wsock32.dll SUCCESS Options: Open Access: Execute 2082 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\wsock32.dll SUCCESS 2083 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\WS2_32.DLL FILE NOT FOUND Attributes: Error 2084 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\WS2_32.DLL FILE NOT FOUND Attributes: Error 2085 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\WS2_32.DLL SUCCESS Attributes: A 2086 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\WS2_32.DLL SUCCESS Options: Open Access: Execute 2087 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\WS2_32.DLL SUCCESS 2088 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\WS2HELP.DLL FILE NOT FOUND Attributes: Error 2089 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\WS2HELP.DLL FILE NOT FOUND Attributes: Error 2090 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\WS2HELP.DLL SUCCESS Attributes: A 2091 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\WS2HELP.DLL SUCCESS Options: Open Access: Execute 2092 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\WS2HELP.DLL SUCCESS 2093 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\imm32.dll FILE NOT FOUND Attributes: Error 2094 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\imm32.dll FILE NOT FOUND Attributes: Error 2095 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\imm32.dll SUCCESS Attributes: A 2096 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\imm32.dll SUCCESS Options: Open Access: Execute 2097 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\imm32.dll SUCCESS 2098 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\zip.dll SUCCESS Attributes: A 2099 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\zip.dll SUCCESS Options: Open Access: Execute 2100 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\zip.dll SUCCESS 2101 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\opjpeg32.dll SUCCESS Attributes: A 2102 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\opjpeg32.dll SUCCESS Options: Open Access: Execute 2103 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\opjpeg32.dll SUCCESS 2104 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\oppng32.dll SUCCESS Attributes: A 2105 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\oppng32.dll SUCCESS Options: Open Access: Execute 2106 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\oppng32.dll SUCCESS 2107 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Attributes: A 2108 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\xmlparse.dll SUCCESS Options: Open Access: Execute 2109 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\xmlparse.dll SUCCESS 2110 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\opera.exe.Local FILE NOT FOUND Attributes: Error 2111 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\IMM32.DLL SUCCESS Attributes: A 2112 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\IMM32.DLL SUCCESS Attributes: A 2113 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\LPK.DLL FILE NOT FOUND Attributes: Error 2114 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\LPK.DLL FILE NOT FOUND Attributes: Error 2115 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\LPK.DLL SUCCESS Attributes: A 2116 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\LPK.DLL SUCCESS Options: Open Access: Execute 2117 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\LPK.DLL SUCCESS 2118 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\USP10.dll FILE NOT FOUND Attributes: Error 2119 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\USP10.dll FILE NOT FOUND Attributes: Error 2120 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\USP10.dll SUCCESS Attributes: A 2121 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\USP10.dll SUCCESS Options: Open Access: Execute 2122 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\USP10.dll SUCCESS 2123 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\NVDESK32.DLL FILE NOT FOUND Attributes: Error 2124 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\NVDESK32.DLL FILE NOT FOUND Attributes: Error 2125 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\NVDESK32.DLL SUCCESS Attributes: A 2126 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\NVDESK32.DLL SUCCESS Options: Open Access: Execute 2127 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\NVDESK32.DLL SUCCESS 2128 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\serwvdrv.dll FILE NOT FOUND Attributes: Error 2129 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\serwvdrv.dll FILE NOT FOUND Attributes: Error 2130 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\serwvdrv.dll SUCCESS Attributes: A 2131 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\serwvdrv.dll SUCCESS Options: Open Access: Execute 2132 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\serwvdrv.dll SUCCESS 2133 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\umdmxfrm.dll FILE NOT FOUND Attributes: Error 2134 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\umdmxfrm.dll FILE NOT FOUND Attributes: Error 2135 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\umdmxfrm.dll SUCCESS Attributes: A 2136 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\umdmxfrm.dll SUCCESS Options: Open Access: Execute 2137 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\umdmxfrm.dll SUCCESS 2138 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\mmdrv.dll FILE NOT FOUND Attributes: Error 2139 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\mmdrv.dll FILE NOT FOUND Attributes: Error 2140 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\mmdrv.dll SUCCESS Attributes: A 2141 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\mmdrv.dll SUCCESS Options: Open Access: Execute 2142 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\mmdrv.dll SUCCESS 2143 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2144 6:33:08 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2145 6:33:08 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2146 6:33:08 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2147 6:33:08 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr00375.gif SUCCESS Options: Open Access: All 2148 6:33:08 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\cache4\opr00375.gif SUCCESS FileStreamInformation 2149 6:33:08 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr00375.gif:Raec25ph4sudbf0hAaq5ehw3Nf:$DATA FILE NOT FOUND Options: Open Access: All 2150 6:33:08 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\cache4\opr00375.gif SUCCESS 2151 6:33:08 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr00375.gif SUCCESS Options: Open Access: All 2152 6:33:08 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\cache4\opr00375.gif SUCCESS FileStreamInformation 2153 6:33:08 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr00375.gif:Raec25ph4sudbf0hAaq5ehw3Nf:$DATA FILE NOT FOUND Options: Open Access: All 2154 6:33:08 PM cidaemon.exe:960 OPEN C:\Program Files\Opera7,X\Cache4\opr00375.gif\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA SUCCESS Options: Open Access: All 2155 6:33:08 PM cidaemon.exe:960 READ C:\Program Files\Opera7,X\Cache4\opr00375.gif\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA END OF FILE Offset: 0 Length: 24 2156 6:33:08 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\cache4\opr00375.gif SUCCESS FileStreamInformation 2157 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\Msimg32.dll FILE NOT FOUND Attributes: Error 2158 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\Msimg32.dll FILE NOT FOUND Attributes: Error 2159 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\Msimg32.dll SUCCESS Attributes: A 2160 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\Msimg32.dll SUCCESS Options: Open Access: Execute 2161 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\Msimg32.dll SUCCESS 2162 6:33:08 PM opera.exe:928 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 2163 6:33:08 PM opera.exe:928 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 2164 6:33:08 PM opera.exe:928 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 2165 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Attributes: A 2166 6:33:08 PM opera.exe:928 OPEN C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Options: Open Access: Execute 2167 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Length: 40960 2168 6:33:08 PM opera.exe:928 CLOSE C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS 2169 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Attributes: A 2170 6:33:08 PM opera.exe:928 OPEN C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS Options: Open Access: Execute 2171 6:33:08 PM opera.exe:928 CLOSE C:\PROGRA~1\Grisoft\AVG6\avgoerun.dll SUCCESS 2172 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\My Documents SUCCESS Attributes: D 2173 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 2174 6:33:08 PM opera.exe:928 OPEN C:\ SUCCESS Options: Open Directory Access: All 2175 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\ SUCCESS FileNameInformation 2176 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\ SUCCESS FileFsVolumeInformation 2177 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\ SUCCESS FileFsAttributeInformation 2178 6:33:08 PM opera.exe:928 CLOSE C:\ SUCCESS 2179 6:33:08 PM opera.exe:928 OPEN C:\ SUCCESS Options: Open Directory Access: All 2180 6:33:08 PM opera.exe:928 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 2181 6:33:08 PM opera.exe:928 CLOSE C:\ SUCCESS 2182 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 2183 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 2184 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 2185 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 2186 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 2187 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 2188 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\~CLBCATQ.DLL FILE NOT FOUND Attributes: Error 2189 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\CLBCATQ.DLL FILE NOT FOUND Attributes: Error 2190 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\CLBCATQ.DLL FILE NOT FOUND Attributes: Error 2191 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\CLBCATQ.DLL SUCCESS Attributes: A 2192 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\CLBCATQ.DLL SUCCESS Options: Open Access: Execute 2193 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\CLBCATQ.DLL SUCCESS 2194 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\cscui.dll FILE NOT FOUND Attributes: Error 2195 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\cscui.dll FILE NOT FOUND Attributes: Error 2196 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\cscui.dll SUCCESS Attributes: A 2197 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\cscui.dll SUCCESS Options: Open Access: Execute 2198 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\cscui.dll SUCCESS 2199 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\CSCDLL.DLL FILE NOT FOUND Attributes: Error 2200 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\CSCDLL.DLL FILE NOT FOUND Attributes: Error 2201 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\CSCDLL.DLL SUCCESS Attributes: A 2202 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\CSCDLL.DLL SUCCESS Options: Open Access: Execute 2203 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\CSCDLL.DLL SUCCESS 2204 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 2205 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 2206 6:33:08 PM opera.exe:928 OPEN C:\WINNT\System32\shell32.dll SUCCESS Options: Open Access: All 2207 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 2208 6:33:08 PM opera.exe:928 SET INFORMATION C:\WINNT\System32\shell32.dll SUCCESS FileBasicInformation 2209 6:33:08 PM opera.exe:928 READ C:\WINNT\System32\shell32.dll SUCCESS Offset: 0 Length: 12 2210 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 2211 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 2212 6:33:08 PM opera.exe:928 CLOSE C:\WINNT\System32\shell32.dll SUCCESS 2213 6:33:08 PM opera.exe:928 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 2214 6:33:08 PM opera.exe:928 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 2215 6:33:08 PM opera.exe:928 CLOSE C:\Documents and Settings\ SUCCESS 2216 6:33:08 PM opera.exe:928 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 2217 6:33:08 PM opera.exe:928 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: My Documents 2218 6:33:08 PM opera.exe:928 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 2219 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Application Data SUCCESS Attributes: DH 2220 6:33:08 PM opera.exe:928 OPEN C:\ SUCCESS Options: Open Directory Access: All 2221 6:33:08 PM opera.exe:928 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 2222 6:33:08 PM opera.exe:928 CLOSE C:\ SUCCESS 2223 6:33:08 PM opera.exe:928 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 2224 6:33:08 PM opera.exe:928 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 2225 6:33:08 PM opera.exe:928 CLOSE C:\Documents and Settings\ SUCCESS 2226 6:33:08 PM opera.exe:928 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 2227 6:33:08 PM opera.exe:928 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: Application Data 2228 6:33:08 PM opera.exe:928 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 2229 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Options: Open Access: All 2230 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Offset: 0 Length: 4096 2231 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS Offset: 0 Length: 4096 2232 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\OperaDef6.ini END OF FILE Offset: 3131 Length: 1024 2233 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\OperaDef6.ini END OF FILE Offset: 3131 Length: 4096 2234 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\OperaDef6.ini SUCCESS 2235 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Documents and Settings\All Users\Start Menu\Programs SUCCESS Attributes: D 2236 6:33:08 PM opera.exe:928 OPEN C:\ SUCCESS Options: Open Directory Access: All 2237 6:33:08 PM opera.exe:928 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 2238 6:33:08 PM opera.exe:928 CLOSE C:\ SUCCESS 2239 6:33:08 PM opera.exe:928 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 2240 6:33:08 PM opera.exe:928 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: All Users 2241 6:33:08 PM opera.exe:928 CLOSE C:\Documents and Settings\ SUCCESS 2242 6:33:08 PM opera.exe:928 OPEN C:\Documents and Settings\All Users\ SUCCESS Options: Open Directory Access: All 2243 6:33:08 PM opera.exe:928 DIRECTORY C:\Documents and Settings\All Users\ SUCCESS FileBothDirectoryInformation: Start Menu 2244 6:33:08 PM opera.exe:928 CLOSE C:\Documents and Settings\All Users\ SUCCESS 2245 6:33:08 PM opera.exe:928 OPEN C:\Documents and Settings\All Users\Start Menu\ SUCCESS Options: Open Directory Access: All 2246 6:33:08 PM opera.exe:928 DIRECTORY C:\Documents and Settings\All Users\Start Menu\ SUCCESS FileBothDirectoryInformation: Programs 2247 6:33:08 PM opera.exe:928 CLOSE C:\Documents and Settings\All Users\Start Menu\ SUCCESS 2248 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Application Data\Opera\Opera7,X FILE NOT FOUND Attributes: Error 2249 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Options: Open Sequential Access: All 2250 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS FileObjectIdInformation 2251 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Length: 2910 2252 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Attributes: A 2253 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS FileStreamInformation 2254 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS Attributes: A 2255 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS FileEaInformation 2256 6:33:08 PM opera.exe:928 CREATE C:\Documents and Settings\Leonard Grossman\Application Data\Opera\Opera7,X\profile\sessions\Opera Software.win PATH NOT FOUND Options: Create Sequential Access: All 2257 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\defaults\Opera Software.win SUCCESS 2258 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 2259 6:33:08 PM opera.exe:928 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 2260 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 2261 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 2262 6:33:08 PM opera.exe:928 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 2263 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 2264 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 2265 6:33:08 PM opera.exe:928 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 2266 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 2267 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 2268 6:33:08 PM opera.exe:928 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 2269 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 2270 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 2271 6:33:08 PM opera.exe:928 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 2272 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 2273 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 2274 6:33:08 PM opera.exe:928 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 2275 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 2276 6:33:08 PM opera.exe:928 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 2277 6:33:08 PM opera.exe:928 LOCK C:\Program Files\Opera7,X\opera6.ini SUCCESS Excl: No Offset: 0 Length: -1 2278 6:33:08 PM opera.exe:928 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Length: 5857 2279 6:33:08 PM opera.exe:928 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 5857 2280 6:33:08 PM opera.exe:928 UNLOCK C:\Program Files\Opera7,X\opera6.ini RANGE NOT LOCKED Offset: 0 Length: -1 2281 6:33:08 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 2282 6:33:08 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 12800 Length: 4096 2283 6:33:08 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 2284 6:33:08 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2285 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2286 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 14336 Length: 512 2287 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.001 SUCCESS Offset: 0 Length: 4096 2288 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 14336 Length: 512 2289 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 12800 Length: 4096 2290 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2291 6:33:09 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 2292 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 16896 Length: 4096 2293 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2294 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2295 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 2296 6:33:09 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 2297 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19968 Length: 512 2298 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 19968 Length: 512 2299 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 16896 Length: 4096 2300 6:33:09 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Options: OpenIf Sequential Access: All 2301 6:33:09 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS FileStandardInformation 2302 6:33:09 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Length: 65536 2303 6:33:09 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 2304 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.002 SUCCESS Offset: 0 Length: 4096 2305 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2306 6:33:09 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2307 6:33:09 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2308 6:33:09 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2309 6:33:09 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2310 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 20992 Length: 4096 2311 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2312 6:33:09 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 2313 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2314 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 21504 Length: 512 2315 6:33:09 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 2316 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 2317 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 21504 Length: 512 2318 6:33:09 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 2319 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 20992 Length: 4096 2320 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2321 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 25088 Length: 4096 2322 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2323 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2324 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 26624 Length: 512 2325 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 26624 Length: 512 2326 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 25088 Length: 4096 2327 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2328 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 23552 Length: 512 2329 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 23552 Length: 512 2330 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 29184 Length: 4096 2331 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2332 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 7680 Length: 512 2333 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 7680 Length: 512 2334 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 33280 Length: 4096 2335 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2336 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 29184 Length: 4096 2337 6:33:09 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2338 6:33:09 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2339 6:33:09 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2340 6:33:09 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2341 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2342 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2343 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 31744 Length: 512 2344 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 31744 Length: 512 2345 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 37376 Length: 4096 2346 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2347 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33280 Length: 4096 2348 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2349 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2350 6:33:09 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 34816 Length: 512 2351 6:33:09 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 34816 Length: 512 2352 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 41472 Length: 4096 2353 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2354 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6049792 Length: 4096 2355 6:33:10 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2356 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 37376 Length: 4096 2357 6:33:10 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2358 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2359 6:33:10 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 40960 Length: 512 2360 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 40960 Length: 512 2361 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10162176 Length: 12288 2362 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10219520 Length: 4096 2363 6:33:10 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2364 6:33:10 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2365 6:33:10 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2366 6:33:10 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2367 6:33:10 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2368 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 4096 2369 6:33:10 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2370 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2371 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 4096 2372 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2373 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2564096 Length: 4096 2374 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2572288 Length: 4096 2375 6:33:10 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2376 6:33:10 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2377 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2580480 Length: 16384 2378 6:33:10 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2379 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 2380 6:33:10 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2381 6:33:10 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41984 Length: 512 2382 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41984 Length: 512 2383 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 2384 6:33:10 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2385 6:33:10 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 40960 Length: 512 2386 6:33:10 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2387 6:33:10 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2388 6:33:10 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2389 6:33:10 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2390 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 40960 Length: 512 2391 6:33:10 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 48128 Length: 512 2392 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 48128 Length: 512 2393 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 49664 Length: 4096 2394 6:33:10 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2395 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2396 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 45568 Length: 4096 2397 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2398 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 53760 Length: 4096 2399 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2400 6:33:10 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 49664 Length: 4096 2401 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2402 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 2403 6:33:11 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2404 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 57856 Length: 4096 2405 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2406 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\cicat.fid SUCCESS Offset: 53248 Length: 32768 2407 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 60416 Length: 512 2408 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 60416 Length: 512 2409 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 55296 Length: 512 2410 6:33:11 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2411 6:33:11 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2412 6:33:11 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2413 6:33:11 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2414 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 55296 Length: 512 2415 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 61952 Length: 4096 2416 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2417 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2418 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 53760 Length: 4096 2419 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2420 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65024 Length: 512 2421 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 65024 Length: 512 2422 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 55296 Length: 512 2423 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 55296 Length: 512 2424 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 66048 Length: 4096 2425 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2426 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2427 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 68096 Length: 512 2428 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 68096 Length: 512 2429 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1445888 Length: 4096 2430 6:33:11 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2431 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 70144 Length: 4096 2432 6:33:11 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2433 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2434 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 57856 Length: 4096 2435 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2436 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 74240 Length: 4096 2437 6:33:11 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2438 6:33:11 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2439 6:33:11 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2440 6:33:11 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2441 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2442 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 4096 2443 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2444 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 82432 Length: 4096 2445 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2446 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 86528 Length: 4096 2447 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2448 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2539520 Length: 4096 2449 6:33:11 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2547712 Length: 8192 2450 6:33:11 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2451 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 90624 Length: 4096 2452 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2453 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 61952 Length: 4096 2454 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2455 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 8192 Length: 4096 2456 6:33:12 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2457 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 94720 Length: 4096 2458 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2459 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10092544 Length: 4096 2460 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 2461 6:33:12 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2462 6:33:12 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2463 6:33:12 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2464 6:33:12 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2465 6:33:12 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2466 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 98816 Length: 4096 2467 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2468 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10027008 Length: 4096 2469 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10035200 Length: 4096 2470 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10047488 Length: 4096 2471 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10055680 Length: 12288 2472 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10080256 Length: 8192 2473 6:33:12 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2474 6:33:12 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2475 6:33:12 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2476 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 4096 2477 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2478 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 66048 Length: 4096 2479 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2480 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9998336 Length: 4096 2481 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10006528 Length: 8192 2482 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 2483 6:33:12 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2484 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 70144 Length: 4096 2485 6:33:12 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2486 6:33:12 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2487 6:33:12 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2488 6:33:12 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2489 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2490 6:33:12 PM cidaemon.exe:960 OPEN C:\Program Files\Opera7,X\Cache4\opr00375.gif\:DocumentSummaryInformation:$DATA FILE NOT FOUND Options: Open Access: All 2491 6:33:12 PM cidaemon.exe:960 OPEN C:\Program Files\Opera7,X\Cache4\opr00375.gif\:Docf_DocumentSummaryInformation:$DATA FILE NOT FOUND Options: Open Access: All 2492 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107008 Length: 4096 2493 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2494 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 111104 Length: 4096 2495 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2496 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 74240 Length: 4096 2497 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2498 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 115200 Length: 4096 2499 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2500 6:33:12 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 78336 Length: 4096 2501 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2502 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 119296 Length: 4096 2503 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2504 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 2505 6:33:13 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2506 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 82432 Length: 4096 2507 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2508 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10092544 Length: 12288 2509 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10121216 Length: 4096 2510 6:33:13 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2511 6:33:13 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2512 6:33:13 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2513 6:33:13 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2514 6:33:13 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2515 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 4096 2516 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2517 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 86528 Length: 4096 2518 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2519 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 127488 Length: 4096 2520 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2521 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 131584 Length: 4096 2522 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2523 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10227712 Length: 4096 2524 6:33:13 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2525 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10170368 Length: 4096 2526 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 135680 Length: 4096 2527 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2528 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1196032 Length: 4096 2529 6:33:13 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2530 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10010624 Length: 8192 2531 6:33:13 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2532 6:33:13 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2533 6:33:13 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2534 6:33:13 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2535 6:33:13 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2536 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 139776 Length: 4096 2537 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2538 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 143872 Length: 4096 2539 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2540 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 147968 Length: 4096 2541 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2542 6:33:13 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 2543 6:33:13 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2544 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 152064 Length: 4096 2545 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2546 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 90624 Length: 4096 2547 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2548 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 156160 Length: 4096 2549 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2550 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 160256 Length: 4096 2551 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2552 6:33:14 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2553 6:33:14 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2554 6:33:14 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2555 6:33:14 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2556 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 164352 Length: 4096 2557 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2558 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10096640 Length: 4096 2559 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 4096 2560 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10141696 Length: 4096 2561 6:33:14 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2562 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 168448 Length: 4096 2563 6:33:14 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2564 6:33:14 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2565 6:33:14 PM Eudora.exe:1420 OPEN C:\Program Files\Qualcomm\Eudora\Eudora.ini SUCCESS Options: Open Access: All 2566 6:33:14 PM Eudora.exe:1420 LOCK C:\Program Files\Qualcomm\Eudora\Eudora.ini SUCCESS Excl: No Offset: 0 Length: -1 2567 6:33:14 PM Eudora.exe:1420 QUERY INFORMATION C:\Program Files\Qualcomm\Eudora\Eudora.ini SUCCESS Length: 16152 2568 6:33:14 PM Eudora.exe:1420 READ C:\Program Files\Qualcomm\Eudora\Eudora.ini SUCCESS Offset: 0 Length: 16152 2569 6:33:14 PM Eudora.exe:1420 UNLOCK C:\Program Files\Qualcomm\Eudora\Eudora.ini RANGE NOT LOCKED Offset: 0 Length: -1 2570 6:33:14 PM Eudora.exe:1420 CLOSE C:\Program Files\Qualcomm\Eudora\Eudora.ini SUCCESS 2571 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2572 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10027008 Length: 8192 2573 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10039296 Length: 12288 2574 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 8192 2575 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10084352 Length: 4096 2576 6:33:14 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2577 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10002432 Length: 4096 2578 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10014720 Length: 4096 2579 6:33:14 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2580 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 172544 Length: 4096 2581 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2582 6:33:14 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2583 6:33:14 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2584 6:33:14 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2585 6:33:14 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2586 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 176640 Length: 4096 2587 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2588 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 180736 Length: 4096 2589 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2590 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 94720 Length: 4096 2591 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2592 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10158080 Length: 36864 2593 6:33:14 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 8192 2594 6:33:14 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2595 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 2596 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2597 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 184832 Length: 4096 2598 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2599 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 2600 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2601 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 4096 2602 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2603 6:33:15 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2604 6:33:15 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2605 6:33:15 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2606 6:33:15 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2607 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 188928 Length: 4096 2608 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2609 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 155648 Length: 4096 2610 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2611 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5189632 Length: 4096 2612 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2613 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 193024 Length: 4096 2614 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2615 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 98816 Length: 4096 2616 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 2617 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1445888 Length: 12288 2618 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2619 6:33:15 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 651264 Length: 32768 2620 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 2621 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 2622 6:33:15 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2623 6:33:15 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2624 6:33:15 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2625 6:33:15 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2626 6:33:15 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 3411968 Length: 32768 2627 6:33:15 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 194048 Length: 512 2628 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 194048 Length: 512 2629 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2539520 Length: 16384 2630 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2631 6:33:15 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 194048 Length: 512 2632 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 194048 Length: 512 2633 6:33:15 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 2634 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 197120 Length: 4096 2635 6:33:15 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2636 6:33:15 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 2637 6:33:16 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2638 6:33:16 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2639 6:33:16 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2640 6:33:16 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2641 6:33:16 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2642 6:33:16 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2643 6:33:16 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2644 6:33:16 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2645 6:33:16 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2646 6:33:16 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2647 6:33:17 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2648 6:33:17 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2649 6:33:17 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2650 6:33:17 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2651 6:33:17 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2652 6:33:17 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2653 6:33:17 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2654 6:33:17 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2655 6:33:18 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2656 6:33:18 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2657 6:33:18 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2658 6:33:18 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2659 6:33:18 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2660 6:33:18 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 2661 6:33:18 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2662 6:33:18 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2663 6:33:18 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2664 6:33:18 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2665 6:33:19 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2666 6:33:19 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2667 6:33:19 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2668 6:33:19 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2669 6:33:19 PM cidaemon.exe:960 CLOSE C:\Program Files\Opera7,X\Cache4\opr00375.gif\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA SUCCESS 2670 6:33:19 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\cache4\opr00375.gif SUCCESS 2671 6:33:19 PM cidaemon.exe:960 CLOSE C:\Program Files\Opera7,X\Cache4\opr00375.gif SUCCESS 2672 6:33:19 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 2673 6:33:19 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 2674 6:33:19 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 2675 6:33:19 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 2676 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00375.gif SUCCESS FileObjectIdInformation 2677 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00375.gif SUCCESS 2678 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00375.gif SUCCESS 2679 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030B.gif SUCCESS Options: Open Access: All 2680 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030B.gif SUCCESS FileObjectIdInformation 2681 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030B.gif SUCCESS 2682 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030B.gif SUCCESS 2683 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZQ.location+"__flashplugin_unique__" NAME INVALID Options: Open Access: All 2684 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032E.js SUCCESS Options: Open Access: All 2685 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032E.js SUCCESS FileObjectIdInformation 2686 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032E.js SUCCESS 2687 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032E.js SUCCESS 2688 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030C.gif SUCCESS Options: Open Access: All 2689 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030C.gif SUCCESS FileObjectIdInformation 2690 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030C.gif SUCCESS 2691 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030C.gif SUCCESS 2692 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035K.gif SUCCESS Options: Open Access: All 2693 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035K.gif SUCCESS FileObjectIdInformation 2694 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035K.gif SUCCESS 2695 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035K.gif SUCCESS 2696 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00389.gif SUCCESS Options: Open Access: All 2697 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00389.gif SUCCESS FileObjectIdInformation 2698 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00389.gif SUCCESS 2699 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00389.gif SUCCESS 2700 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038A.gif SUCCESS Options: Open Access: All 2701 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038A.gif SUCCESS FileObjectIdInformation 2702 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038A.gif SUCCESS 2703 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038A.gif SUCCESS 2704 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038B.gif SUCCESS Options: Open Access: All 2705 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038B.gif SUCCESS FileObjectIdInformation 2706 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038B.gif SUCCESS 2707 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038B.gif SUCCESS 2708 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038C.gif SUCCESS Options: Open Access: All 2709 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038C.gif SUCCESS FileObjectIdInformation 2710 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038C.gif SUCCESS 2711 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038C.gif SUCCESS 2712 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038D.gif SUCCESS Options: Open Access: All 2713 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038D.gif SUCCESS FileObjectIdInformation 2714 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038D.gif SUCCESS 2715 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038D.gif SUCCESS 2716 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00346.jpeg SUCCESS Options: Open Access: All 2717 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00346.jpeg SUCCESS FileObjectIdInformation 2718 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00346.jpeg SUCCESS 2719 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00346.jpeg SUCCESS 2720 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032F.gif SUCCESS Options: Open Access: All 2721 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032F.gif SUCCESS FileObjectIdInformation 2722 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032F.gif SUCCESS 2723 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032F.gif SUCCESS 2724 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032G.gif SUCCESS Options: Open Access: All 2725 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032G.gif SUCCESS FileObjectIdInformation 2726 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032G.gif SUCCESS 2727 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032G.gif SUCCESS 2728 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14241792 Length: 4096 2729 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033D.gif SUCCESS Options: Open Access: All 2730 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033D.gif SUCCESS FileObjectIdInformation 2731 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033D.gif SUCCESS 2732 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033D.gif SUCCESS 2733 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030D.gif SUCCESS Options: Open Access: All 2734 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030D.gif SUCCESS FileObjectIdInformation 2735 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030D.gif SUCCESS 2736 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030D.gif SUCCESS 2737 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038E.gif SUCCESS Options: Open Access: All 2738 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038E.gif SUCCESS FileObjectIdInformation 2739 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038E.gif SUCCESS 2740 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038E.gif SUCCESS 2741 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002Z5.jpeg SUCCESS Options: Open Access: All 2742 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002Z5.jpeg SUCCESS FileObjectIdInformation 2743 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002Z5.jpeg SUCCESS 2744 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002Z5.jpeg SUCCESS 2745 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039H.gif SUCCESS Options: Open Access: All 2746 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039H.gif SUCCESS FileObjectIdInformation 2747 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039H.gif SUCCESS 2748 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039H.gif SUCCESS 2749 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038F.gif SUCCESS Options: Open Access: All 2750 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038F.gif SUCCESS FileObjectIdInformation 2751 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038F.gif SUCCESS 2752 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038F.gif SUCCESS 2753 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035L.gif SUCCESS Options: Open Access: All 2754 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035L.gif SUCCESS FileObjectIdInformation 2755 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035L.gif SUCCESS 2756 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035L.gif SUCCESS 2757 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038G.gif SUCCESS Options: Open Access: All 2758 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038G.gif SUCCESS FileObjectIdInformation 2759 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038G.gif SUCCESS 2760 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038G.gif SUCCESS 2761 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038H.gif SUCCESS Options: Open Access: All 2762 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038H.gif SUCCESS FileObjectIdInformation 2763 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038H.gif SUCCESS 2764 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038H.gif SUCCESS 2765 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AH.gif SUCCESS Options: Open Access: All 2766 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AH.gif SUCCESS FileObjectIdInformation 2767 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AH.gif SUCCESS 2768 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AH.gif SUCCESS 2769 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002Z6.gif SUCCESS Options: Open Access: All 2770 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002Z6.gif SUCCESS FileObjectIdInformation 2771 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002Z6.gif SUCCESS 2772 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002Z6.gif SUCCESS 2773 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030E.gif SUCCESS Options: Open Access: All 2774 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030E.gif SUCCESS FileObjectIdInformation 2775 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030E.gif SUCCESS 2776 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030E.gif SUCCESS 2777 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038I.gif SUCCESS Options: Open Access: All 2778 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038I.gif SUCCESS FileObjectIdInformation 2779 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038I.gif SUCCESS 2780 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038I.gif SUCCESS 2781 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AI.gif SUCCESS Options: Open Access: All 2782 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AI.gif SUCCESS FileObjectIdInformation 2783 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AI.gif SUCCESS 2784 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AI.gif SUCCESS 2785 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00368.gif SUCCESS Options: Open Access: All 2786 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00368.gif SUCCESS FileObjectIdInformation 2787 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00368.gif SUCCESS 2788 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00368.gif SUCCESS 2789 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031R.htm SUCCESS Options: Open Access: All 2790 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031R.htm SUCCESS FileObjectIdInformation 2791 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031R.htm SUCCESS 2792 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031R.htm SUCCESS 2793 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037F.htm SUCCESS Options: Open Access: All 2794 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037F.htm SUCCESS FileObjectIdInformation 2795 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037F.htm SUCCESS 2796 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037F.htm SUCCESS 2797 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00399.gif SUCCESS Options: Open Access: All 2798 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00399.gif SUCCESS FileObjectIdInformation 2799 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00399.gif SUCCESS 2800 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00399.gif SUCCESS 2801 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038J.gif SUCCESS Options: Open Access: All 2802 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038J.gif SUCCESS FileObjectIdInformation 2803 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038J.gif SUCCESS 2804 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038J.gif SUCCESS 2805 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035M.gif SUCCESS Options: Open Access: All 2806 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035M.gif SUCCESS FileObjectIdInformation 2807 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035M.gif SUCCESS 2808 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035M.gif SUCCESS 2809 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030F.gif SUCCESS Options: Open Access: All 2810 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030F.gif SUCCESS FileObjectIdInformation 2811 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030F.gif SUCCESS 2812 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030F.gif SUCCESS 2813 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035H.htm SUCCESS Options: Open Access: All 2814 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035H.htm SUCCESS FileObjectIdInformation 2815 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035H.htm SUCCESS 2816 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035H.htm SUCCESS 2817 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030G.gif SUCCESS Options: Open Access: All 2818 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030G.gif SUCCESS FileObjectIdInformation 2819 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030G.gif SUCCESS 2820 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030G.gif SUCCESS 2821 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037K.gif SUCCESS Options: Open Access: All 2822 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037K.gif SUCCESS FileObjectIdInformation 2823 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037K.gif SUCCESS 2824 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037K.gif SUCCESS 2825 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AJ.jpeg SUCCESS Options: Open Access: All 2826 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AJ.jpeg SUCCESS FileObjectIdInformation 2827 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AJ.jpeg SUCCESS 2828 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AJ.jpeg SUCCESS 2829 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002Z7.gif SUCCESS Options: Open Access: All 2830 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002Z7.gif SUCCESS FileObjectIdInformation 2831 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002Z7.gif SUCCESS 2832 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002Z7.gif SUCCESS 2833 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032H.gif SUCCESS Options: Open Access: All 2834 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032H.gif SUCCESS FileObjectIdInformation 2835 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032H.gif SUCCESS 2836 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032H.gif SUCCESS 2837 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039A.gif SUCCESS Options: Open Access: All 2838 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039A.gif SUCCESS FileObjectIdInformation 2839 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039A.gif SUCCESS 2840 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039A.gif SUCCESS 2841 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030H.gif SUCCESS Options: Open Access: All 2842 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030H.gif SUCCESS FileObjectIdInformation 2843 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030H.gif SUCCESS 2844 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030H.gif SUCCESS 2845 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038K.gif SUCCESS Options: Open Access: All 2846 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038K.gif SUCCESS FileObjectIdInformation 2847 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038K.gif SUCCESS 2848 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038K.gif SUCCESS 2849 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038L.gif SUCCESS Options: Open Access: All 2850 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038L.gif SUCCESS FileObjectIdInformation 2851 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038L.gif SUCCESS 2852 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038L.gif SUCCESS 2853 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038M.gif SUCCESS Options: Open Access: All 2854 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038M.gif SUCCESS FileObjectIdInformation 2855 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038M.gif SUCCESS 2856 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038M.gif SUCCESS 2857 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZS.gif SUCCESS Options: Open Access: All 2858 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZS.gif SUCCESS FileObjectIdInformation 2859 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZS.gif SUCCESS 2860 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZS.gif SUCCESS 2861 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035C.htm SUCCESS Options: Open Access: All 2862 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035C.htm SUCCESS FileObjectIdInformation 2863 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035C.htm SUCCESS 2864 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035C.htm SUCCESS 2865 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035N.js SUCCESS Options: Open Access: All 2866 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035N.js SUCCESS FileObjectIdInformation 2867 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035N.js SUCCESS 2868 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035N.js SUCCESS 2869 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AL.gif SUCCESS Options: Open Access: All 2870 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AL.gif SUCCESS FileObjectIdInformation 2871 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AL.gif SUCCESS 2872 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AL.gif SUCCESS 2873 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037L.gif SUCCESS Options: Open Access: All 2874 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037L.gif SUCCESS FileObjectIdInformation 2875 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037L.gif SUCCESS 2876 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037L.gif SUCCESS 2877 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030I.gif SUCCESS Options: Open Access: All 2878 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030I.gif SUCCESS FileObjectIdInformation 2879 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030I.gif SUCCESS 2880 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030I.gif SUCCESS 2881 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033E.jpeg SUCCESS Options: Open Access: All 2882 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033E.jpeg SUCCESS FileObjectIdInformation 2883 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033E.jpeg SUCCESS 2884 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033E.jpeg SUCCESS 2885 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033F.jpeg SUCCESS Options: Open Access: All 2886 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033F.jpeg SUCCESS FileObjectIdInformation 2887 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033F.jpeg SUCCESS 2888 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033F.jpeg SUCCESS 2889 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038N.gif SUCCESS Options: Open Access: All 2890 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038N.gif SUCCESS FileObjectIdInformation 2891 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038N.gif SUCCESS 2892 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038N.gif SUCCESS 2893 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AM.gif SUCCESS Options: Open Access: All 2894 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AM.gif SUCCESS FileObjectIdInformation 2895 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AM.gif SUCCESS 2896 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AM.gif SUCCESS 2897 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030J.gif SUCCESS Options: Open Access: All 2898 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030J.gif SUCCESS FileObjectIdInformation 2899 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030J.gif SUCCESS 2900 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030J.gif SUCCESS 2901 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030K.gif SUCCESS Options: Open Access: All 2902 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030K.gif SUCCESS FileObjectIdInformation 2903 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030K.gif SUCCESS 2904 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030K.gif SUCCESS 2905 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031S.gif SUCCESS Options: Open Access: All 2906 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031S.gif SUCCESS FileObjectIdInformation 2907 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031S.gif SUCCESS 2908 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031S.gif SUCCESS 2909 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033G.jpeg SUCCESS Options: Open Access: All 2910 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033G.jpeg SUCCESS FileObjectIdInformation 2911 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033G.jpeg SUCCESS 2912 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033G.jpeg SUCCESS 2913 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14245888 Length: 4096 2914 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AN.htm SUCCESS Options: Open Access: All 2915 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AN.htm SUCCESS FileObjectIdInformation 2916 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AN.htm SUCCESS 2917 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AN.htm SUCCESS 2918 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031T.gif SUCCESS Options: Open Access: All 2919 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031T.gif SUCCESS FileObjectIdInformation 2920 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031T.gif SUCCESS 2921 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031T.gif SUCCESS 2922 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002Z8.jpeg SUCCESS Options: Open Access: All 2923 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002Z8.jpeg SUCCESS FileObjectIdInformation 2924 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002Z8.jpeg SUCCESS 2925 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002Z8.jpeg SUCCESS 2926 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002Z9.gif SUCCESS Options: Open Access: All 2927 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002Z9.gif SUCCESS FileObjectIdInformation 2928 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002Z9.gif SUCCESS 2929 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002Z9.gif SUCCESS 2930 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AO.htm SUCCESS Options: Open Access: All 2931 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AO.htm SUCCESS FileObjectIdInformation 2932 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AO.htm SUCCESS 2933 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AO.htm SUCCESS 2934 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030L.gif SUCCESS Options: Open Access: All 2935 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030L.gif SUCCESS FileObjectIdInformation 2936 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030L.gif SUCCESS 2937 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030L.gif SUCCESS 2938 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032I.gif SUCCESS Options: Open Access: All 2939 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032I.gif SUCCESS FileObjectIdInformation 2940 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032I.gif SUCCESS 2941 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032I.gif SUCCESS 2942 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00348.jpeg SUCCESS Options: Open Access: All 2943 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00348.jpeg SUCCESS FileObjectIdInformation 2944 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00348.jpeg SUCCESS 2945 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00348.jpeg SUCCESS 2946 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032J.js SUCCESS Options: Open Access: All 2947 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032J.js SUCCESS FileObjectIdInformation 2948 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032J.js SUCCESS 2949 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032J.js SUCCESS 2950 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032K.js SUCCESS Options: Open Access: All 2951 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032K.js SUCCESS FileObjectIdInformation 2952 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032K.js SUCCESS 2953 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032K.js SUCCESS 2954 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039T.htm SUCCESS Options: Open Access: All 2955 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039T.htm SUCCESS FileObjectIdInformation 2956 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039T.htm SUCCESS 2957 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039T.htm SUCCESS 2958 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039W.gif SUCCESS Options: Open Access: All 2959 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039W.gif SUCCESS FileObjectIdInformation 2960 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039W.gif SUCCESS 2961 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039W.gif SUCCESS 2962 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038O.gif SUCCESS Options: Open Access: All 2963 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038O.gif SUCCESS FileObjectIdInformation 2964 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038O.gif SUCCESS 2965 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038O.gif SUCCESS 2966 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00369.gif SUCCESS Options: Open Access: All 2967 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00369.gif SUCCESS FileObjectIdInformation 2968 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00369.gif SUCCESS 2969 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00369.gif SUCCESS 2970 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZA.gif SUCCESS Options: Open Access: All 2971 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZA.gif SUCCESS FileObjectIdInformation 2972 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZA.gif SUCCESS 2973 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZA.gif SUCCESS 2974 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZT.htm SUCCESS Options: Open Access: All 2975 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZT.htm SUCCESS FileObjectIdInformation 2976 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZT.htm SUCCESS 2977 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZT.htm SUCCESS 2978 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AP.gif SUCCESS Options: Open Access: All 2979 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AP.gif SUCCESS FileObjectIdInformation 2980 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AP.gif SUCCESS 2981 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AP.gif SUCCESS 2982 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZR.location+"__flashplugin_unique__" NAME INVALID Options: Open Access: All 2983 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032L.gif SUCCESS Options: Open Access: All 2984 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032L.gif SUCCESS FileObjectIdInformation 2985 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032L.gif SUCCESS 2986 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032L.gif SUCCESS 2987 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035O.gif SUCCESS Options: Open Access: All 2988 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035O.gif SUCCESS FileObjectIdInformation 2989 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035O.gif SUCCESS 2990 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035O.gif SUCCESS 2991 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032M.gif SUCCESS Options: Open Access: All 2992 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032M.gif SUCCESS FileObjectIdInformation 2993 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032M.gif SUCCESS 2994 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032M.gif SUCCESS 2995 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AQ.gif SUCCESS Options: Open Access: All 2996 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AQ.gif SUCCESS FileObjectIdInformation 2997 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AQ.gif SUCCESS 2998 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AQ.gif SUCCESS 2999 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036A.gif SUCCESS Options: Open Access: All 3000 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036A.gif SUCCESS FileObjectIdInformation 3001 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036A.gif SUCCESS 3002 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036A.gif SUCCESS 3003 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030M.gif SUCCESS Options: Open Access: All 3004 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030M.gif SUCCESS FileObjectIdInformation 3005 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030M.gif SUCCESS 3006 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030M.gif SUCCESS 3007 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031U.gif SUCCESS Options: Open Access: All 3008 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031U.gif SUCCESS FileObjectIdInformation 3009 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031U.gif SUCCESS 3010 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031U.gif SUCCESS 3011 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039I.gif SUCCESS Options: Open Access: All 3012 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039I.gif SUCCESS FileObjectIdInformation 3013 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039I.gif SUCCESS 3014 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039I.gif SUCCESS 3015 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AR.gif SUCCESS Options: Open Access: All 3016 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AR.gif SUCCESS FileObjectIdInformation 3017 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AR.gif SUCCESS 3018 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AR.gif SUCCESS 3019 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030N.gif SUCCESS Options: Open Access: All 3020 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030N.gif SUCCESS FileObjectIdInformation 3021 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030N.gif SUCCESS 3022 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030N.gif SUCCESS 3023 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038P.gif SUCCESS Options: Open Access: All 3024 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038P.gif SUCCESS FileObjectIdInformation 3025 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038P.gif SUCCESS 3026 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038P.gif SUCCESS 3027 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZO.location+"__flashplugin_unique__" NAME INVALID Options: Open Access: All 3028 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030O.gif SUCCESS Options: Open Access: All 3029 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030O.gif SUCCESS FileObjectIdInformation 3030 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030O.gif SUCCESS 3031 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030O.gif SUCCESS 3032 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032N.gif SUCCESS Options: Open Access: All 3033 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032N.gif SUCCESS FileObjectIdInformation 3034 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032N.gif SUCCESS 3035 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032N.gif SUCCESS 3036 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00322.htm SUCCESS Options: Open Access: All 3037 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00322.htm SUCCESS FileObjectIdInformation 3038 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00322.htm SUCCESS 3039 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00322.htm SUCCESS 3040 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032O.jpeg SUCCESS Options: Open Access: All 3041 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032O.jpeg SUCCESS FileObjectIdInformation 3042 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032O.jpeg SUCCESS 3043 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032O.jpeg SUCCESS 3044 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AS.gif SUCCESS Options: Open Access: All 3045 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AS.gif SUCCESS FileObjectIdInformation 3046 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AS.gif SUCCESS 3047 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AS.gif SUCCESS 3048 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036B.gif SUCCESS Options: Open Access: All 3049 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036B.gif SUCCESS FileObjectIdInformation 3050 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036B.gif SUCCESS 3051 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036B.gif SUCCESS 3052 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037M.gif SUCCESS Options: Open Access: All 3053 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037M.gif SUCCESS FileObjectIdInformation 3054 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037M.gif SUCCESS 3055 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037M.gif SUCCESS 3056 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036C.gif SUCCESS Options: Open Access: All 3057 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036C.gif SUCCESS FileObjectIdInformation 3058 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036C.gif SUCCESS 3059 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036C.gif SUCCESS 3060 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036D.gif SUCCESS Options: Open Access: All 3061 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036D.gif SUCCESS FileObjectIdInformation 3062 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036D.gif SUCCESS 3063 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036D.gif SUCCESS 3064 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AT.htm SUCCESS Options: Open Access: All 3065 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AT.htm SUCCESS FileObjectIdInformation 3066 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AT.htm SUCCESS 3067 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AT.htm SUCCESS 3068 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036E.gif SUCCESS Options: Open Access: All 3069 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036E.gif SUCCESS FileObjectIdInformation 3070 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036E.gif SUCCESS 3071 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036E.gif SUCCESS 3072 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039B.gif SUCCESS Options: Open Access: All 3073 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039B.gif SUCCESS FileObjectIdInformation 3074 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039B.gif SUCCESS 3075 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039B.gif SUCCESS 3076 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038Q.gif SUCCESS Options: Open Access: All 3077 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038Q.gif SUCCESS FileObjectIdInformation 3078 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038Q.gif SUCCESS 3079 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038Q.gif SUCCESS 3080 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032P.gif SUCCESS Options: Open Access: All 3081 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032P.gif SUCCESS FileObjectIdInformation 3082 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032P.gif SUCCESS 3083 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032P.gif SUCCESS 3084 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035P.js SUCCESS Options: Open Access: All 3085 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035P.js SUCCESS FileObjectIdInformation 3086 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035P.js SUCCESS 3087 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035P.js SUCCESS 3088 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036F.gif SUCCESS Options: Open Access: All 3089 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036F.gif SUCCESS FileObjectIdInformation 3090 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036F.gif SUCCESS 3091 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036F.gif SUCCESS 3092 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030P.gif SUCCESS Options: Open Access: All 3093 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030P.gif SUCCESS FileObjectIdInformation 3094 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030P.gif SUCCESS 3095 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030P.gif SUCCESS 3096 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00398.gif SUCCESS Options: Open Access: All 3097 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00398.gif SUCCESS FileObjectIdInformation 3098 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00398.gif SUCCESS 3099 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00398.gif SUCCESS 3100 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14249984 Length: 4096 3101 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZU.gif SUCCESS Options: Open Access: All 3102 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZU.gif SUCCESS FileObjectIdInformation 3103 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZU.gif SUCCESS 3104 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZU.gif SUCCESS 3105 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AU.htm SUCCESS Options: Open Access: All 3106 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AU.htm SUCCESS FileObjectIdInformation 3107 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AU.htm SUCCESS 3108 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AU.htm SUCCESS 3109 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038R.gif SUCCESS Options: Open Access: All 3110 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038R.gif SUCCESS FileObjectIdInformation 3111 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038R.gif SUCCESS 3112 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038R.gif SUCCESS 3113 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036G.gif SUCCESS Options: Open Access: All 3114 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036G.gif SUCCESS FileObjectIdInformation 3115 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036G.gif SUCCESS 3116 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036G.gif SUCCESS 3117 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AV.gif SUCCESS Options: Open Access: All 3118 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AV.gif SUCCESS FileObjectIdInformation 3119 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AV.gif SUCCESS 3120 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AV.gif SUCCESS 3121 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AW.gif SUCCESS Options: Open Access: All 3122 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AW.gif SUCCESS FileObjectIdInformation 3123 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AW.gif SUCCESS 3124 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AW.gif SUCCESS 3125 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AX.gif SUCCESS Options: Open Access: All 3126 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AX.gif SUCCESS FileObjectIdInformation 3127 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AX.gif SUCCESS 3128 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AX.gif SUCCESS 3129 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AY.gif SUCCESS Options: Open Access: All 3130 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AY.gif SUCCESS FileObjectIdInformation 3131 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AY.gif SUCCESS 3132 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AY.gif SUCCESS 3133 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032Q.gif SUCCESS Options: Open Access: All 3134 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032Q.gif SUCCESS FileObjectIdInformation 3135 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032Q.gif SUCCESS 3136 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032Q.gif SUCCESS 3137 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032R.gif SUCCESS Options: Open Access: All 3138 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032R.gif SUCCESS FileObjectIdInformation 3139 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032R.gif SUCCESS 3140 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032R.gif SUCCESS 3141 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032S.gif SUCCESS Options: Open Access: All 3142 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032S.gif SUCCESS FileObjectIdInformation 3143 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032S.gif SUCCESS 3144 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032S.gif SUCCESS 3145 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033H.gif SUCCESS Options: Open Access: All 3146 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033H.gif SUCCESS FileObjectIdInformation 3147 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033H.gif SUCCESS 3148 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033H.gif SUCCESS 3149 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036H.gif SUCCESS Options: Open Access: All 3150 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036H.gif SUCCESS FileObjectIdInformation 3151 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036H.gif SUCCESS 3152 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036H.gif SUCCESS 3153 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033I.gif SUCCESS Options: Open Access: All 3154 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033I.gif SUCCESS FileObjectIdInformation 3155 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033I.gif SUCCESS 3156 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033I.gif SUCCESS 3157 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033J.gif SUCCESS Options: Open Access: All 3158 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033J.gif SUCCESS FileObjectIdInformation 3159 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033J.gif SUCCESS 3160 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033J.gif SUCCESS 3161 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032T.gif SUCCESS Options: Open Access: All 3162 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032T.gif SUCCESS FileObjectIdInformation 3163 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032T.gif SUCCESS 3164 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032T.gif SUCCESS 3165 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035Q.htm SUCCESS Options: Open Access: All 3166 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035Q.htm SUCCESS FileObjectIdInformation 3167 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035Q.htm SUCCESS 3168 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035Q.htm SUCCESS 3169 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035R.gif SUCCESS Options: Open Access: All 3170 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035R.gif SUCCESS FileObjectIdInformation 3171 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035R.gif SUCCESS 3172 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035R.gif SUCCESS 3173 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039X.jpeg SUCCESS Options: Open Access: All 3174 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039X.jpeg SUCCESS FileObjectIdInformation 3175 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039X.jpeg SUCCESS 3176 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039X.jpeg SUCCESS 3177 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZV.gif SUCCESS Options: Open Access: All 3178 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZV.gif SUCCESS FileObjectIdInformation 3179 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZV.gif SUCCESS 3180 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZV.gif SUCCESS 3181 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038S.gif SUCCESS Options: Open Access: All 3182 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038S.gif SUCCESS FileObjectIdInformation 3183 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038S.gif SUCCESS 3184 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038S.gif SUCCESS 3185 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00352.htm SUCCESS Options: Open Access: All 3186 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00352.htm SUCCESS FileObjectIdInformation 3187 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00352.htm SUCCESS 3188 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00352.htm SUCCESS 3189 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032U.gif SUCCESS Options: Open Access: All 3190 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032U.gif SUCCESS FileObjectIdInformation 3191 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032U.gif SUCCESS 3192 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032U.gif SUCCESS 3193 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032V.js SUCCESS Options: Open Access: All 3194 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032V.js SUCCESS FileObjectIdInformation 3195 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032V.js SUCCESS 3196 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032V.js SUCCESS 3197 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039Y.htm SUCCESS Options: Open Access: All 3198 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039Y.htm SUCCESS FileObjectIdInformation 3199 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039Y.htm SUCCESS 3200 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039Y.htm SUCCESS 3201 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00323.htm SUCCESS Options: Open Access: All 3202 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00323.htm SUCCESS FileObjectIdInformation 3203 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00323.htm SUCCESS 3204 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00323.htm SUCCESS 3205 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZB.gif SUCCESS Options: Open Access: All 3206 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZB.gif SUCCESS FileObjectIdInformation 3207 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZB.gif SUCCESS 3208 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZB.gif SUCCESS 3209 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030Q.gif SUCCESS Options: Open Access: All 3210 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030Q.gif SUCCESS FileObjectIdInformation 3211 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030Q.gif SUCCESS 3212 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030Q.gif SUCCESS 3213 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030R.gif SUCCESS Options: Open Access: All 3214 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030R.gif SUCCESS FileObjectIdInformation 3215 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030R.gif SUCCESS 3216 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030R.gif SUCCESS 3217 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037N.js SUCCESS Options: Open Access: All 3218 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037N.js SUCCESS FileObjectIdInformation 3219 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037N.js SUCCESS 3220 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037N.js SUCCESS 3221 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZC.gif SUCCESS Options: Open Access: All 3222 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZC.gif SUCCESS FileObjectIdInformation 3223 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZC.gif SUCCESS 3224 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZC.gif SUCCESS 3225 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032W.jpeg SUCCESS Options: Open Access: All 3226 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032W.jpeg SUCCESS FileObjectIdInformation 3227 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032W.jpeg SUCCESS 3228 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032W.jpeg SUCCESS 3229 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032X.js SUCCESS Options: Open Access: All 3230 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032X.js SUCCESS FileObjectIdInformation 3231 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032X.js SUCCESS 3232 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032X.js SUCCESS 3233 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035E.jpeg SUCCESS Options: Open Access: All 3234 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035E.jpeg SUCCESS FileObjectIdInformation 3235 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035E.jpeg SUCCESS 3236 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035E.jpeg SUCCESS 3237 6:33:19 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2555904 Length: 53248 3238 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037O.js SUCCESS Options: Open Access: All 3239 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037O.js SUCCESS FileObjectIdInformation 3240 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037O.js SUCCESS 3241 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037O.js SUCCESS 3242 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030S.gif SUCCESS Options: Open Access: All 3243 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030S.gif SUCCESS FileObjectIdInformation 3244 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030S.gif SUCCESS 3245 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030S.gif SUCCESS 3246 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00376.gif SUCCESS Options: Open Access: All 3247 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00376.gif SUCCESS FileObjectIdInformation 3248 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00376.gif SUCCESS 3249 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00376.gif SUCCESS 3250 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00349.jpeg SUCCESS Options: Open Access: All 3251 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00349.jpeg SUCCESS FileObjectIdInformation 3252 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00349.jpeg SUCCESS 3253 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00349.jpeg SUCCESS 3254 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036I.gif SUCCESS Options: Open Access: All 3255 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036I.gif SUCCESS FileObjectIdInformation 3256 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036I.gif SUCCESS 3257 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036I.gif SUCCESS 3258 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039Z.gif SUCCESS Options: Open Access: All 3259 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039Z.gif SUCCESS FileObjectIdInformation 3260 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039Z.gif SUCCESS 3261 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039Z.gif SUCCESS 3262 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037P.gif SUCCESS Options: Open Access: All 3263 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037P.gif SUCCESS FileObjectIdInformation 3264 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037P.gif SUCCESS 3265 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037P.gif SUCCESS 3266 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038T.jpeg SUCCESS Options: Open Access: All 3267 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038T.jpeg SUCCESS FileObjectIdInformation 3268 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038T.jpeg SUCCESS 3269 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038T.jpeg SUCCESS 3270 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00353.zip SUCCESS Options: Open Access: All 3271 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00353.zip SUCCESS FileObjectIdInformation 3272 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00353.zip SUCCESS 3273 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00353.zip SUCCESS 3274 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039V.htm SUCCESS Options: Open Access: All 3275 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039V.htm SUCCESS FileObjectIdInformation 3276 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039V.htm SUCCESS 3277 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039V.htm SUCCESS 3278 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035S.gif SUCCESS Options: Open Access: All 3279 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035S.gif SUCCESS FileObjectIdInformation 3280 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035S.gif SUCCESS 3281 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035S.gif SUCCESS 3282 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035T.gif SUCCESS Options: Open Access: All 3283 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035T.gif SUCCESS FileObjectIdInformation 3284 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035T.gif SUCCESS 3285 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035T.gif SUCCESS 3286 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14254080 Length: 4096 3287 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030T.gif SUCCESS Options: Open Access: All 3288 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030T.gif SUCCESS FileObjectIdInformation 3289 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030T.gif SUCCESS 3290 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030T.gif SUCCESS 3291 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00357.htm SUCCESS Options: Open Access: All 3292 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00357.htm SUCCESS FileObjectIdInformation 3293 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00357.htm SUCCESS 3294 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00357.htm SUCCESS 3295 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003AZ.gif SUCCESS Options: Open Access: All 3296 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003AZ.gif SUCCESS FileObjectIdInformation 3297 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003AZ.gif SUCCESS 3298 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003AZ.gif SUCCESS 3299 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031V.gif SUCCESS Options: Open Access: All 3300 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031V.gif SUCCESS FileObjectIdInformation 3301 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031V.gif SUCCESS 3302 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031V.gif SUCCESS 3303 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00358.htm SUCCESS Options: Open Access: All 3304 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00358.htm SUCCESS FileObjectIdInformation 3305 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00358.htm SUCCESS 3306 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00358.htm SUCCESS 3307 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033K.gif SUCCESS Options: Open Access: All 3308 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033K.gif SUCCESS FileObjectIdInformation 3309 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033K.gif SUCCESS 3310 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033K.gif SUCCESS 3311 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038U.gif SUCCESS Options: Open Access: All 3312 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038U.gif SUCCESS FileObjectIdInformation 3313 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038U.gif SUCCESS 3314 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038U.gif SUCCESS 3315 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZW.gif SUCCESS Options: Open Access: All 3316 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZW.gif SUCCESS FileObjectIdInformation 3317 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZW.gif SUCCESS 3318 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZW.gif SUCCESS 3319 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038V.js SUCCESS Options: Open Access: All 3320 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038V.js SUCCESS FileObjectIdInformation 3321 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038V.js SUCCESS 3322 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038V.js SUCCESS 3323 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035U.gif SUCCESS Options: Open Access: All 3324 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035U.gif SUCCESS FileObjectIdInformation 3325 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035U.gif SUCCESS 3326 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035U.gif SUCCESS 3327 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038W.gif SUCCESS Options: Open Access: All 3328 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038W.gif SUCCESS FileObjectIdInformation 3329 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038W.gif SUCCESS 3330 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038W.gif SUCCESS 3331 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032Y.gif SUCCESS Options: Open Access: All 3332 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032Y.gif SUCCESS FileObjectIdInformation 3333 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032Y.gif SUCCESS 3334 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032Y.gif SUCCESS 3335 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B0.gif SUCCESS Options: Open Access: All 3336 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B0.gif SUCCESS FileObjectIdInformation 3337 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B0.gif SUCCESS 3338 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B0.gif SUCCESS 3339 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B1.htm SUCCESS Options: Open Access: All 3340 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B1.htm SUCCESS FileObjectIdInformation 3341 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B1.htm SUCCESS 3342 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B1.htm SUCCESS 3343 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B2.gif SUCCESS Options: Open Access: All 3344 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B2.gif SUCCESS FileObjectIdInformation 3345 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B2.gif SUCCESS 3346 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B2.gif SUCCESS 3347 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034A.gif SUCCESS Options: Open Access: All 3348 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034A.gif SUCCESS FileObjectIdInformation 3349 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034A.gif SUCCESS 3350 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034A.gif SUCCESS 3351 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030U.gif SUCCESS Options: Open Access: All 3352 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030U.gif SUCCESS FileObjectIdInformation 3353 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030U.gif SUCCESS 3354 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030U.gif SUCCESS 3355 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034B.gif SUCCESS Options: Open Access: All 3356 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034B.gif SUCCESS FileObjectIdInformation 3357 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034B.gif SUCCESS 3358 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034B.gif SUCCESS 3359 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003A0.gif SUCCESS Options: Open Access: All 3360 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003A0.gif SUCCESS FileObjectIdInformation 3361 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003A0.gif SUCCESS 3362 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003A0.gif SUCCESS 3363 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034C.gif SUCCESS Options: Open Access: All 3364 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034C.gif SUCCESS FileObjectIdInformation 3365 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034C.gif SUCCESS 3366 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034C.gif SUCCESS 3367 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034D.gif SUCCESS Options: Open Access: All 3368 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034D.gif SUCCESS FileObjectIdInformation 3369 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034D.gif SUCCESS 3370 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034D.gif SUCCESS 3371 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034E.gif SUCCESS Options: Open Access: All 3372 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034E.gif SUCCESS FileObjectIdInformation 3373 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034E.gif SUCCESS 3374 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034E.gif SUCCESS 3375 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034F.gif SUCCESS Options: Open Access: All 3376 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034F.gif SUCCESS FileObjectIdInformation 3377 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034F.gif SUCCESS 3378 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034F.gif SUCCESS 3379 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034G.gif SUCCESS Options: Open Access: All 3380 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034G.gif SUCCESS FileObjectIdInformation 3381 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034G.gif SUCCESS 3382 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034G.gif SUCCESS 3383 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034H.gif SUCCESS Options: Open Access: All 3384 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034H.gif SUCCESS FileObjectIdInformation 3385 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034H.gif SUCCESS 3386 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034H.gif SUCCESS 3387 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038X.gif SUCCESS Options: Open Access: All 3388 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038X.gif SUCCESS FileObjectIdInformation 3389 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038X.gif SUCCESS 3390 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038X.gif SUCCESS 3391 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039J.gif SUCCESS Options: Open Access: All 3392 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039J.gif SUCCESS FileObjectIdInformation 3393 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039J.gif SUCCESS 3394 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039J.gif SUCCESS 3395 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003A1.gif SUCCESS Options: Open Access: All 3396 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003A1.gif SUCCESS FileObjectIdInformation 3397 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003A1.gif SUCCESS 3398 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003A1.gif SUCCESS 3399 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030V.gif SUCCESS Options: Open Access: All 3400 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030V.gif SUCCESS FileObjectIdInformation 3401 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030V.gif SUCCESS 3402 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030V.gif SUCCESS 3403 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034I.gif SUCCESS Options: Open Access: All 3404 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034I.gif SUCCESS FileObjectIdInformation 3405 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034I.gif SUCCESS 3406 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034I.gif SUCCESS 3407 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZD.jpeg SUCCESS Options: Open Access: All 3408 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZD.jpeg SUCCESS FileObjectIdInformation 3409 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZD.jpeg SUCCESS 3410 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZD.jpeg SUCCESS 3411 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0032Z.jpeg SUCCESS Options: Open Access: All 3412 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0032Z.jpeg SUCCESS FileObjectIdInformation 3413 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0032Z.jpeg SUCCESS 3414 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0032Z.jpeg SUCCESS 3415 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036J.gif SUCCESS Options: Open Access: All 3416 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036J.gif SUCCESS FileObjectIdInformation 3417 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036J.gif SUCCESS 3418 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036J.gif SUCCESS 3419 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033L.jpeg SUCCESS Options: Open Access: All 3420 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033L.jpeg SUCCESS FileObjectIdInformation 3421 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033L.jpeg SUCCESS 3422 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033L.jpeg SUCCESS 3423 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00321.htm SUCCESS Options: Open Access: All 3424 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00321.htm SUCCESS FileObjectIdInformation 3425 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00321.htm SUCCESS 3426 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00321.htm SUCCESS 3427 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00330.jpeg SUCCESS Options: Open Access: All 3428 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00330.jpeg SUCCESS FileObjectIdInformation 3429 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00330.jpeg SUCCESS 3430 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00330.jpeg SUCCESS 3431 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033M.jpeg SUCCESS Options: Open Access: All 3432 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033M.jpeg SUCCESS FileObjectIdInformation 3433 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033M.jpeg SUCCESS 3434 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033M.jpeg SUCCESS 3435 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033N.jpeg SUCCESS Options: Open Access: All 3436 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033N.jpeg SUCCESS FileObjectIdInformation 3437 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033N.jpeg SUCCESS 3438 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033N.jpeg SUCCESS 3439 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033O.jpeg SUCCESS Options: Open Access: All 3440 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033O.jpeg SUCCESS FileObjectIdInformation 3441 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033O.jpeg SUCCESS 3442 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033O.jpeg SUCCESS 3443 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00331.jpeg SUCCESS Options: Open Access: All 3444 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00331.jpeg SUCCESS FileObjectIdInformation 3445 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00331.jpeg SUCCESS 3446 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00331.jpeg SUCCESS 3447 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00332.jpeg SUCCESS Options: Open Access: All 3448 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00332.jpeg SUCCESS FileObjectIdInformation 3449 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00332.jpeg SUCCESS 3450 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00332.jpeg SUCCESS 3451 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034J.jpeg SUCCESS Options: Open Access: All 3452 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034J.jpeg SUCCESS FileObjectIdInformation 3453 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034J.jpeg SUCCESS 3454 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034J.jpeg SUCCESS 3455 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034K.jpeg SUCCESS Options: Open Access: All 3456 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034K.jpeg SUCCESS FileObjectIdInformation 3457 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034K.jpeg SUCCESS 3458 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034K.jpeg SUCCESS 3459 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036K.gif SUCCESS Options: Open Access: All 3460 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036K.gif SUCCESS FileObjectIdInformation 3461 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036K.gif SUCCESS 3462 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036K.gif SUCCESS 3463 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031W.htm SUCCESS Options: Open Access: All 3464 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031W.htm SUCCESS FileObjectIdInformation 3465 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031W.htm SUCCESS 3466 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031W.htm SUCCESS 3467 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033P.jpeg SUCCESS Options: Open Access: All 3468 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033P.jpeg SUCCESS FileObjectIdInformation 3469 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033P.jpeg SUCCESS 3470 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033P.jpeg SUCCESS 3471 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14258176 Length: 4096 3472 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00320.jpeg SUCCESS Options: Open Access: All 3473 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00320.jpeg SUCCESS FileObjectIdInformation 3474 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00320.jpeg SUCCESS 3475 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00320.jpeg SUCCESS 3476 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00333.jpeg SUCCESS Options: Open Access: All 3477 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00333.jpeg SUCCESS FileObjectIdInformation 3478 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00333.jpeg SUCCESS 3479 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00333.jpeg SUCCESS 3480 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038Y.htm SUCCESS Options: Open Access: All 3481 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038Y.htm SUCCESS FileObjectIdInformation 3482 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038Y.htm SUCCESS 3483 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038Y.htm SUCCESS 3484 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B3.gif SUCCESS Options: Open Access: All 3485 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B3.gif SUCCESS FileObjectIdInformation 3486 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B3.gif SUCCESS 3487 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B3.gif SUCCESS 3488 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036L.gif SUCCESS Options: Open Access: All 3489 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036L.gif SUCCESS FileObjectIdInformation 3490 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036L.gif SUCCESS 3491 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036L.gif SUCCESS 3492 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00377.css SUCCESS Options: Open Access: All 3493 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00377.css SUCCESS FileObjectIdInformation 3494 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00377.css SUCCESS 3495 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00377.css SUCCESS 3496 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037Q.htm SUCCESS Options: Open Access: All 3497 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037Q.htm SUCCESS FileObjectIdInformation 3498 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037Q.htm SUCCESS 3499 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037Q.htm SUCCESS 3500 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033Q.jpeg SUCCESS Options: Open Access: All 3501 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033Q.jpeg SUCCESS FileObjectIdInformation 3502 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033Q.jpeg SUCCESS 3503 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033Q.jpeg SUCCESS 3504 6:33:19 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 3505 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003A2.gif SUCCESS Options: Open Access: All 3506 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003A2.gif SUCCESS FileObjectIdInformation 3507 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003A2.gif SUCCESS 3508 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003A2.gif SUCCESS 3509 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036M.gif SUCCESS Options: Open Access: All 3510 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036M.gif SUCCESS FileObjectIdInformation 3511 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036M.gif SUCCESS 3512 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036M.gif SUCCESS 3513 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00378.gif SUCCESS Options: Open Access: All 3514 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00378.gif SUCCESS FileObjectIdInformation 3515 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00378.gif SUCCESS 3516 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00378.gif SUCCESS 3517 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZE.gif SUCCESS Options: Open Access: All 3518 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZE.gif SUCCESS FileObjectIdInformation 3519 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZE.gif SUCCESS 3520 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZE.gif SUCCESS 3521 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036N.gif SUCCESS Options: Open Access: All 3522 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036N.gif SUCCESS FileObjectIdInformation 3523 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036N.gif SUCCESS 3524 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036N.gif SUCCESS 3525 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B4.gif SUCCESS Options: Open Access: All 3526 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B4.gif SUCCESS FileObjectIdInformation 3527 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B4.gif SUCCESS 3528 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B4.gif SUCCESS 3529 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036O.gif SUCCESS Options: Open Access: All 3530 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036O.gif SUCCESS FileObjectIdInformation 3531 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036O.gif SUCCESS 3532 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036O.gif SUCCESS 3533 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00301.swf SUCCESS Options: Open Access: All 3534 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00301.swf SUCCESS FileObjectIdInformation 3535 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00301.swf SUCCESS 3536 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00301.swf SUCCESS 3537 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZF.htm SUCCESS Options: Open Access: All 3538 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZF.htm SUCCESS FileObjectIdInformation 3539 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZF.htm SUCCESS 3540 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZF.htm SUCCESS 3541 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034L.jpeg SUCCESS Options: Open Access: All 3542 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034L.jpeg SUCCESS FileObjectIdInformation 3543 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034L.jpeg SUCCESS 3544 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034L.jpeg SUCCESS 3545 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035B.htm SUCCESS Options: Open Access: All 3546 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035B.htm SUCCESS FileObjectIdInformation 3547 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035B.htm SUCCESS 3548 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035B.htm SUCCESS 3549 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036P.gif SUCCESS Options: Open Access: All 3550 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036P.gif SUCCESS FileObjectIdInformation 3551 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036P.gif SUCCESS 3552 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036P.gif SUCCESS 3553 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B5.gif SUCCESS Options: Open Access: All 3554 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B5.gif SUCCESS FileObjectIdInformation 3555 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B5.gif SUCCESS 3556 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B5.gif SUCCESS 3557 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B6.gif SUCCESS Options: Open Access: All 3558 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B6.gif SUCCESS FileObjectIdInformation 3559 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B6.gif SUCCESS 3560 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B6.gif SUCCESS 3561 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039K.gif SUCCESS Options: Open Access: All 3562 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039K.gif SUCCESS FileObjectIdInformation 3563 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039K.gif SUCCESS 3564 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039K.gif SUCCESS 3565 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036Q.gif SUCCESS Options: Open Access: All 3566 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036Q.gif SUCCESS FileObjectIdInformation 3567 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036Q.gif SUCCESS 3568 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036Q.gif SUCCESS 3569 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039L.gif SUCCESS Options: Open Access: All 3570 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039L.gif SUCCESS FileObjectIdInformation 3571 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039L.gif SUCCESS 3572 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039L.gif SUCCESS 3573 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039M.gif SUCCESS Options: Open Access: All 3574 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039M.gif SUCCESS FileObjectIdInformation 3575 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039M.gif SUCCESS 3576 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039M.gif SUCCESS 3577 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZG.jpeg SUCCESS Options: Open Access: All 3578 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZG.jpeg SUCCESS FileObjectIdInformation 3579 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZG.jpeg SUCCESS 3580 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZG.jpeg SUCCESS 3581 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030W.gif SUCCESS Options: Open Access: All 3582 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030W.gif SUCCESS FileObjectIdInformation 3583 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030W.gif SUCCESS 3584 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030W.gif SUCCESS 3585 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037E.htm SUCCESS Options: Open Access: All 3586 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037E.htm SUCCESS FileObjectIdInformation 3587 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037E.htm SUCCESS 3588 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037E.htm SUCCESS 3589 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036R.gif SUCCESS Options: Open Access: All 3590 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036R.gif SUCCESS FileObjectIdInformation 3591 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036R.gif SUCCESS 3592 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036R.gif SUCCESS 3593 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00379.htm SUCCESS Options: Open Access: All 3594 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00379.htm SUCCESS FileObjectIdInformation 3595 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00379.htm SUCCESS 3596 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00379.htm SUCCESS 3597 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B7.gif SUCCESS Options: Open Access: All 3598 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B7.gif SUCCESS FileObjectIdInformation 3599 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B7.gif SUCCESS 3600 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B7.gif SUCCESS 3601 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033R.jpeg SUCCESS Options: Open Access: All 3602 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033R.jpeg SUCCESS FileObjectIdInformation 3603 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033R.jpeg SUCCESS 3604 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033R.jpeg SUCCESS 3605 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037R.gif SUCCESS Options: Open Access: All 3606 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037R.gif SUCCESS FileObjectIdInformation 3607 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037R.gif SUCCESS 3608 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037R.gif SUCCESS 3609 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B8.gif SUCCESS Options: Open Access: All 3610 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B8.gif SUCCESS FileObjectIdInformation 3611 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B8.gif SUCCESS 3612 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B8.gif SUCCESS 3613 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037S.js SUCCESS Options: Open Access: All 3614 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037S.js SUCCESS FileObjectIdInformation 3615 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037S.js SUCCESS 3616 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037S.js SUCCESS 3617 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036S.gif SUCCESS Options: Open Access: All 3618 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036S.gif SUCCESS FileObjectIdInformation 3619 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036S.gif SUCCESS 3620 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036S.gif SUCCESS 3621 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030X.gif SUCCESS Options: Open Access: All 3622 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030X.gif SUCCESS FileObjectIdInformation 3623 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030X.gif SUCCESS 3624 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030X.gif SUCCESS 3625 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00334.gif SUCCESS Options: Open Access: All 3626 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00334.gif SUCCESS FileObjectIdInformation 3627 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00334.gif SUCCESS 3628 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00334.gif SUCCESS 3629 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00335.gif SUCCESS Options: Open Access: All 3630 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00335.gif SUCCESS FileObjectIdInformation 3631 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00335.gif SUCCESS 3632 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00335.gif SUCCESS 3633 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033S.gif SUCCESS Options: Open Access: All 3634 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033S.gif SUCCESS FileObjectIdInformation 3635 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033S.gif SUCCESS 3636 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033S.gif SUCCESS 3637 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033T.gif SUCCESS Options: Open Access: All 3638 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033T.gif SUCCESS FileObjectIdInformation 3639 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033T.gif SUCCESS 3640 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033T.gif SUCCESS 3641 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036T.gif SUCCESS Options: Open Access: All 3642 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036T.gif SUCCESS FileObjectIdInformation 3643 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036T.gif SUCCESS 3644 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036T.gif SUCCESS 3645 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003B9.gif SUCCESS Options: Open Access: All 3646 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003B9.gif SUCCESS FileObjectIdInformation 3647 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003B9.gif SUCCESS 3648 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003B9.gif SUCCESS 3649 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030Y.gif SUCCESS Options: Open Access: All 3650 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030Y.gif SUCCESS FileObjectIdInformation 3651 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030Y.gif SUCCESS 3652 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030Y.gif SUCCESS 3653 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0030Z.gif SUCCESS Options: Open Access: All 3654 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0030Z.gif SUCCESS FileObjectIdInformation 3655 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0030Z.gif SUCCESS 3656 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0030Z.gif SUCCESS 3657 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14262272 Length: 4096 3658 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031X.gif SUCCESS Options: Open Access: All 3659 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031X.gif SUCCESS FileObjectIdInformation 3660 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031X.gif SUCCESS 3661 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031X.gif SUCCESS 3662 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036U.gif SUCCESS Options: Open Access: All 3663 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036U.gif SUCCESS FileObjectIdInformation 3664 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036U.gif SUCCESS 3665 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036U.gif SUCCESS 3666 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00359.htm SUCCESS Options: Open Access: All 3667 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00359.htm SUCCESS FileObjectIdInformation 3668 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00359.htm SUCCESS 3669 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00359.htm SUCCESS 3670 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039D.gif SUCCESS Options: Open Access: All 3671 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039D.gif SUCCESS FileObjectIdInformation 3672 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039D.gif SUCCESS 3673 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039D.gif SUCCESS 3674 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZH.gif SUCCESS Options: Open Access: All 3675 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZH.gif SUCCESS FileObjectIdInformation 3676 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZH.gif SUCCESS 3677 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZH.gif SUCCESS 3678 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00310.gif SUCCESS Options: Open Access: All 3679 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00310.gif SUCCESS FileObjectIdInformation 3680 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00310.gif SUCCESS 3681 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00310.gif SUCCESS 3682 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00311.gif SUCCESS Options: Open Access: All 3683 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00311.gif SUCCESS FileObjectIdInformation 3684 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00311.gif SUCCESS 3685 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00311.gif SUCCESS 3686 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0038Z.gif SUCCESS Options: Open Access: All 3687 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0038Z.gif SUCCESS FileObjectIdInformation 3688 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0038Z.gif SUCCESS 3689 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0038Z.gif SUCCESS 3690 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034M.js SUCCESS Options: Open Access: All 3691 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034M.js SUCCESS FileObjectIdInformation 3692 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034M.js SUCCESS 3693 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034M.js SUCCESS 3694 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00336.gif SUCCESS Options: Open Access: All 3695 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00336.gif SUCCESS FileObjectIdInformation 3696 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00336.gif SUCCESS 3697 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00336.gif SUCCESS 3698 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00390.jpeg SUCCESS Options: Open Access: All 3699 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00390.jpeg SUCCESS FileObjectIdInformation 3700 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00390.jpeg SUCCESS 3701 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00390.jpeg SUCCESS 3702 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BA.gif SUCCESS Options: Open Access: All 3703 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BA.gif SUCCESS FileObjectIdInformation 3704 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BA.gif SUCCESS 3705 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BA.gif SUCCESS 3706 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00312.gif SUCCESS Options: Open Access: All 3707 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00312.gif SUCCESS FileObjectIdInformation 3708 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00312.gif SUCCESS 3709 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00312.gif SUCCESS 3710 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00391.gif SUCCESS Options: Open Access: All 3711 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00391.gif SUCCESS FileObjectIdInformation 3712 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00391.gif SUCCESS 3713 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00391.gif SUCCESS 3714 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00313.gif SUCCESS Options: Open Access: All 3715 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00313.gif SUCCESS FileObjectIdInformation 3716 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00313.gif SUCCESS 3717 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00313.gif SUCCESS 3718 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00314.gif SUCCESS Options: Open Access: All 3719 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00314.gif SUCCESS FileObjectIdInformation 3720 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00314.gif SUCCESS 3721 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00314.gif SUCCESS 3722 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034N.jpeg SUCCESS Options: Open Access: All 3723 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034N.jpeg SUCCESS FileObjectIdInformation 3724 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034N.jpeg SUCCESS 3725 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034N.jpeg SUCCESS 3726 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036V.gif SUCCESS Options: Open Access: All 3727 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036V.gif SUCCESS FileObjectIdInformation 3728 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036V.gif SUCCESS 3729 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036V.gif SUCCESS 3730 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003A3.gif SUCCESS Options: Open Access: All 3731 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003A3.gif SUCCESS FileObjectIdInformation 3732 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003A3.gif SUCCESS 3733 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003A3.gif SUCCESS 3734 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BB.gif SUCCESS Options: Open Access: All 3735 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BB.gif SUCCESS FileObjectIdInformation 3736 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BB.gif SUCCESS 3737 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BB.gif SUCCESS 3738 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036W.gif SUCCESS Options: Open Access: All 3739 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036W.gif SUCCESS FileObjectIdInformation 3740 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036W.gif SUCCESS 3741 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036W.gif SUCCESS 3742 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZI.jpeg SUCCESS Options: Open Access: All 3743 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZI.jpeg SUCCESS FileObjectIdInformation 3744 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZI.jpeg SUCCESS 3745 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZI.jpeg SUCCESS 3746 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00392.gif SUCCESS Options: Open Access: All 3747 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00392.gif SUCCESS FileObjectIdInformation 3748 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00392.gif SUCCESS 3749 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00392.gif SUCCESS 3750 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00337.gif SUCCESS Options: Open Access: All 3751 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00337.gif SUCCESS FileObjectIdInformation 3752 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00337.gif SUCCESS 3753 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00337.gif SUCCESS 3754 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034O.jpeg SUCCESS Options: Open Access: All 3755 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034O.jpeg SUCCESS FileObjectIdInformation 3756 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034O.jpeg SUCCESS 3757 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034O.jpeg SUCCESS 3758 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039N.gif SUCCESS Options: Open Access: All 3759 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039N.gif SUCCESS FileObjectIdInformation 3760 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039N.gif SUCCESS 3761 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039N.gif SUCCESS 3762 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZJ.gif SUCCESS Options: Open Access: All 3763 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZJ.gif SUCCESS FileObjectIdInformation 3764 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZJ.gif SUCCESS 3765 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZJ.gif SUCCESS 3766 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZK.gif SUCCESS Options: Open Access: All 3767 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZK.gif SUCCESS FileObjectIdInformation 3768 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZK.gif SUCCESS 3769 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZK.gif SUCCESS 3770 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033U.jpeg SUCCESS Options: Open Access: All 3771 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033U.jpeg SUCCESS FileObjectIdInformation 3772 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033U.jpeg SUCCESS 3773 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033U.jpeg SUCCESS 3774 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037T.gif SUCCESS Options: Open Access: All 3775 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037T.gif SUCCESS FileObjectIdInformation 3776 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037T.gif SUCCESS 3777 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037T.gif SUCCESS 3778 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZL.jpeg SUCCESS Options: Open Access: All 3779 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZL.jpeg SUCCESS FileObjectIdInformation 3780 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZL.jpeg SUCCESS 3781 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZL.jpeg SUCCESS 3782 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037U.js SUCCESS Options: Open Access: All 3783 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037U.js SUCCESS FileObjectIdInformation 3784 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037U.js SUCCESS 3785 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037U.js SUCCESS 3786 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00315.gif SUCCESS Options: Open Access: All 3787 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00315.gif SUCCESS FileObjectIdInformation 3788 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00315.gif SUCCESS 3789 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00315.gif SUCCESS 3790 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00316.gif SUCCESS Options: Open Access: All 3791 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00316.gif SUCCESS FileObjectIdInformation 3792 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00316.gif SUCCESS 3793 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00316.gif SUCCESS 3794 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00317.gif SUCCESS Options: Open Access: All 3795 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00317.gif SUCCESS FileObjectIdInformation 3796 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00317.gif SUCCESS 3797 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00317.gif SUCCESS 3798 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00318.gif SUCCESS Options: Open Access: All 3799 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00318.gif SUCCESS FileObjectIdInformation 3800 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00318.gif SUCCESS 3801 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00318.gif SUCCESS 3802 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035F.htm SUCCESS Options: Open Access: All 3803 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035F.htm SUCCESS FileObjectIdInformation 3804 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035F.htm SUCCESS 3805 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035F.htm SUCCESS 3806 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00319.jpeg SUCCESS Options: Open Access: All 3807 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00319.jpeg SUCCESS FileObjectIdInformation 3808 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00319.jpeg SUCCESS 3809 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00319.jpeg SUCCESS 3810 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036X.gif SUCCESS Options: Open Access: All 3811 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036X.gif SUCCESS FileObjectIdInformation 3812 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036X.gif SUCCESS 3813 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036X.gif SUCCESS 3814 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BC.gif SUCCESS Options: Open Access: All 3815 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BC.gif SUCCESS FileObjectIdInformation 3816 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BC.gif SUCCESS 3817 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BC.gif SUCCESS 3818 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00338.gif SUCCESS Options: Open Access: All 3819 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00338.gif SUCCESS FileObjectIdInformation 3820 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00338.gif SUCCESS 3821 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00338.gif SUCCESS 3822 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00339.gif SUCCESS Options: Open Access: All 3823 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00339.gif SUCCESS FileObjectIdInformation 3824 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00339.gif SUCCESS 3825 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00339.gif SUCCESS 3826 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039O.htm SUCCESS Options: Open Access: All 3827 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039O.htm SUCCESS FileObjectIdInformation 3828 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039O.htm SUCCESS 3829 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039O.htm SUCCESS 3830 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BD.gif SUCCESS Options: Open Access: All 3831 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BD.gif SUCCESS FileObjectIdInformation 3832 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BD.gif SUCCESS 3833 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BD.gif SUCCESS 3834 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031A.gif SUCCESS Options: Open Access: All 3835 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031A.gif SUCCESS FileObjectIdInformation 3836 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031A.gif SUCCESS 3837 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031A.gif SUCCESS 3838 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031B.gif SUCCESS Options: Open Access: All 3839 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031B.gif SUCCESS FileObjectIdInformation 3840 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031B.gif SUCCESS 3841 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031B.gif SUCCESS 3842 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14266368 Length: 4096 3843 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036Y.gif SUCCESS Options: Open Access: All 3844 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036Y.gif SUCCESS FileObjectIdInformation 3845 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036Y.gif SUCCESS 3846 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036Y.gif SUCCESS 3847 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003A4.gif SUCCESS Options: Open Access: All 3848 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003A4.gif SUCCESS FileObjectIdInformation 3849 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003A4.gif SUCCESS 3850 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003A4.gif SUCCESS 3851 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031C.gif SUCCESS Options: Open Access: All 3852 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031C.gif SUCCESS FileObjectIdInformation 3853 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031C.gif SUCCESS 3854 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031C.gif SUCCESS 3855 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BE.gif SUCCESS Options: Open Access: All 3856 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BE.gif SUCCESS FileObjectIdInformation 3857 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BE.gif SUCCESS 3858 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BE.gif SUCCESS 3859 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035V.gif SUCCESS Options: Open Access: All 3860 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035V.gif SUCCESS FileObjectIdInformation 3861 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035V.gif SUCCESS 3862 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035V.gif SUCCESS 3863 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033V.jpeg SUCCESS Options: Open Access: All 3864 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033V.jpeg SUCCESS FileObjectIdInformation 3865 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033V.jpeg SUCCESS 3866 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033V.jpeg SUCCESS 3867 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039U.gif SUCCESS Options: Open Access: All 3868 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039U.gif SUCCESS FileObjectIdInformation 3869 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039U.gif SUCCESS 3870 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039U.gif SUCCESS 3871 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034P.gif SUCCESS Options: Open Access: All 3872 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034P.gif SUCCESS FileObjectIdInformation 3873 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034P.gif SUCCESS 3874 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034P.gif SUCCESS 3875 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BF.gif SUCCESS Options: Open Access: All 3876 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BF.gif SUCCESS FileObjectIdInformation 3877 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BF.gif SUCCESS 3878 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BF.gif SUCCESS 3879 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BG.gif SUCCESS Options: Open Access: All 3880 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BG.gif SUCCESS FileObjectIdInformation 3881 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BG.gif SUCCESS 3882 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BG.gif SUCCESS 3883 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034Q.gif SUCCESS Options: Open Access: All 3884 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034Q.gif SUCCESS FileObjectIdInformation 3885 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034Q.gif SUCCESS 3886 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034Q.gif SUCCESS 3887 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035W.gif SUCCESS Options: Open Access: All 3888 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035W.gif SUCCESS FileObjectIdInformation 3889 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035W.gif SUCCESS 3890 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035W.gif SUCCESS 3891 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031Y.gif SUCCESS Options: Open Access: All 3892 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031Y.gif SUCCESS FileObjectIdInformation 3893 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031Y.gif SUCCESS 3894 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031Y.gif SUCCESS 3895 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034R.gif SUCCESS Options: Open Access: All 3896 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034R.gif SUCCESS FileObjectIdInformation 3897 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034R.gif SUCCESS 3898 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034R.gif SUCCESS 3899 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034S.gif SUCCESS Options: Open Access: All 3900 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034S.gif SUCCESS FileObjectIdInformation 3901 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034S.gif SUCCESS 3902 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034S.gif SUCCESS 3903 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0036Z.gif SUCCESS Options: Open Access: All 3904 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0036Z.gif SUCCESS FileObjectIdInformation 3905 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0036Z.gif SUCCESS 3906 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0036Z.gif SUCCESS 3907 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034T.gif SUCCESS Options: Open Access: All 3908 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034T.gif SUCCESS FileObjectIdInformation 3909 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034T.gif SUCCESS 3910 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034T.gif SUCCESS 3911 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034U.gif SUCCESS Options: Open Access: All 3912 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034U.gif SUCCESS FileObjectIdInformation 3913 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034U.gif SUCCESS 3914 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034U.gif SUCCESS 3915 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BH.gif SUCCESS Options: Open Access: All 3916 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BH.gif SUCCESS FileObjectIdInformation 3917 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BH.gif SUCCESS 3918 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BH.gif SUCCESS 3919 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034V.gif SUCCESS Options: Open Access: All 3920 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034V.gif SUCCESS FileObjectIdInformation 3921 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034V.gif SUCCESS 3922 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034V.gif SUCCESS 3923 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037A.js SUCCESS Options: Open Access: All 3924 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037A.js SUCCESS FileObjectIdInformation 3925 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037A.js SUCCESS 3926 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037A.js SUCCESS 3927 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034W.gif SUCCESS Options: Open Access: All 3928 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034W.gif SUCCESS FileObjectIdInformation 3929 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034W.gif SUCCESS 3930 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034W.gif SUCCESS 3931 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037V.js SUCCESS Options: Open Access: All 3932 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037V.js SUCCESS FileObjectIdInformation 3933 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037V.js SUCCESS 3934 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037V.js SUCCESS 3935 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034X.gif SUCCESS Options: Open Access: All 3936 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034X.gif SUCCESS FileObjectIdInformation 3937 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034X.gif SUCCESS 3938 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034X.gif SUCCESS 3939 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037W.gif SUCCESS Options: Open Access: All 3940 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037W.gif SUCCESS FileObjectIdInformation 3941 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037W.gif SUCCESS 3942 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037W.gif SUCCESS 3943 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034Y.gif SUCCESS Options: Open Access: All 3944 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034Y.gif SUCCESS FileObjectIdInformation 3945 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034Y.gif SUCCESS 3946 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034Y.gif SUCCESS 3947 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00393.gif SUCCESS Options: Open Access: All 3948 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00393.gif SUCCESS FileObjectIdInformation 3949 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00393.gif SUCCESS 3950 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00393.gif SUCCESS 3951 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039E.jpeg SUCCESS Options: Open Access: All 3952 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039E.jpeg SUCCESS FileObjectIdInformation 3953 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039E.jpeg SUCCESS 3954 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039E.jpeg SUCCESS 3955 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0034Z.jpeg SUCCESS Options: Open Access: All 3956 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0034Z.jpeg SUCCESS FileObjectIdInformation 3957 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0034Z.jpeg SUCCESS 3958 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0034Z.jpeg SUCCESS 3959 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031D.tmp SUCCESS Options: Open Access: All 3960 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031D.tmp SUCCESS FileObjectIdInformation 3961 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031D.tmp SUCCESS 3962 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031D.tmp SUCCESS 3963 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033A.gif SUCCESS Options: Open Access: All 3964 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033A.gif SUCCESS FileObjectIdInformation 3965 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033A.gif SUCCESS 3966 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033A.gif SUCCESS 3967 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00370.gif SUCCESS Options: Open Access: All 3968 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00370.gif SUCCESS FileObjectIdInformation 3969 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00370.gif SUCCESS 3970 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00370.gif SUCCESS 3971 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039P.gif SUCCESS Options: Open Access: All 3972 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039P.gif SUCCESS FileObjectIdInformation 3973 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039P.gif SUCCESS 3974 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039P.gif SUCCESS 3975 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031E.gif SUCCESS Options: Open Access: All 3976 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031E.gif SUCCESS FileObjectIdInformation 3977 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031E.gif SUCCESS 3978 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031E.gif SUCCESS 3979 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037X.js SUCCESS Options: Open Access: All 3980 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037X.js SUCCESS FileObjectIdInformation 3981 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037X.js SUCCESS 3982 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037X.js SUCCESS 3983 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037Y.js SUCCESS Options: Open Access: All 3984 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037Y.js SUCCESS FileObjectIdInformation 3985 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037Y.js SUCCESS 3986 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037Y.js SUCCESS 3987 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035X.gif SUCCESS Options: Open Access: All 3988 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035X.gif SUCCESS FileObjectIdInformation 3989 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035X.gif SUCCESS 3990 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035X.gif SUCCESS 3991 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037Z.htm SUCCESS Options: Open Access: All 3992 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037Z.htm SUCCESS FileObjectIdInformation 3993 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037Z.htm SUCCESS 3994 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037Z.htm SUCCESS 3995 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00394.gif SUCCESS Options: Open Access: All 3996 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00394.gif SUCCESS FileObjectIdInformation 3997 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00394.gif SUCCESS 3998 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00394.gif SUCCESS 3999 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037B.gif SUCCESS Options: Open Access: All 4000 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037B.gif SUCCESS FileObjectIdInformation 4001 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037B.gif SUCCESS 4002 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037B.gif SUCCESS 4003 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BI.gif SUCCESS Options: Open Access: All 4004 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BI.gif SUCCESS FileObjectIdInformation 4005 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BI.gif SUCCESS 4006 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BI.gif SUCCESS 4007 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031Z.gif SUCCESS Options: Open Access: All 4008 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031Z.gif SUCCESS FileObjectIdInformation 4009 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031Z.gif SUCCESS 4010 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031Z.gif SUCCESS 4011 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037C.gif SUCCESS Options: Open Access: All 4012 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037C.gif SUCCESS FileObjectIdInformation 4013 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037C.gif SUCCESS 4014 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037C.gif SUCCESS 4015 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00324.htm SUCCESS Options: Open Access: All 4016 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00324.htm SUCCESS FileObjectIdInformation 4017 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00324.htm SUCCESS 4018 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00324.htm SUCCESS 4019 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BJ.gif SUCCESS Options: Open Access: All 4020 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BJ.gif SUCCESS FileObjectIdInformation 4021 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BJ.gif SUCCESS 4022 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BJ.gif SUCCESS 4023 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZP.location+"__flashplugin_unique__" NAME INVALID Options: Open Access: All 4024 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031G.gif SUCCESS Options: Open Access: All 4025 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031G.gif SUCCESS FileObjectIdInformation 4026 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031G.gif SUCCESS 4027 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031G.gif SUCCESS 4028 6:33:19 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14270464 Length: 4096 4029 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00395.gif SUCCESS Options: Open Access: All 4030 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00395.gif SUCCESS FileObjectIdInformation 4031 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00395.gif SUCCESS 4032 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00395.gif SUCCESS 4033 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00371.gif SUCCESS Options: Open Access: All 4034 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00371.gif SUCCESS FileObjectIdInformation 4035 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00371.gif SUCCESS 4036 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00371.gif SUCCESS 4037 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003A5.htm SUCCESS Options: Open Access: All 4038 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003A5.htm SUCCESS FileObjectIdInformation 4039 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003A5.htm SUCCESS 4040 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003A5.htm SUCCESS 4041 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00372.gif SUCCESS Options: Open Access: All 4042 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00372.gif SUCCESS FileObjectIdInformation 4043 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00372.gif SUCCESS 4044 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00372.gif SUCCESS 4045 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031H.gif SUCCESS Options: Open Access: All 4046 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031H.gif SUCCESS FileObjectIdInformation 4047 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031H.gif SUCCESS 4048 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031H.gif SUCCESS 4049 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00350.jpeg SUCCESS Options: Open Access: All 4050 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00350.jpeg SUCCESS FileObjectIdInformation 4051 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00350.jpeg SUCCESS 4052 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00350.jpeg SUCCESS 4053 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00396.htm SUCCESS Options: Open Access: All 4054 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00396.htm SUCCESS FileObjectIdInformation 4055 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00396.htm SUCCESS 4056 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00396.htm SUCCESS 4057 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031I.gif SUCCESS Options: Open Access: All 4058 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031I.gif SUCCESS FileObjectIdInformation 4059 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031I.gif SUCCESS 4060 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031I.gif SUCCESS 4061 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZZ.swf SUCCESS Options: Open Access: All 4062 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZZ.swf SUCCESS FileObjectIdInformation 4063 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZZ.swf SUCCESS 4064 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZZ.swf SUCCESS 4065 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035Y.gif SUCCESS Options: Open Access: All 4066 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035Y.gif SUCCESS FileObjectIdInformation 4067 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035Y.gif SUCCESS 4068 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035Y.gif SUCCESS 4069 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039Q.gif SUCCESS Options: Open Access: All 4070 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039Q.gif SUCCESS FileObjectIdInformation 4071 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039Q.gif SUCCESS 4072 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039Q.gif SUCCESS 4073 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BK.gif SUCCESS Options: Open Access: All 4074 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BK.gif SUCCESS FileObjectIdInformation 4075 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BK.gif SUCCESS 4076 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BK.gif SUCCESS 4077 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZM.gif SUCCESS Options: Open Access: All 4078 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZM.gif SUCCESS FileObjectIdInformation 4079 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZM.gif SUCCESS 4080 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZM.gif SUCCESS 4081 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031J.gif SUCCESS Options: Open Access: All 4082 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031J.gif SUCCESS FileObjectIdInformation 4083 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031J.gif SUCCESS 4084 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031J.gif SUCCESS 4085 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031K.gif SUCCESS Options: Open Access: All 4086 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031K.gif SUCCESS FileObjectIdInformation 4087 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031K.gif SUCCESS 4088 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031K.gif SUCCESS 4089 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033W.htm SUCCESS Options: Open Access: All 4090 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033W.htm SUCCESS FileObjectIdInformation 4091 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033W.htm SUCCESS 4092 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033W.htm SUCCESS 4093 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BL.gif SUCCESS Options: Open Access: All 4094 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BL.gif SUCCESS FileObjectIdInformation 4095 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BL.gif SUCCESS 4096 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BL.gif SUCCESS 4097 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031L.gif SUCCESS Options: Open Access: All 4098 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031L.gif SUCCESS FileObjectIdInformation 4099 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031L.gif SUCCESS 4100 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031L.gif SUCCESS 4101 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BM.htm SUCCESS Options: Open Access: All 4102 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BM.htm SUCCESS FileObjectIdInformation 4103 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BM.htm SUCCESS 4104 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BM.htm SUCCESS 4105 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031M.gif SUCCESS Options: Open Access: All 4106 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031M.gif SUCCESS FileObjectIdInformation 4107 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031M.gif SUCCESS 4108 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031M.gif SUCCESS 4109 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033X.gif SUCCESS Options: Open Access: All 4110 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033X.gif SUCCESS FileObjectIdInformation 4111 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033X.gif SUCCESS 4112 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033X.gif SUCCESS 4113 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033Y.gif SUCCESS Options: Open Access: All 4114 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033Y.gif SUCCESS FileObjectIdInformation 4115 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033Y.gif SUCCESS 4116 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033Y.gif SUCCESS 4117 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039R.gif SUCCESS Options: Open Access: All 4118 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039R.gif SUCCESS FileObjectIdInformation 4119 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039R.gif SUCCESS 4120 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039R.gif SUCCESS 4121 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BN.gif SUCCESS Options: Open Access: All 4122 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BN.gif SUCCESS FileObjectIdInformation 4123 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BN.gif SUCCESS 4124 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BN.gif SUCCESS 4125 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033Z.gif SUCCESS Options: Open Access: All 4126 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033Z.gif SUCCESS FileObjectIdInformation 4127 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033Z.gif SUCCESS 4128 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033Z.gif SUCCESS 4129 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003A6.jpeg SUCCESS Options: Open Access: All 4130 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003A6.jpeg SUCCESS FileObjectIdInformation 4131 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003A6.jpeg SUCCESS 4132 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003A6.jpeg SUCCESS 4133 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00302.swf SUCCESS Options: Open Access: All 4134 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00302.swf SUCCESS FileObjectIdInformation 4135 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00302.swf SUCCESS 4136 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00302.swf SUCCESS 4137 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031N.gif SUCCESS Options: Open Access: All 4138 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031N.gif SUCCESS FileObjectIdInformation 4139 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031N.gif SUCCESS 4140 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031N.gif SUCCESS 4141 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039S.jpeg SUCCESS Options: Open Access: All 4142 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039S.jpeg SUCCESS FileObjectIdInformation 4143 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039S.jpeg SUCCESS 4144 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039S.jpeg SUCCESS 4145 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BO.gif SUCCESS Options: Open Access: All 4146 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BO.gif SUCCESS FileObjectIdInformation 4147 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BO.gif SUCCESS 4148 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BO.gif SUCCESS 4149 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00340.jpeg SUCCESS Options: Open Access: All 4150 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00340.jpeg SUCCESS FileObjectIdInformation 4151 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00340.jpeg SUCCESS 4152 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00340.jpeg SUCCESS 4153 6:33:19 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0039F.gif SUCCESS Options: Open Access: All 4154 6:33:19 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0039F.gif SUCCESS FileObjectIdInformation 4155 6:33:19 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0039F.gif SUCCESS 4156 6:33:19 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0039F.gif SUCCESS 4157 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr003BP.gif SUCCESS Options: Open Access: All 4158 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr003BP.gif SUCCESS FileObjectIdInformation 4159 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr003BP.gif SUCCESS 4160 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr003BP.gif SUCCESS 4161 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00380.gif SUCCESS Options: Open Access: All 4162 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00380.gif SUCCESS FileObjectIdInformation 4163 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00380.gif SUCCESS 4164 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00380.gif SUCCESS 4165 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZX.gif SUCCESS Options: Open Access: All 4166 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZX.gif SUCCESS FileObjectIdInformation 4167 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZX.gif SUCCESS 4168 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZX.gif SUCCESS 4169 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0037D.gif SUCCESS Options: Open Access: All 4170 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0037D.gif SUCCESS FileObjectIdInformation 4171 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0037D.gif SUCCESS 4172 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0037D.gif SUCCESS 4173 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0033B.gif SUCCESS Options: Open Access: All 4174 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0033B.gif SUCCESS FileObjectIdInformation 4175 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0033B.gif SUCCESS 4176 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0033B.gif SUCCESS 4177 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZY.gif SUCCESS Options: Open Access: All 4178 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZY.gif SUCCESS FileObjectIdInformation 4179 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZY.gif SUCCESS 4180 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZY.gif SUCCESS 4181 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00397.gif SUCCESS Options: Open Access: All 4182 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00397.gif SUCCESS FileObjectIdInformation 4183 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00397.gif SUCCESS 4184 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00397.gif SUCCESS 4185 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031O.gif SUCCESS Options: Open Access: All 4186 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031O.gif SUCCESS FileObjectIdInformation 4187 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031O.gif SUCCESS 4188 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031O.gif SUCCESS 4189 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00373.gif SUCCESS Options: Open Access: All 4190 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00373.gif SUCCESS FileObjectIdInformation 4191 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00373.gif SUCCESS 4192 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00373.gif SUCCESS 4193 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr002ZN.jpeg SUCCESS Options: Open Access: All 4194 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr002ZN.jpeg SUCCESS FileObjectIdInformation 4195 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr002ZN.jpeg SUCCESS 4196 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr002ZN.jpeg SUCCESS 4197 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0031P.htm SUCCESS Options: Open Access: All 4198 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0031P.htm SUCCESS FileObjectIdInformation 4199 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0031P.htm SUCCESS 4200 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0031P.htm SUCCESS 4201 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00300.swf SUCCESS Options: Open Access: All 4202 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00300.swf SUCCESS FileObjectIdInformation 4203 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00300.swf SUCCESS 4204 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00300.swf SUCCESS 4205 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00374.gif SUCCESS Options: Open Access: All 4206 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00374.gif SUCCESS FileObjectIdInformation 4207 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00374.gif SUCCESS 4208 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00374.gif SUCCESS 4209 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr0035Z.gif SUCCESS Options: Open Access: All 4210 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr0035Z.gif SUCCESS FileObjectIdInformation 4211 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr0035Z.gif SUCCESS 4212 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr0035Z.gif SUCCESS 4213 6:33:20 PM opera.exe:1120 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14274560 Length: 4096 4214 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\opr00360.gif SUCCESS Options: Open Access: All 4215 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\opr00360.gif SUCCESS FileObjectIdInformation 4216 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\opr00360.gif SUCCESS 4217 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\opr00360.gif SUCCESS 4218 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.new SUCCESS Attributes: A 4219 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\Cache4\dcache4.new SUCCESS Offset: 0 Length: 20 4220 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\dcache4.new SUCCESS 4221 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.url SUCCESS Attributes: A 4222 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\dcache4.url SUCCESS Options: Open Access: All 4223 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.url SUCCESS FileObjectIdInformation 4224 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\dcache4.old SUCCESS Options: Open Access: All 4225 6:33:20 PM opera.exe:1120 SET INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.url SUCCESS FileRenameInformation 4226 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\dcache4.old SUCCESS 4227 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\dcache4.old SUCCESS 4228 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.new SUCCESS Attributes: A 4229 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\dcache4.new SUCCESS Options: Open Access: All 4230 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.new SUCCESS FileObjectIdInformation 4231 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\dcache4.url SUCCESS Options: Open Access: All 4232 6:33:20 PM opera.exe:1120 SET INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.new SUCCESS FileRenameInformation 4233 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\dcache4.url SUCCESS 4234 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\dcache4.url SUCCESS 4235 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\Cache4\dcache4.old SUCCESS Options: Open Access: All 4236 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\Cache4\dcache4.old SUCCESS FileObjectIdInformation 4237 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\Cache4\dcache4.old SUCCESS 4238 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\Cache4\dcache4.old SUCCESS 4239 6:33:20 PM opera.exe:1120 CREATE C:\Program Files\Opera7,X\vlink4.new SUCCESS Options: OverwriteIf Access: All 4240 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\vlink4.new SUCCESS Attributes: A 4241 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 0 Length: 4096 4242 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 4096 Length: 4096 4243 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 8192 Length: 4096 4244 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 12288 Length: 4096 4245 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 16384 Length: 4096 4246 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 20480 Length: 4096 4247 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 24576 Length: 4096 4248 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 28672 Length: 4096 4249 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 32768 Length: 4096 4250 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 36864 Length: 4096 4251 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 40960 Length: 4096 4252 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 45056 Length: 4096 4253 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 49152 Length: 4096 4254 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 53248 Length: 4096 4255 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 57344 Length: 4096 4256 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 61440 Length: 4096 4257 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 65536 Length: 4096 4258 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 69632 Length: 4096 4259 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 73728 Length: 4096 4260 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 77824 Length: 4096 4261 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 81920 Length: 4096 4262 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 86016 Length: 4096 4263 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 90112 Length: 4096 4264 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 94208 Length: 4096 4265 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 98304 Length: 4096 4266 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 102400 Length: 4096 4267 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 106496 Length: 4096 4268 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 110592 Length: 4096 4269 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 114688 Length: 4096 4270 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 118784 Length: 4096 4271 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 122880 Length: 4096 4272 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 126976 Length: 4096 4273 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 131072 Length: 4096 4274 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 135168 Length: 4096 4275 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 139264 Length: 4096 4276 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 143360 Length: 4096 4277 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 147456 Length: 4096 4278 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 151552 Length: 4096 4279 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 155648 Length: 4096 4280 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 159744 Length: 4096 4281 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 163840 Length: 4096 4282 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 167936 Length: 4096 4283 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 172032 Length: 4096 4284 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 176128 Length: 4096 4285 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 180224 Length: 4096 4286 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 184320 Length: 4096 4287 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 188416 Length: 4096 4288 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 192512 Length: 4096 4289 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 196608 Length: 4096 4290 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 200704 Length: 4096 4291 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 204800 Length: 4096 4292 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 208896 Length: 4096 4293 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 212992 Length: 4096 4294 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 217088 Length: 4096 4295 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 221184 Length: 4096 4296 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 225280 Length: 4096 4297 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 229376 Length: 4096 4298 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 233472 Length: 4096 4299 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 237568 Length: 4096 4300 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 241664 Length: 4096 4301 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 245760 Length: 4096 4302 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 249856 Length: 4096 4303 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 253952 Length: 4096 4304 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 258048 Length: 4096 4305 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 262144 Length: 4096 4306 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\vlink4.new SUCCESS Offset: 266240 Length: 3783 4307 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\vlink4.new SUCCESS 4308 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\vlink4.dat SUCCESS Attributes: A 4309 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\vlink4.dat SUCCESS Options: Open Access: All 4310 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\vlink4.dat SUCCESS FileObjectIdInformation 4311 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\vlink4.old SUCCESS Options: Open Access: All 4312 6:33:20 PM opera.exe:1120 SET INFORMATION C:\Program Files\Opera7,X\vlink4.dat SUCCESS FileRenameInformation 4313 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\vlink4.old SUCCESS 4314 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\vlink4.old SUCCESS 4315 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\vlink4.new SUCCESS Attributes: A 4316 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\vlink4.new SUCCESS Options: Open Access: All 4317 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\vlink4.new SUCCESS FileObjectIdInformation 4318 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\vlink4.dat SUCCESS Options: Open Access: All 4319 6:33:20 PM opera.exe:1120 SET INFORMATION C:\Program Files\Opera7,X\vlink4.new SUCCESS FileRenameInformation 4320 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\vlink4.dat SUCCESS 4321 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\vlink4.dat SUCCESS 4322 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\vlink4.old SUCCESS Options: Open Access: All 4323 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\vlink4.old SUCCESS FileObjectIdInformation 4324 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\vlink4.old SUCCESS 4325 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\vlink4.old SUCCESS 4326 6:33:20 PM opera.exe:1120 CREATE C:\Program Files\Opera7,X\oprand.dat SUCCESS Options: OverwriteIf Access: All 4327 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\oprand.dat SUCCESS Attributes: A 4328 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\oprand.dat SUCCESS Options: Open Access: All 4329 6:33:20 PM opera.exe:1120 SET INFORMATION C:\Program Files\Opera7,X\oprand.dat SUCCESS FileBasicInformation 4330 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\oprand.dat SUCCESS 4331 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 201216 Length: 4096 4332 6:33:20 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 4333 6:33:20 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 4334 6:33:20 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 4335 6:33:20 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 4336 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 4337 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5128192 Length: 4096 4338 6:33:20 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 4339 6:33:20 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 4340 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4341 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4342 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\??????.dll FILE NOT FOUND Attributes: Error 4343 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system\??????.dll FILE NOT FOUND Attributes: Error 4344 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\??????.dll FILE NOT FOUND Attributes: Error 4345 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4346 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system32\??????.dll FILE NOT FOUND Attributes: Error 4347 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\??????.dll FILE NOT FOUND Attributes: Error 4348 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\Wbem\??????.dll FILE NOT FOUND Attributes: Error 4349 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Support Tools\??????.dll FILE NOT FOUND Attributes: Error 4350 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4351 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4352 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\??????.dll FILE NOT FOUND Attributes: Error 4353 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system\??????.dll FILE NOT FOUND Attributes: Error 4354 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\??????.dll FILE NOT FOUND Attributes: Error 4355 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4356 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system32\??????.dll FILE NOT FOUND Attributes: Error 4357 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\??????.dll FILE NOT FOUND Attributes: Error 4358 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\Wbem\??????.dll FILE NOT FOUND Attributes: Error 4359 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Support Tools\??????.dll FILE NOT FOUND Attributes: Error 4360 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\?????.dll FILE NOT FOUND Attributes: Error 4361 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\?????.dll FILE NOT FOUND Attributes: Error 4362 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\?????.dll FILE NOT FOUND Attributes: Error 4363 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system\?????.dll FILE NOT FOUND Attributes: Error 4364 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\?????.dll FILE NOT FOUND Attributes: Error 4365 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\?????.dll FILE NOT FOUND Attributes: Error 4366 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system32\?????.dll FILE NOT FOUND Attributes: Error 4367 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\?????.dll FILE NOT FOUND Attributes: Error 4368 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\Wbem\?????.dll FILE NOT FOUND Attributes: Error 4369 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Support Tools\?????.dll FILE NOT FOUND Attributes: Error 4370 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4371 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4372 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\??????.dll FILE NOT FOUND Attributes: Error 4373 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system\??????.dll FILE NOT FOUND Attributes: Error 4374 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\??????.dll FILE NOT FOUND Attributes: Error 4375 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\??????.dll FILE NOT FOUND Attributes: Error 4376 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\system32\??????.dll FILE NOT FOUND Attributes: Error 4377 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\??????.dll FILE NOT FOUND Attributes: Error 4378 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\WINNT\System32\Wbem\??????.dll FILE NOT FOUND Attributes: Error 4379 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Support Tools\??????.dll FILE NOT FOUND Attributes: Error 4380 6:33:20 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 4381 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\oprand.dat SUCCESS Offset: 0 Length: 1024 4382 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\oprand.dat SUCCESS 4383 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10096640 Length: 4096 4384 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 8192 4385 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10121216 Length: 4096 4386 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 8192 4387 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 4388 6:33:20 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 4389 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 4390 6:33:20 PM opera.exe:1120 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 0 Length: 4096 4391 6:33:20 PM opera.exe:1120 READ C:\Program Files\Opera7,X\opera6.ini SUCCESS Offset: 4096 Length: 4096 4392 6:33:20 PM opera.exe:1120 READ C:\Program Files\Opera7,X\opera6.ini END OF FILE Offset: 5857 Length: 4096 4393 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 4394 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 4395 6:33:20 PM opera.exe:1120 CREATE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Options: Create Access: All 4396 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS 4397 6:33:20 PM opera.exe:1120 CREATE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Options: OverwriteIf Access: All 4398 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Offset: 0 Length: 1024 4399 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Offset: 1024 Length: 1024 4400 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Offset: 2048 Length: 1024 4401 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Offset: 3072 Length: 1024 4402 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Offset: 4096 Length: 117 4403 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Offset: 4213 Length: 1024 4404 6:33:20 PM opera.exe:1120 WRITE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Offset: 5237 Length: 620 4405 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS 4406 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X SUCCESS Attributes: D 4407 6:33:20 PM opera.exe:1120 CREATE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS Options: Create Access: All 4408 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4409 6:33:20 PM opera.exe:1120 CREATE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS Options: OverwriteIf Access: All 4410 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4411 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS Options: Open Access: All 4412 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS FileObjectIdInformation 4413 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4414 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4415 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS Attributes: A 4416 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 4417 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS FileObjectIdInformation 4418 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS Options: Open Access: All 4419 6:33:20 PM opera.exe:1120 SET INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS FileRenameInformation 4420 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4421 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4422 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Attributes: A 4423 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS Options: Open Access: All 4424 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS FileObjectIdInformation 4425 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\opera6.ini SUCCESS Options: Open Access: All 4426 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\opera6.ini SUCCESS FileNameInformation 4427 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X IS DIRECTORY Options: Open Access: All 4428 6:33:20 PM opera.exe:1120 SET INFORMATION C:\Program Files\Opera7,X\iniEDE.tmp SUCCESS FileRenameInformation 4429 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 4430 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\opera6.ini SUCCESS 4431 6:33:20 PM opera.exe:1120 OPEN C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS Options: Open Access: All 4432 6:33:20 PM opera.exe:1120 QUERY INFORMATION C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS FileObjectIdInformation 4433 6:33:20 PM opera.exe:1120 DELETE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4434 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\iniEDF.tmp SUCCESS 4435 6:33:20 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 4436 6:33:20 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 4437 6:33:20 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 4438 6:33:20 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 4439 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\skin\Standard.zip SUCCESS 4440 6:33:20 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\skin\windows.zip SUCCESS 4441 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 205312 Length: 4096 4442 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 4443 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 209408 Length: 4096 4444 6:33:20 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\opera.dir SUCCESS Options: Open Access: All 4445 6:33:20 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\opera.dir SUCCESS Options: Open Access: All 4446 6:33:20 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\opera.dir SUCCESS FileBasicInformation 4447 6:33:20 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\opera.dir SUCCESS FileAllInformation 4448 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 4449 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10002432 Length: 4096 4450 6:33:20 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 4451 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 4096 4452 6:33:20 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10084352 Length: 4096 4453 6:33:20 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 4454 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1175552 Length: 4096 4455 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 4456 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 213504 Length: 4096 4457 6:33:21 PM cidaemon.exe:960 QUERY SECURITY C:\program files\opera7,x\opera.dir SUCCESS 4458 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 4459 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2560000 Length: 12288 4460 6:33:21 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\opera.dir SUCCESS FileStandardInformation 4461 6:33:21 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\opera.dir SUCCESS 4462 6:33:21 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\opera.dir SUCCESS 4463 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035n.js FILE NOT FOUND Options: Open Access: All 4464 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035n.js FILE NOT FOUND Options: Open Access: All 4465 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\urlwarn.dir SUCCESS Options: Open Access: All 4466 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\urlwarn.dir SUCCESS Options: Open Access: All 4467 6:33:21 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\urlwarn.dir SUCCESS FileBasicInformation 4468 6:33:21 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\urlwarn.dir SUCCESS FileAllInformation 4469 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2576384 Length: 4096 4470 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2592768 Length: 8192 4471 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 4472 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 102912 Length: 4096 4473 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 4474 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 4475 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 4476 6:33:21 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 4477 6:33:21 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 4478 6:33:21 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 4479 6:33:21 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 4480 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 155648 Length: 4096 4481 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 4482 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6029312 Length: 4096 4483 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6037504 Length: 4096 4484 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6049792 Length: 4096 4485 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 4486 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10035200 Length: 4096 4487 6:33:21 PM cidaemon.exe:960 QUERY SECURITY C:\program files\opera7,x\urlwarn.dir SUCCESS 4488 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10055680 Length: 4096 4489 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10080256 Length: 4096 4490 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X SUCCESS 4491 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\rt.jar SUCCESS 4492 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\sunrsasign.jar SUCCESS 4493 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\jsse.jar SUCCESS 4494 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\jce.jar SUCCESS 4495 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\charsets.jar SUCCESS 4496 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\ext\dnsns.jar SUCCESS 4497 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\ext\ldapsec.jar SUCCESS 4498 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\ext\localedata.jar SUCCESS 4499 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Java\j2re1.4.1_01\lib\ext\sunjce_provider.jar SUCCESS 4500 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Opera7,X\classes\Opera.jar SUCCESS 4501 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Netscape\Communicator\Program\Plugins\cppack1.jar SUCCESS 4502 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Netscape\Communicator\Program\Plugins\plywood.jar SUCCESS 4503 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Netscape\Communicator\Program\Plugins\npdrmv2.zip SUCCESS 4504 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Netscape\Communicator\Program\Plugins\npds.zip SUCCESS 4505 6:33:21 PM opera.exe:1120 CLOSE C:\Program Files\Netscape\Communicator\Program\Plugins\rpcl3260.zip SUCCESS 4506 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\webdings.ttf SUCCESS 4507 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\wingding.ttf SUCCESS 4508 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\WINGDNG2.TTF SUCCESS 4509 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\WINGDNG3.TTF SUCCESS 4510 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\VERDREF.TTF SUCCESS 4511 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\VINERITC.TTF SUCCESS 4512 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\VIVALDII.TTF SUCCESS 4513 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\VLADIMIR.TTF SUCCESS 4514 6:33:21 PM opera.exe:1120 CLOSE C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\jar_cache3881.tmp SUCCESS 4515 6:33:21 PM opera.exe:1120 CLOSE C:\DOCUME~1\LEONAR~1\LOCALS~1\Temp\jar_cache3880.tmp SUCCESS 4516 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\verdanaz.ttf SUCCESS 4517 6:33:21 PM opera.exe:1120 CLOSE C:\WINNT\Fonts\arial.ttf SUCCESS 4518 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 4519 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 4520 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 4521 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 4522 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 4523 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.dll SUCCESS Attributes: A 4524 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 4525 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 4526 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\system32\config\software.LOG SUCCESS Length: 8192 4527 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\~CLBCATQ.DLL FILE NOT FOUND Attributes: Error 4528 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\CLBCATQ.DLL FILE NOT FOUND Attributes: Error 4529 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\CLBCATQ.DLL FILE NOT FOUND Attributes: Error 4530 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\CLBCATQ.DLL SUCCESS Attributes: A 4531 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\CLBCATQ.DLL SUCCESS Options: Open Access: Execute 4532 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\CLBCATQ.DLL SUCCESS 4533 6:33:21 PM OUTLOOK.EXE:1140 QUERY INFORMATION C:\Program Files\Common Files\System\Mapi\1033\NT\WWW_OpenURL FILE NOT FOUND Attributes: Error 4534 6:33:21 PM OUTLOOK.EXE:1140 QUERY INFORMATION C:\Program Files\Common Files\System\Mapi\1033\NT\WWW_OpenURL FILE NOT FOUND Attributes: Error 4535 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\cscui.dll FILE NOT FOUND Attributes: Error 4536 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\cscui.dll FILE NOT FOUND Attributes: Error 4537 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\cscui.dll SUCCESS Attributes: A 4538 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\cscui.dll SUCCESS Options: Open Access: Execute 4539 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\cscui.dll SUCCESS 4540 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\CSCDLL.DLL FILE NOT FOUND Attributes: Error 4541 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\CSCDLL.DLL FILE NOT FOUND Attributes: Error 4542 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\CSCDLL.DLL SUCCESS Attributes: A 4543 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\CSCDLL.DLL SUCCESS Options: Open Access: Execute 4544 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\CSCDLL.DLL SUCCESS 4545 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent SUCCESS Attributes: DRH 4546 6:33:21 PM explorer.exe:924 QUERY INFORMATION C:\WWW_OpenURL FILE NOT FOUND Attributes: Error 4547 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 4548 6:33:21 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 4549 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\ SUCCESS FileNameInformation 4550 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\ SUCCESS FileFsVolumeInformation 4551 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\ SUCCESS FileFsAttributeInformation 4552 6:33:21 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 4553 6:33:21 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 4554 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 4555 6:33:21 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 4556 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 4557 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 4558 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\shell32.dll SUCCESS Options: Open Access: All 4559 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 4560 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\System32\shell32.dll SUCCESS FileBasicInformation 4561 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\System32\shell32.dll SUCCESS Offset: 0 Length: 12 4562 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 4563 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 4564 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\shell32.dll SUCCESS 4565 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 4566 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 4567 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\ SUCCESS 4568 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 4569 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: Recent 4570 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 4571 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4572 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4573 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4574 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4575 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4576 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4577 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4578 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4579 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4580 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4581 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4582 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4583 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4584 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4585 6:33:21 PM explorer.exe:924 QUERY INFORMATION C:\WWW_OpenURL FILE NOT FOUND Attributes: Error 4586 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 4587 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\ntshrui.dll FILE NOT FOUND Attributes: Error 4588 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\ntshrui.dll FILE NOT FOUND Attributes: Error 4589 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\ntshrui.dll SUCCESS Attributes: A 4590 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\ntshrui.dll SUCCESS Options: Open Access: Execute 4591 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\ntshrui.dll SUCCESS 4592 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\ATL.DLL FILE NOT FOUND Attributes: Error 4593 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\ATL.DLL FILE NOT FOUND Attributes: Error 4594 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\ATL.DLL SUCCESS Attributes: A 4595 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\ATL.DLL SUCCESS Options: Open Access: Execute 4596 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\ATL.DLL SUCCESS 4597 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\NETAPI32.DLL FILE NOT FOUND Attributes: Error 4598 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\NETAPI32.DLL FILE NOT FOUND Attributes: Error 4599 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\NETAPI32.DLL SUCCESS Attributes: A 4600 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\NETAPI32.DLL SUCCESS Options: Open Access: Execute 4601 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\NETAPI32.DLL SUCCESS 4602 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\SECUR32.DLL FILE NOT FOUND Attributes: Error 4603 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\SECUR32.DLL FILE NOT FOUND Attributes: Error 4604 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\SECUR32.DLL SUCCESS Attributes: A 4605 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\SECUR32.DLL SUCCESS Options: Open Access: Execute 4606 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\SECUR32.DLL SUCCESS 4607 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\NETRAP.DLL FILE NOT FOUND Attributes: Error 4608 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\NETRAP.DLL FILE NOT FOUND Attributes: Error 4609 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\NETRAP.DLL SUCCESS Attributes: A 4610 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\NETRAP.DLL SUCCESS Options: Open Access: Execute 4611 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\NETRAP.DLL SUCCESS 4612 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\SAMLIB.DLL FILE NOT FOUND Attributes: Error 4613 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\SAMLIB.DLL FILE NOT FOUND Attributes: Error 4614 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\SAMLIB.DLL SUCCESS Attributes: A 4615 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\SAMLIB.DLL SUCCESS Options: Open Access: Execute 4616 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\SAMLIB.DLL SUCCESS 4617 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\WS2_32.DLL FILE NOT FOUND Attributes: Error 4618 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\WS2_32.DLL FILE NOT FOUND Attributes: Error 4619 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\WS2_32.DLL SUCCESS Attributes: A 4620 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\WS2_32.DLL SUCCESS Options: Open Access: Execute 4621 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\WS2_32.DLL SUCCESS 4622 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\WS2HELP.DLL FILE NOT FOUND Attributes: Error 4623 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\WS2HELP.DLL FILE NOT FOUND Attributes: Error 4624 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\WS2HELP.DLL SUCCESS Attributes: A 4625 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\WS2HELP.DLL SUCCESS Options: Open Access: Execute 4626 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\WS2HELP.DLL SUCCESS 4627 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\DNSAPI.DLL FILE NOT FOUND Attributes: Error 4628 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\DNSAPI.DLL FILE NOT FOUND Attributes: Error 4629 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\DNSAPI.DLL SUCCESS Attributes: A 4630 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\DNSAPI.DLL SUCCESS Options: Open Access: Execute 4631 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\DNSAPI.DLL SUCCESS 4632 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\WSOCK32.DLL FILE NOT FOUND Attributes: Error 4633 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\WSOCK32.DLL FILE NOT FOUND Attributes: Error 4634 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\WSOCK32.DLL SUCCESS Attributes: A 4635 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\WSOCK32.DLL SUCCESS Options: Open Access: Execute 4636 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\WSOCK32.DLL SUCCESS 4637 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\shell32.dll FILE NOT FOUND Attributes: Error 4638 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\shell32.dll FILE NOT FOUND Attributes: Error 4639 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\shell32.dll FILE NOT FOUND Attributes: Error 4640 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 4641 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\shell32.dll SUCCESS Options: Open Access: All 4642 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Attributes: A 4643 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\System32\shell32.dll SUCCESS FileBasicInformation 4644 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\System32\shell32.dll SUCCESS Offset: 0 Length: 12 4645 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 4646 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shell32.dll SUCCESS Length: 2374416 4647 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\shell32.dll SUCCESS 4648 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4649 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4650 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4651 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4652 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4653 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4654 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4655 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4656 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4657 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4658 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4659 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4660 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4661 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4662 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4663 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4664 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4665 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4666 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4667 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4668 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shdocvw.dll SUCCESS Attributes: A 4669 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shdocvw.dll SUCCESS Attributes: A 4670 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\shdocvw.dll SUCCESS Options: Open Access: All 4671 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shdocvw.dll SUCCESS Attributes: A 4672 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\System32\shdocvw.dll SUCCESS FileBasicInformation 4673 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\System32\shdocvw.dll SUCCESS Offset: 0 Length: 12 4674 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shdocvw.dll SUCCESS Length: 1336320 4675 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\shdocvw.dll SUCCESS Length: 1336320 4676 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\shdocvw.dll SUCCESS 4677 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4678 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4679 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4680 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4681 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4682 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4683 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4684 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4685 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4686 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4687 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4688 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4689 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4690 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4691 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4692 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4693 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4694 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4695 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4696 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4697 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS Attributes: A 4698 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS Attributes: A 4699 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\system32\SHELL32.DLL SUCCESS Options: Open Access: All 4700 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS Attributes: A 4701 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS FileBasicInformation 4702 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\SHELL32.DLL SUCCESS Offset: 0 Length: 12 4703 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS Length: 2374416 4704 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\SHELL32.DLL SUCCESS Length: 2374416 4705 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\system32\SHELL32.DLL SUCCESS 4706 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4707 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4708 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4709 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4710 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4711 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4712 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4713 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4714 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4715 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4716 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4717 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4718 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4719 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Attributes: HS 4720 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Options: Open Access: All 4721 6:33:21 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4722 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Length: 122 4723 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS Offset: 0 Length: 122 4724 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4725 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Recent\desktop.ini SUCCESS 4726 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Explorer.exe SUCCESS Attributes: A 4727 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Explorer.exe SUCCESS Attributes: A 4728 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\Explorer.exe SUCCESS Options: Open Access: All 4729 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Explorer.exe SUCCESS Attributes: A 4730 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\Explorer.exe SUCCESS FileBasicInformation 4731 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\Explorer.exe SUCCESS Offset: 0 Length: 12 4732 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Explorer.exe SUCCESS Length: 242960 4733 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Explorer.exe SUCCESS Length: 242960 4734 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\Explorer.exe SUCCESS 4735 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 4736 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 4737 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\system32\shell32.dll SUCCESS Options: Open Access: All 4738 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 4739 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\system32\shell32.dll SUCCESS FileBasicInformation 4740 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\shell32.dll SUCCESS Offset: 0 Length: 12 4741 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Length: 2374416 4742 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Length: 2374416 4743 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\system32\shell32.dll SUCCESS 4744 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\~CLBCATQ.DLL FILE NOT FOUND Attributes: Error 4745 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\browseui.dll SUCCESS Attributes: A 4746 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\browseui.dll SUCCESS Options: Open Access: Execute 4747 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\browseui.dll SUCCESS Length: 1024512 4748 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\browseui.dll SUCCESS 4749 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\browseui.dll SUCCESS Attributes: A 4750 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\System32\browseui.dll SUCCESS Options: Open Access: Execute 4751 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\browseui.dll SUCCESS 4752 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\UxTheme.dll FILE NOT FOUND Attributes: Error 4753 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\UxTheme.dll FILE NOT FOUND Attributes: Error 4754 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\UxTheme.dll FILE NOT FOUND Attributes: Error 4755 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system\UxTheme.dll FILE NOT FOUND Attributes: Error 4756 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\UxTheme.dll FILE NOT FOUND Attributes: Error 4757 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\UxTheme.dll FILE NOT FOUND Attributes: Error 4758 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\UxTheme.dll FILE NOT FOUND Attributes: Error 4759 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\Wbem\UxTheme.dll FILE NOT FOUND Attributes: Error 4760 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Program Files\Support Tools\UxTheme.dll FILE NOT FOUND Attributes: Error 4761 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\Filemon FILE NOT FOUND Attributes: Error 4762 6:33:21 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 4763 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 4764 6:33:21 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 4765 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 4766 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 4767 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\ SUCCESS 4768 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 4769 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: Desktop 4770 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 4771 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop SUCCESS Attributes: D 4772 6:33:21 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 4773 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 4774 6:33:21 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 4775 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 4776 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 4777 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\ SUCCESS 4778 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 4779 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: Desktop 4780 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 4781 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Web\default.htt SUCCESS Attributes: H 4782 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Web\folder.htt SUCCESS Attributes: H 4783 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\desktop.ini FILE NOT FOUND Attributes: Error 4784 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\ SUCCESS Options: Open Directory Access: All 4785 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\Desktop\ SUCCESS FileBothDirectoryInformation: * 4786 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\ SUCCESS Options: Open Directory Access: All 4787 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\All Users\Desktop\ SUCCESS FileBothDirectoryInformation: * 4788 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\Desktop\ SUCCESS FileBothDirectoryInformation 4789 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 4790 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 4791 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\system32\shell32.dll SUCCESS Options: Open Access: All 4792 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Attributes: A 4793 6:33:21 PM Filemon.exe:1128 SET INFORMATION C:\WINNT\system32\shell32.dll SUCCESS FileBasicInformation 4794 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\shell32.dll SUCCESS Offset: 0 Length: 12 4795 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Length: 2374416 4796 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\shell32.dll SUCCESS Length: 2374416 4797 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\system32\shell32.dll SUCCESS 4798 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\Desktop\ SUCCESS FileBothDirectoryInformation 4799 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\Desktop\ NO MORE FILES FileBothDirectoryInformation 4800 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\All Users\Desktop\ SUCCESS FileBothDirectoryInformation 4801 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\All Users\Desktop\ NO MORE FILES FileBothDirectoryInformation 4802 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Options: Open Access: All 4803 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS FileNameInformation 4804 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Options: Open Access: All 4805 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Length: 465 4806 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Attributes: A 4807 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Length: 465 4808 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Length: 465 4809 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Offset: 0 Length: 10 4810 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Offset: 0 Length: 4096 4811 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS 4812 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS Offset: 0 Length: 4096 4813 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\2001 TurboTax .lnk SUCCESS 4814 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Options: Open Access: All 4815 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS FileNameInformation 4816 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Options: Open Access: All 4817 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Length: 695 4818 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Attributes: A 4819 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Length: 695 4820 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Length: 695 4821 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Offset: 0 Length: 10 4822 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Offset: 0 Length: 4096 4823 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS 4824 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS Offset: 0 Length: 4096 4825 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Program Files SUCCESS Attributes: DRA 4826 6:33:21 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 4827 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Program Files 4828 6:33:21 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 4829 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Program Files\desktop.ini SUCCESS Attributes: H 4830 6:33:21 PM Filemon.exe:1128 OPEN C:\Program Files\desktop.ini SUCCESS Options: Open Access: All 4831 6:33:21 PM Filemon.exe:1128 LOCK C:\Program Files\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4832 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Program Files\desktop.ini SUCCESS Length: 271 4833 6:33:21 PM Filemon.exe:1128 READ C:\Program Files\desktop.ini SUCCESS Offset: 0 Length: 271 4834 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Program Files\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4835 6:33:21 PM Filemon.exe:1128 CLOSE C:\Program Files\desktop.ini SUCCESS 4836 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Program Files\desktop.ini SUCCESS Attributes: H 4837 6:33:21 PM Filemon.exe:1128 OPEN C:\Program Files\desktop.ini SUCCESS Options: Open Access: All 4838 6:33:21 PM Filemon.exe:1128 LOCK C:\Program Files\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 4839 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Program Files\desktop.ini SUCCESS Length: 271 4840 6:33:21 PM Filemon.exe:1128 READ C:\Program Files\desktop.ini SUCCESS Offset: 0 Length: 271 4841 6:33:21 PM Filemon.exe:1128 UNLOCK C:\Program Files\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 4842 6:33:21 PM Filemon.exe:1128 CLOSE C:\Program Files\desktop.ini SUCCESS 4843 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 4.0.lnk SUCCESS 4844 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Options: Open Access: All 4845 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS FileNameInformation 4846 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Options: Open Access: All 4847 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Length: 620 4848 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Attributes: A 4849 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Length: 620 4850 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Length: 620 4851 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Offset: 0 Length: 10 4852 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Offset: 0 Length: 4096 4853 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS 4854 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS Offset: 0 Length: 4096 4855 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\InterActual Player.lnk SUCCESS 4856 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Options: Open Access: All 4857 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS FileNameInformation 4858 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Options: Open Access: All 4859 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Length: 1609 4860 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Attributes: A 4861 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Length: 1609 4862 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Length: 1609 4863 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Offset: 0 Length: 10 4864 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Offset: 0 Length: 4096 4865 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 217600 Length: 4096 4866 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS 4867 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS Offset: 0 Length: 4096 4868 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\KODAK Picture CD.lnk SUCCESS 4869 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Options: Open Access: All 4870 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS FileNameInformation 4871 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Options: Open Access: All 4872 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Length: 640 4873 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Attributes: A 4874 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Length: 640 4875 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Length: 640 4876 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Offset: 0 Length: 10 4877 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Offset: 0 Length: 4096 4878 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS 4879 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS Offset: 0 Length: 4096 4880 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\PowerDVD.lnk SUCCESS 4881 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Options: Open Access: All 4882 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS FileNameInformation 4883 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Options: Open Access: All 4884 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Length: 621 4885 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Attributes: A 4886 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Length: 621 4887 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Length: 621 4888 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Offset: 0 Length: 10 4889 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Offset: 0 Length: 4096 4890 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 4891 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS 4892 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS Offset: 0 Length: 4096 4893 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk SUCCESS 4894 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Options: Open Access: All 4895 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS FileNameInformation 4896 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Options: Open Access: All 4897 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Length: 566 4898 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Attributes: A 4899 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Length: 566 4900 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Length: 566 4901 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Offset: 0 Length: 10 4902 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Offset: 0 Length: 4096 4903 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS 4904 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS Offset: 0 Length: 4096 4905 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\RealOne Player.lnk SUCCESS 4906 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Options: Open Access: All 4907 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS FileNameInformation 4908 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Options: Open Access: All 4909 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Length: 772 4910 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Attributes: A 4911 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Length: 772 4912 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Length: 772 4913 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Offset: 0 Length: 10 4914 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Offset: 0 Length: 4096 4915 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1445888 Length: 8192 4916 6:33:21 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\urlwarn.dir SUCCESS FileStandardInformation 4917 6:33:21 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\urlwarn.dir SUCCESS 4918 6:33:21 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\urlwarn.dir SUCCESS 4919 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035s.gif FILE NOT FOUND Options: Open Access: All 4920 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035s.gif FILE NOT FOUND Options: Open Access: All 4921 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035s.gif FILE NOT FOUND Options: Open Access: All 4922 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035r.gif FILE NOT FOUND Options: Open Access: All 4923 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035r.gif FILE NOT FOUND Options: Open Access: All 4924 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035r.gif FILE NOT FOUND Options: Open Access: All 4925 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035p.js FILE NOT FOUND Options: Open Access: All 4926 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035p.js FILE NOT FOUND Options: Open Access: All 4927 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\global.dat SUCCESS Options: Open Access: All 4928 6:33:21 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\global.dat SUCCESS Options: Open Access: All 4929 6:33:21 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\global.dat SUCCESS FileBasicInformation 4930 6:33:21 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\global.dat SUCCESS FileAllInformation 4931 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS 4932 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS Offset: 0 Length: 4096 4933 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\Sandra .lnk SUCCESS 4934 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Options: Open Access: All 4935 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS FileNameInformation 4936 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Options: Open Access: All 4937 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Length: 537 4938 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Attributes: A 4939 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Length: 537 4940 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Length: 537 4941 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Offset: 0 Length: 10 4942 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Offset: 0 Length: 4096 4943 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS 4944 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS Offset: 0 Length: 4096 4945 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\WinKey.lnk SUCCESS 4946 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Options: Open Access: All 4947 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS FileNameInformation 4948 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Options: Open Access: All 4949 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Length: 581 4950 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Attributes: A 4951 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Length: 581 4952 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Length: 581 4953 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Offset: 0 Length: 10 4954 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Offset: 0 Length: 4096 4955 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS 4956 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS Offset: 0 Length: 4096 4957 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2349.lnk SUCCESS 4958 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Options: Open Access: All 4959 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS FileNameInformation 4960 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Options: Open Access: All 4961 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Length: 581 4962 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Attributes: A 4963 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Length: 581 4964 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Length: 581 4965 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Offset: 0 Length: 10 4966 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Offset: 0 Length: 4096 4967 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS 4968 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS Offset: 0 Length: 4096 4969 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2506.lnk SUCCESS 4970 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Options: Open Access: All 4971 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS FileNameInformation 4972 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Options: Open Access: All 4973 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Length: 581 4974 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Attributes: A 4975 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Length: 581 4976 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Length: 581 4977 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Offset: 0 Length: 10 4978 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Offset: 0 Length: 4096 4979 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS 4980 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS Offset: 0 Length: 4096 4981 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2530.lnk SUCCESS 4982 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Options: Open Access: All 4983 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS FileNameInformation 4984 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Options: Open Access: All 4985 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Length: 581 4986 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Attributes: A 4987 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Length: 581 4988 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Length: 581 4989 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Offset: 0 Length: 10 4990 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Offset: 0 Length: 4096 4991 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS 4992 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS Offset: 0 Length: 4096 4993 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\2550.lnk SUCCESS 4994 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Options: Open Access: All 4995 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS FileNameInformation 4996 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Options: Open Access: All 4997 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Length: 581 4998 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Attributes: A 4999 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Length: 581 5000 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Length: 581 5001 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Offset: 0 Length: 10 5002 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Offset: 0 Length: 4096 5003 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS 5004 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS Offset: 0 Length: 4096 5005 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\256x.lnk SUCCESS 5006 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Options: Open Access: All 5007 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS Offset: 0 Length: 4096 5008 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7.X.lnk SUCCESS 5009 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Options: Open Access: All 5010 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS FileNameInformation 5011 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Options: Open Access: All 5012 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Length: 569 5013 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Attributes: A 5014 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Length: 569 5015 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Length: 569 5016 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Offset: 0 Length: 10 5017 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Offset: 0 Length: 4096 5018 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS 5019 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS Offset: 0 Length: 4096 5020 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-37.lnk SUCCESS 5021 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Options: Open Access: All 5022 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS FileNameInformation 5023 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Options: Open Access: All 5024 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Length: 569 5025 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Attributes: A 5026 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Length: 569 5027 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Length: 569 5028 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Offset: 0 Length: 10 5029 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Offset: 0 Length: 4096 5030 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS 5031 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS Offset: 0 Length: 4096 5032 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7--3x.lnk SUCCESS 5033 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Options: Open Access: All 5034 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS FileNameInformation 5035 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Options: Open Access: All 5036 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Length: 569 5037 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Attributes: A 5038 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Length: 569 5039 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Length: 569 5040 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Offset: 0 Length: 10 5041 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Offset: 0 Length: 4096 5042 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS 5043 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS Offset: 0 Length: 4096 5044 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-40.lnk SUCCESS 5045 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Options: Open Access: All 5046 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS FileNameInformation 5047 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Options: Open Access: All 5048 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Length: 569 5049 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Attributes: A 5050 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Length: 569 5051 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Length: 569 5052 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Offset: 0 Length: 10 5053 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Offset: 0 Length: 4096 5054 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS 5055 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS Offset: 0 Length: 4096 5056 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-B2.lnk SUCCESS 5057 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Options: Open Access: All 5058 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS FileNameInformation 5059 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Options: Open Access: All 5060 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Length: 575 5061 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Attributes: A 5062 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Length: 575 5063 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Length: 575 5064 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Offset: 0 Length: 10 5065 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Offset: 0 Length: 4096 5066 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS 5067 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS Offset: 0 Length: 4096 5068 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7B2.x.lnk SUCCESS 5069 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Options: Open Access: All 5070 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS FileNameInformation 5071 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Options: Open Access: All 5072 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Length: 555 5073 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Attributes: A 5074 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Length: 555 5075 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Length: 555 5076 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Offset: 0 Length: 10 5077 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Offset: 0 Length: 4096 5078 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS 5079 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS Offset: 0 Length: 4096 5080 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\7-f.lnk SUCCESS 5081 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Options: Open Access: All 5082 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS FileNameInformation 5083 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Options: Open Access: All 5084 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Length: 542 5085 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Attributes: A 5086 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Length: 542 5087 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Length: 542 5088 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Offset: 0 Length: 10 5089 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Offset: 0 Length: 4096 5090 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS 5091 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS Offset: 0 Length: 4096 5092 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Aspell (drop files here).lnk SUCCESS 5093 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Options: Open Access: All 5094 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS FileNameInformation 5095 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Options: Open Access: All 5096 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Length: 536 5097 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Attributes: A 5098 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Length: 536 5099 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Length: 536 5100 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Offset: 0 Length: 10 5101 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Offset: 0 Length: 4096 5102 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS 5103 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS Offset: 0 Length: 4096 5104 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\AVG 6.0.lnk SUCCESS 5105 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Options: Open Access: All 5106 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS FileNameInformation 5107 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Options: Open Access: All 5108 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Length: 778 5109 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Attributes: A 5110 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Length: 778 5111 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Length: 778 5112 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Offset: 0 Length: 10 5113 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Offset: 0 Length: 4096 5114 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 5115 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS 5116 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS Offset: 0 Length: 4096 5117 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Calendar.lnk SUCCESS 5118 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Options: Open Access: All 5119 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS FileNameInformation 5120 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Options: Open Access: All 5121 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Length: 617 5122 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Attributes: A 5123 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Length: 617 5124 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Length: 617 5125 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Offset: 0 Length: 10 5126 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Offset: 0 Length: 4096 5127 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS 5128 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS Offset: 0 Length: 4096 5129 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT SUCCESS Attributes: DA 5130 6:33:21 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 5131 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: WINNT 5132 6:33:21 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 5133 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Command Prompt.lnk SUCCESS 5134 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Options: Open Access: All 5135 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS FileNameInformation 5136 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Options: Open Access: All 5137 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Length: 581 5138 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Attributes: A 5139 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Length: 581 5140 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Length: 581 5141 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Offset: 0 Length: 10 5142 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Offset: 0 Length: 4096 5143 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS 5144 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS Offset: 0 Length: 4096 5145 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Copy of 2348.lnk SUCCESS 5146 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Options: Open Access: All 5147 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS FileNameInformation 5148 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Options: Open Access: All 5149 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Length: 489 5150 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Attributes: A 5151 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Length: 489 5152 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Length: 489 5153 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Offset: 0 Length: 10 5154 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Offset: 0 Length: 4096 5155 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS 5156 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS Offset: 0 Length: 4096 5157 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\DidaPro.lnk SUCCESS 5158 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Options: Open Access: All 5159 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS FileNameInformation 5160 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Options: Open Access: All 5161 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Length: 1694 5162 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Attributes: A 5163 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Length: 1694 5164 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Length: 1694 5165 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Offset: 0 Length: 10 5166 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Offset: 0 Length: 4096 5167 6:33:21 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 5168 6:33:21 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 5169 6:33:21 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 5170 6:33:21 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 5171 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS 5172 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS Offset: 0 Length: 4096 5173 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\DivX .lnk SUCCESS 5174 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Options: Open Access: All 5175 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS FileNameInformation 5176 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Options: Open Access: All 5177 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Length: 1767 5178 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Attributes: A 5179 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Length: 1767 5180 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Length: 1767 5181 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Offset: 0 Length: 10 5182 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Offset: 0 Length: 4096 5183 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 107008 Length: 4096 5184 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS 5185 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS Offset: 0 Length: 4096 5186 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\DSL.lnk SUCCESS 5187 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Options: Open Access: All 5188 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS FileNameInformation 5189 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Options: Open Access: All 5190 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Length: 678 5191 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Attributes: A 5192 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Length: 678 5193 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Length: 678 5194 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Offset: 0 Length: 10 5195 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Offset: 0 Length: 4096 5196 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS 5197 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS Offset: 0 Length: 4096 5198 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Eudora.lnk SUCCESS 5199 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Filemon.lnk SUCCESS Options: Open Access: All 5200 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Filemon.lnk SUCCESS Offset: 0 Length: 4096 5201 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Filemon.lnk SUCCESS 5202 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Options: Open Access: All 5203 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS FileNameInformation 5204 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Options: Open Access: All 5205 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Length: 517 5206 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Attributes: A 5207 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Length: 517 5208 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Length: 517 5209 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Offset: 0 Length: 10 5210 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Offset: 0 Length: 4096 5211 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS 5212 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS Offset: 0 Length: 4096 5213 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\IrfanView.lnk SUCCESS 5214 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Options: Open Access: All 5215 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS FileNameInformation 5216 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Options: Open Access: All 5217 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Length: 1479 5218 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Attributes: A 5219 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Length: 1479 5220 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Length: 1479 5221 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Offset: 0 Length: 10 5222 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Offset: 0 Length: 4096 5223 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5224 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS 5225 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS Offset: 0 Length: 4096 5226 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Java Web Start.lnk SUCCESS 5227 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Options: Open Access: All 5228 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS FileNameInformation 5229 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Options: Open Access: All 5230 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Length: 607 5231 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Attributes: A 5232 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Length: 607 5233 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Length: 607 5234 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Offset: 0 Length: 10 5235 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Offset: 0 Length: 4096 5236 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6062080 Length: 4096 5237 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS 5238 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS Offset: 0 Length: 4096 5239 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\LView.lnk SUCCESS 5240 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Options: Open Access: All 5241 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS FileNameInformation 5242 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Options: Open Access: All 5243 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Length: 2404 5244 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Attributes: A 5245 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Length: 2404 5246 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Length: 2404 5247 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Offset: 0 Length: 10 5248 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Offset: 0 Length: 4096 5249 6:33:21 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5250 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS 5251 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS Offset: 0 Length: 4096 5252 6:33:21 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 5253 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: WINNT 5254 6:33:21 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 5255 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\ SUCCESS Options: Open Directory Access: All 5256 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\WINNT\ SUCCESS FileBothDirectoryInformation: Installer 5257 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\ SUCCESS 5258 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\Installer SUCCESS Offset: 0 Length: 4096 5259 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Installer\desktop.ini FILE NOT FOUND Attributes: Error 5260 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\Installer\desktop.ini FILE NOT FOUND Attributes: Error 5261 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\Installer\ SUCCESS Options: Open Directory Access: All 5262 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\WINNT\Installer\ SUCCESS FileBothDirectoryInformation: {00000409-78E1-11D2-B60F-006097C998E7} 5263 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\Installer\ SUCCESS 5264 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\ SUCCESS Options: Open Directory Access: All 5265 6:33:21 PM Filemon.exe:1128 DIRECTORY C:\WINNT\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\ SUCCESS FileBothDirectoryInformation: wordicon.exe 5266 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\Installer\{00000409-78E1-11D2-B60F-006097C998E7} SUCCESS Offset: 0 Length: 4096 5267 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\ SUCCESS 5268 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Microsoft Word (2).lnk SUCCESS 5269 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Options: Open Access: All 5270 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS FileNameInformation 5271 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Options: Open Access: All 5272 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Length: 546 5273 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Attributes: A 5274 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Length: 546 5275 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Length: 546 5276 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Offset: 0 Length: 10 5277 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Offset: 0 Length: 4096 5278 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS 5279 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS Offset: 0 Length: 4096 5280 6:33:21 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Mindspring.lnk SUCCESS 5281 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\NETSHELL.dll SUCCESS Attributes: A 5282 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\system32\NETSHELL.dll SUCCESS Options: Open Access: Execute 5283 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\NETSHELL.dll SUCCESS Length: 468752 5284 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\system32\NETSHELL.dll SUCCESS 5285 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\system32\NETSHELL.dll SUCCESS Attributes: A 5286 6:33:21 PM Filemon.exe:1128 OPEN C:\WINNT\system32\NETSHELL.dll SUCCESS Options: Open Access: Execute 5287 6:33:21 PM Filemon.exe:1128 CLOSE C:\WINNT\system32\NETSHELL.dll SUCCESS 5288 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\netshell.dll SUCCESS Offset: 222208 Length: 19456 5289 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\netshell.dll SUCCESS Offset: 1024 Length: 4096 5290 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 221696 Length: 4096 5291 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\netshell.dll SUCCESS Offset: 242176 Length: 10240 5292 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5293 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\netshell.dll SUCCESS Offset: 9216 Length: 4096 5294 6:33:21 PM Filemon.exe:1128 READ C:\WINNT\system32\netshell.dll SUCCESS Offset: 241664 Length: 512 5295 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Options: Open Access: All 5296 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS FileNameInformation 5297 6:33:21 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Options: Open Access: All 5298 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Length: 647 5299 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Attributes: A 5300 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Length: 647 5301 6:33:21 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Length: 647 5302 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Offset: 0 Length: 10 5303 6:33:21 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Offset: 0 Length: 4096 5304 6:33:21 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10031104 Length: 4096 5305 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS 5306 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS Offset: 0 Length: 4096 5307 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\mplayer2..lnk SUCCESS 5308 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Options: Open Access: All 5309 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS FileNameInformation 5310 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Options: Open Access: All 5311 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Length: 586 5312 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Attributes: A 5313 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Length: 586 5314 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Length: 586 5315 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Offset: 0 Length: 10 5316 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Offset: 0 Length: 4096 5317 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS 5318 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS Offset: 0 Length: 4096 5319 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\My PowerDesk.lnk SUCCESS 5320 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Options: Open Access: All 5321 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS FileNameInformation 5322 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Options: Open Access: All 5323 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Length: 1659 5324 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Attributes: A 5325 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Length: 1659 5326 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Length: 1659 5327 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Offset: 0 Length: 10 5328 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Offset: 0 Length: 4096 5329 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5330 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS 5331 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS Offset: 0 Length: 4096 5332 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Netscape Navigator.lnk SUCCESS 5333 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Options: Open Access: All 5334 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS FileNameInformation 5335 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Options: Open Access: All 5336 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Length: 565 5337 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Attributes: A 5338 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Length: 565 5339 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Length: 565 5340 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Offset: 0 Length: 10 5341 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Offset: 0 Length: 4096 5342 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS 5343 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS Offset: 0 Length: 4096 5344 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\O6CPM.lnk SUCCESS 5345 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Options: Open Access: All 5346 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS FileNameInformation 5347 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Options: Open Access: All 5348 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Length: 612 5349 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Attributes: A 5350 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Length: 612 5351 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Length: 612 5352 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Offset: 0 Length: 10 5353 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Offset: 0 Length: 4096 5354 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS 5355 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS Offset: 0 Length: 4096 5356 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Opera 6.05.lnk SUCCESS 5357 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Options: Open Access: All 5358 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS FileNameInformation 5359 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Options: Open Access: All 5360 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Length: 1252 5361 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Attributes: A 5362 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Length: 1252 5363 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Length: 1252 5364 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Offset: 0 Length: 10 5365 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Offset: 0 Length: 4096 5366 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS 5367 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS Offset: 0 Length: 4096 5368 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Quicken .lnk SUCCESS 5369 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Options: Open Access: All 5370 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS FileNameInformation 5371 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Options: Open Access: All 5372 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Length: 543 5373 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Attributes: A 5374 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Length: 543 5375 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Length: 543 5376 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Offset: 0 Length: 10 5377 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Offset: 0 Length: 4096 5378 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS 5379 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS Offset: 0 Length: 4096 5380 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\QuickShow.lnk SUCCESS 5381 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Options: Open Access: All 5382 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS FileNameInformation 5383 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Options: Open Access: All 5384 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Length: 702 5385 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Attributes: A 5386 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Length: 702 5387 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Length: 702 5388 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Offset: 0 Length: 10 5389 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Offset: 0 Length: 4096 5390 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 225792 Length: 4096 5391 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS 5392 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS Offset: 0 Length: 4096 5393 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to FileSearch.exe.lnk SUCCESS 5394 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Options: Open Access: All 5395 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS FileNameInformation 5396 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Options: Open Access: All 5397 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Length: 557 5398 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Attributes: A 5399 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Length: 557 5400 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Length: 557 5401 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Offset: 0 Length: 10 5402 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Offset: 0 Length: 4096 5403 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS 5404 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS Offset: 0 Length: 4096 5405 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to metapad.exe.lnk SUCCESS 5406 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Options: Open Access: All 5407 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS FileNameInformation 5408 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Options: Open Access: All 5409 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Length: 602 5410 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Attributes: A 5411 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Length: 602 5412 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Length: 602 5413 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Offset: 0 Length: 10 5414 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Offset: 0 Length: 4096 5415 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5416 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS 5417 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS Offset: 0 Length: 4096 5418 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to procexp.exe.lnk SUCCESS 5419 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Options: Open Access: All 5420 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS FileNameInformation 5421 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Options: Open Access: All 5422 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Length: 567 5423 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Attributes: A 5424 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Length: 567 5425 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Length: 567 5426 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Offset: 0 Length: 10 5427 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Offset: 0 Length: 4096 5428 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS 5429 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS Offset: 0 Length: 4096 5430 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Shortcut to RegClean.exe.lnk SUCCESS 5431 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Options: Open Access: All 5432 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS FileNameInformation 5433 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Options: Open Access: All 5434 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Length: 863 5435 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Attributes: A 5436 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Length: 863 5437 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Length: 863 5438 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Offset: 0 Length: 10 5439 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Offset: 0 Length: 4096 5440 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9998336 Length: 8192 5441 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS 5442 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS Offset: 0 Length: 4096 5443 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\System Information.lnk SUCCESS 5444 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Options: Open Access: All 5445 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS FileNameInformation 5446 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Options: Open Access: All 5447 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Length: 1407 5448 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Attributes: A 5449 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Length: 1407 5450 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Length: 1407 5451 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Offset: 0 Length: 10 5452 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Offset: 0 Length: 4096 5453 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10010624 Length: 4096 5454 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS 5455 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS Offset: 0 Length: 4096 5456 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Tardis .lnk SUCCESS 5457 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Options: Open Access: All 5458 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS FileNameInformation 5459 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Options: Open Access: All 5460 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Length: 709 5461 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Attributes: A 5462 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Length: 709 5463 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Length: 709 5464 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Offset: 0 Length: 10 5465 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Offset: 0 Length: 4096 5466 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5467 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS 5468 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Offset: 0 Length: 4096 5469 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS 5470 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Options: Open Access: All 5471 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS FileNameInformation 5472 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Options: Open Access: All 5473 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Length: 474 5474 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Attributes: A 5475 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Length: 474 5476 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Length: 474 5477 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Offset: 0 Length: 10 5478 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Offset: 0 Length: 4096 5479 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS 5480 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS Offset: 0 Length: 4096 5481 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\wintertetris.lnk SUCCESS 5482 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Options: Open Access: All 5483 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS FileNameInformation 5484 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Options: Open Access: All 5485 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Length: 567 5486 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Attributes: A 5487 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Length: 567 5488 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Length: 567 5489 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Offset: 0 Length: 10 5490 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Offset: 0 Length: 4096 5491 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS 5492 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS Offset: 0 Length: 4096 5493 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\WS_FTP95 LE.lnk SUCCESS 5494 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Options: Open Access: All 5495 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS FileNameInformation 5496 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Options: Open Access: All 5497 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Length: 527 5498 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Attributes: A 5499 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Length: 527 5500 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Length: 527 5501 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Offset: 0 Length: 10 5502 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Offset: 0 Length: 4096 5503 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS 5504 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS Offset: 0 Length: 4096 5505 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\Xenu.lnk SUCCESS 5506 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Options: Open Access: All 5507 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS FileNameInformation 5508 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Options: Open Access: All 5509 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Length: 404 5510 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Attributes: A 5511 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Length: 404 5512 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Length: 404 5513 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Offset: 0 Length: 10 5514 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Offset: 0 Length: 4096 5515 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS 5516 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS Offset: 0 Length: 4096 5517 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\X-News.lnk SUCCESS 5518 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\ SUCCESS 5519 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\All Users\Desktop\ SUCCESS 5520 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop SUCCESS Options: Open Directory Access: Traverse 5521 6:33:22 PM Filemon.exe:1128 CLOSE C:\utilities\filemon SUCCESS 5522 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\utilities\filemon\SHDOCVW.dll FILE NOT FOUND Attributes: Error 5523 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Desktop\SHDOCVW.dll FILE NOT FOUND Attributes: Error 5524 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\WINNT\System32\SHDOCVW.dll SUCCESS Attributes: A 5525 6:33:22 PM Filemon.exe:1128 OPEN C:\WINNT\System32\SHDOCVW.dll SUCCESS Options: Open Access: Execute 5526 6:33:22 PM Filemon.exe:1128 CLOSE C:\WINNT\System32\SHDOCVW.dll SUCCESS 5527 6:33:22 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 5528 6:33:22 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 5529 6:33:22 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 5530 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 5531 6:33:22 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 5532 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\ SUCCESS 5533 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 5534 6:33:22 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: Desktop 5535 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 5536 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Favorites SUCCESS Attributes: DR 5537 6:33:22 PM Filemon.exe:1128 OPEN C:\ SUCCESS Options: Open Directory Access: All 5538 6:33:22 PM Filemon.exe:1128 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: Documents and Settings 5539 6:33:22 PM Filemon.exe:1128 CLOSE C:\ SUCCESS 5540 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\ SUCCESS Options: Open Directory Access: All 5541 6:33:22 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\ SUCCESS FileBothDirectoryInformation: Leonard Grossman 5542 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\ SUCCESS 5543 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\ SUCCESS Options: Open Directory Access: All 5544 6:33:22 PM Filemon.exe:1128 DIRECTORY C:\Documents and Settings\Leonard Grossman\ SUCCESS FileBothDirectoryInformation: Favorites 5545 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\ SUCCESS 5546 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Favorites\desktop.ini SUCCESS Attributes: HS 5547 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Favorites\desktop.ini SUCCESS Options: Open Access: All 5548 6:33:22 PM Filemon.exe:1128 LOCK C:\Documents and Settings\Leonard Grossman\Favorites\desktop.ini SUCCESS Excl: No Offset: 0 Length: -1 5549 6:33:22 PM Filemon.exe:1128 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Favorites\desktop.ini SUCCESS Length: 83 5550 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Favorites\desktop.ini SUCCESS Offset: 0 Length: 83 5551 6:33:22 PM Filemon.exe:1128 UNLOCK C:\Documents and Settings\Leonard Grossman\Favorites\desktop.ini RANGE NOT LOCKED Offset: 0 Length: -1 5552 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Favorites\desktop.ini SUCCESS 5553 6:33:22 PM Filemon.exe:1128 OPEN C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Options: Open Access: All 5554 6:33:22 PM Filemon.exe:1128 READ C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS Offset: 0 Length: 4096 5555 6:33:22 PM Filemon.exe:1128 CLOSE C:\Documents and Settings\Leonard Grossman\Desktop\WatsnLog.lnk SUCCESS 5556 6:33:22 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 5557 6:33:22 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 5558 6:33:22 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 5559 6:33:22 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 5560 6:33:22 PM OUTLOOK.EXE:1140 QUERY INFORMATION C:\Program Files\Common Files\System\Mapi\1033\NT\WWW_Activate FILE NOT FOUND Attributes: Error 5561 6:33:22 PM OUTLOOK.EXE:1140 QUERY INFORMATION C:\Program Files\Common Files\System\Mapi\1033\NT\WWW_Activate FILE NOT FOUND Attributes: Error 5562 6:33:22 PM explorer.exe:924 QUERY INFORMATION C:\WWW_Activate FILE NOT FOUND Attributes: Error 5563 6:33:22 PM explorer.exe:924 QUERY INFORMATION C:\WWW_Activate FILE NOT FOUND Attributes: Error 5564 6:33:22 PM opera.exe:1304 CLOSE C:\Program Files\Opera7,X SUCCESS 5565 6:33:22 PM opera.exe:928 CLOSE C:\Program Files\Opera7,X SUCCESS 5566 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10166272 Length: 8192 5567 6:33:22 PM cidaemon.exe:960 QUERY SECURITY C:\program files\opera7,x\global.dat SUCCESS 5568 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10182656 Length: 8192 5569 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10194944 Length: 12288 5570 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10211328 Length: 12288 5571 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5572 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 229888 Length: 4096 5573 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5574 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10108928 Length: 4096 5575 6:33:22 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\global.dat SUCCESS FileStandardInformation 5576 6:33:22 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\global.dat SUCCESS 5577 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 4096 5578 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10125312 Length: 4096 5579 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 4096 5580 6:33:22 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\global.dat SUCCESS 5581 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035m.gif FILE NOT FOUND Options: Open Access: All 5582 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 5583 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035m.gif FILE NOT FOUND Options: Open Access: All 5584 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035m.gif FILE NOT FOUND Options: Open Access: All 5585 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5586 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035o.gif FILE NOT FOUND Options: Open Access: All 5587 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035o.gif FILE NOT FOUND Options: Open Access: All 5588 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035o.gif FILE NOT FOUND Options: Open Access: All 5589 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035l.gif FILE NOT FOUND Options: Open Access: All 5590 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035l.gif FILE NOT FOUND Options: Open Access: All 5591 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035l.gif FILE NOT FOUND Options: Open Access: All 5592 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035k.gif FILE NOT FOUND Options: Open Access: All 5593 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035k.gif FILE NOT FOUND Options: Open Access: All 5594 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035k.gif FILE NOT FOUND Options: Open Access: All 5595 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035j.gif FILE NOT FOUND Options: Open Access: All 5596 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035j.gif FILE NOT FOUND Options: Open Access: All 5597 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035j.gif FILE NOT FOUND Options: Open Access: All 5598 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\jswarn.dir SUCCESS Options: Open Access: All 5599 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\jswarn.dir SUCCESS Options: Open Access: All 5600 6:33:22 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\jswarn.dir SUCCESS FileBasicInformation 5601 6:33:22 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\jswarn.dir SUCCESS FileAllInformation 5602 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 1323008 Length: 4096 5603 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5604 6:33:22 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 5605 6:33:22 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 5606 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 233984 Length: 4096 5607 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5608 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 111104 Length: 4096 5609 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5610 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5124096 Length: 4096 5611 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5612 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 238080 Length: 4096 5613 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5614 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10158080 Length: 4096 5615 6:33:22 PM cidaemon.exe:960 QUERY SECURITY C:\program files\opera7,x\jswarn.dir SUCCESS 5616 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10219520 Length: 4096 5617 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5618 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10022912 Length: 4096 5619 6:33:22 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\opera7,x\jswarn.dir SUCCESS FileStandardInformation 5620 6:33:22 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\jswarn.dir SUCCESS 5621 6:33:22 PM cidaemon.exe:960 CLOSE C:\program files\opera7,x\jswarn.dir SUCCESS 5622 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035q.htm FILE NOT FOUND Options: Open Access: All 5623 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\opera7,x\cache4\opr0035q.htm FILE NOT FOUND Options: Open Access: All 5624 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS Options: Open Access: All 5625 6:33:22 PM cidaemon.exe:960 OPEN C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS Options: Open Access: All 5626 6:33:22 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS FileBasicInformation 5627 6:33:22 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS FileAllInformation 5628 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5629 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 8192 5630 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 4096 5631 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10141696 Length: 4096 5632 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5633 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10227712 Length: 4096 5634 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5635 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10027008 Length: 8192 5636 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 8192 5637 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10076160 Length: 4096 5638 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5639 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 242176 Length: 4096 5640 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5641 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 5642 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5643 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6029312 Length: 4096 5644 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5645 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10182656 Length: 4096 5646 6:33:22 PM cidaemon.exe:960 QUERY SECURITY C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS 5647 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10211328 Length: 4096 5648 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5649 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 246272 Length: 4096 5650 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5651 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10129408 Length: 4096 5652 6:33:22 PM cidaemon.exe:960 QUERY INFORMATION C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS FileStandardInformation 5653 6:33:22 PM cidaemon.exe:960 CLOSE C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS 5654 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5655 6:33:22 PM cidaemon.exe:960 CLOSE C:\program files\qualcomm\eudora\linkhistory.dat SUCCESS 5656 6:33:22 PM cisvc.exe:600 OPEN C:\ SUCCESS Options: Open Directory Access: All 5657 6:33:22 PM cisvc.exe:600 QUERY INFORMATION C:\ SUCCESS FileFsSizeInformation 5658 6:33:22 PM cisvc.exe:600 CLOSE C:\ SUCCESS 5659 6:33:22 PM cisvc.exe:600 OPEN C:\ SUCCESS Options: Open Directory Access: All 5660 6:33:22 PM cisvc.exe:600 QUERY INFORMATION C:\ SUCCESS FileFsSizeInformation 5661 6:33:22 PM cisvc.exe:600 CLOSE C:\ SUCCESS 5662 6:33:22 PM cisvc.exe:600 OPEN C:\ SUCCESS Options: Open Directory Access: All 5663 6:33:22 PM cisvc.exe:600 QUERY INFORMATION C:\ SUCCESS FileFsSizeInformation 5664 6:33:22 PM cisvc.exe:600 CLOSE C:\ SUCCESS 5665 6:33:22 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 5666 6:33:22 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 5667 6:33:22 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 5668 6:33:22 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 5669 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10076160 Length: 4096 5670 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5671 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6033408 Length: 4096 5672 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5673 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9998336 Length: 4096 5674 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10006528 Length: 4096 5675 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 5676 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5677 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 250368 Length: 4096 5678 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5679 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 5680 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5681 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 4096 5682 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5683 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5185536 Length: 4096 5684 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5685 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 254464 Length: 4096 5686 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5687 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10022912 Length: 4096 5688 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5689 6:33:22 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1413120 Length: 4096 5690 6:33:22 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 5691 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Options: OpenIf Sequential Access: All 5692 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS FileStandardInformation 5693 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Length: 262144 5694 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 5695 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 5696 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.001 SUCCESS Offset: 245760 Length: 8192 5697 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 5698 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 5699 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 5700 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Options: OpenIf Sequential Access: All 5701 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS FileStandardInformation 5702 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Length: 262144 5703 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 5704 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.002 SUCCESS Offset: 245760 Length: 8192 5705 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 5706 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 5707 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 5708 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 5709 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10137600 Length: 4096 5710 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5711 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1179648 Length: 4096 5712 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 5713 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2510848 Length: 4096 5714 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2539520 Length: 16384 5715 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 5716 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1449984 Length: 4096 5717 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 5718 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2555904 Length: 53248 5719 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 5720 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 5721 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 5722 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 5723 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 5724 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 5725 6:33:23 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 5726 6:33:23 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 5727 6:33:23 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 5728 6:33:23 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 5729 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 5730 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 5731 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 5732 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 5733 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 5734 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 5735 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 5736 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.002 SUCCESS Offset: 0 Length: 4096 5737 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 5738 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 5739 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 5740 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 5741 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10035200 Length: 4096 5742 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10051584 Length: 4096 5743 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10080256 Length: 4096 5744 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5745 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10166272 Length: 4096 5746 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10174464 Length: 4096 5747 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10199040 Length: 4096 5748 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10211328 Length: 4096 5749 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5750 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 1323008 Length: 4096 5751 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5752 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10022912 Length: 4096 5753 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5754 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 5755 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 5756 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 5757 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 5758 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 5759 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 5760 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 5761 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 5762 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 5763 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 5764 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 5765 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 5766 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.002 SUCCESS Offset: 0 Length: 4096 5767 6:33:23 PM cisvc.exe:600 READ C:\$Extend\$UsnJrnl:$J SUCCESS Offset: 14278656 Length: 4096 5768 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 5769 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 5770 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 5771 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 5772 6:33:23 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 5773 6:33:23 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 5774 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5775 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 512 Length: 512 5776 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1024 Length: 512 5777 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1536 Length: 512 5778 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2048 Length: 512 5779 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2560 Length: 512 5780 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3072 Length: 512 5781 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3584 Length: 512 5782 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4096 Length: 512 5783 6:33:23 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 5784 6:33:23 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 5785 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5786 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 512 Length: 512 5787 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1024 Length: 512 5788 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1536 Length: 512 5789 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2048 Length: 512 5790 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2560 Length: 512 5791 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3072 Length: 512 5792 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3584 Length: 512 5793 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4096 Length: 512 5794 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4608 Length: 4096 5795 6:33:23 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5796 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5797 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 5798 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 5799 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 5800 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 5801 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 5802 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 5803 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 5804 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 5805 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 5806 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 5807 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 5808 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 5809 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.001 SUCCESS Offset: 0 Length: 4096 5810 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 5811 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 5812 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 5813 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 5814 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 8704 Length: 4096 5815 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5816 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4608 Length: 4096 5817 6:33:23 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5818 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5819 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 5820 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 5821 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 5822 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 5823 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 5824 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 5825 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 5826 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 5827 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 5828 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 5829 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 5830 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 5831 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.001 SUCCESS Offset: 0 Length: 4096 5832 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 5833 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 5834 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 5835 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 5836 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 8704 Length: 4096 5837 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5838 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Options: OpenIf Sequential Access: All 5839 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS FileStandardInformation 5840 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Length: 65536 5841 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 5842 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 5843 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 12800 Length: 4096 5844 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5845 6:33:23 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 5846 6:33:23 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 5847 6:33:23 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 5848 6:33:23 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 5849 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 5850 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 12800 Length: 4096 5851 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5852 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 16896 Length: 4096 5853 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.002 SUCCESS Offset: 0 Length: 4096 5854 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5855 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 16896 Length: 4096 5856 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 5857 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5858 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 20992 Length: 4096 5859 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5860 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 5861 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 5862 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 25088 Length: 4096 5863 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5864 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 29184 Length: 4096 5865 6:33:23 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Options: OpenIf Sequential Access: All 5866 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS FileStandardInformation 5867 6:33:23 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Length: 65536 5868 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 5869 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.001 SUCCESS Offset: 0 Length: 4096 5870 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5871 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33280 Length: 4096 5872 6:33:23 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 5873 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5874 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 20992 Length: 4096 5875 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5876 6:33:23 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 5877 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 5878 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 5879 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 37376 Length: 4096 5880 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5881 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 25088 Length: 4096 5882 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5883 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 4096 5884 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5885 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 29184 Length: 4096 5886 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5887 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 33280 Length: 4096 5888 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5889 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10170368 Length: 4096 5890 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10178560 Length: 4096 5891 6:33:23 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10203136 Length: 4096 5892 6:33:23 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5893 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 4096 5894 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5895 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 37376 Length: 4096 5896 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5897 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 41472 Length: 4096 5898 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5899 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 4096 5900 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5901 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 49664 Length: 4096 5902 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5903 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 45568 Length: 4096 5904 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5905 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6033408 Length: 4096 5906 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5907 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 53760 Length: 4096 5908 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5909 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 57856 Length: 4096 5910 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5911 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 49664 Length: 4096 5912 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5913 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9998336 Length: 8192 5914 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 8192 5915 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5916 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 61952 Length: 4096 5917 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5918 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5185536 Length: 4096 5919 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5920 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 66048 Length: 4096 5921 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5922 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 53760 Length: 4096 5923 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5924 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 57856 Length: 4096 5925 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5926 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10158080 Length: 4096 5927 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10203136 Length: 4096 5928 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5929 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 70144 Length: 4096 5930 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5931 6:33:24 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 5932 6:33:24 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 5933 6:33:24 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 5934 6:33:24 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 5935 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 74240 Length: 4096 5936 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5937 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 4096 5938 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5939 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 82432 Length: 4096 5940 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5941 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 86528 Length: 4096 5942 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5943 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 61952 Length: 4096 5944 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5945 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 90624 Length: 4096 5946 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5947 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 66048 Length: 4096 5948 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5949 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 94720 Length: 4096 5950 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5951 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 4096 5952 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5953 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 98816 Length: 4096 5954 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5955 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10039296 Length: 4096 5956 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10047488 Length: 4096 5957 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10055680 Length: 8192 5958 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10080256 Length: 4096 5959 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10088448 Length: 4096 5960 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5961 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 4096 5962 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5963 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 5964 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5965 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 70144 Length: 4096 5966 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5967 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107008 Length: 4096 5968 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5969 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 111104 Length: 4096 5970 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5971 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 115200 Length: 4096 5972 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5973 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 119296 Length: 4096 5974 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5975 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 74240 Length: 4096 5976 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 5977 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 4096 5978 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5979 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 127488 Length: 4096 5980 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5981 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 131584 Length: 4096 5982 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5983 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 135680 Length: 4096 5984 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5985 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10002432 Length: 4096 5986 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10010624 Length: 4096 5987 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 5988 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5989 6:33:24 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 5990 6:33:24 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 5991 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 139776 Length: 4096 5992 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 5993 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10043392 Length: 4096 5994 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10051584 Length: 4096 5995 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10059776 Length: 4096 5996 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 5997 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10096640 Length: 4096 5998 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 4096 5999 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10113024 Length: 12288 6000 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 8192 6001 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 6002 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6003 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 143872 Length: 4096 6004 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6005 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 78336 Length: 4096 6006 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6007 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 147968 Length: 4096 6008 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6009 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 152064 Length: 4096 6010 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6011 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 156160 Length: 4096 6012 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6013 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 82432 Length: 4096 6014 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6015 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9998336 Length: 4096 6016 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 6017 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6018 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 160256 Length: 4096 6019 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6020 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 164352 Length: 4096 6021 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6022 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 168448 Length: 4096 6023 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6024 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 172544 Length: 4096 6025 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6026 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 176640 Length: 4096 6027 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6028 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 180736 Length: 4096 6029 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6030 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 184832 Length: 4096 6031 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6032 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 188928 Length: 4096 6033 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6034 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 193024 Length: 4096 6035 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6036 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 197120 Length: 4096 6037 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6038 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 201216 Length: 4096 6039 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6040 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 205312 Length: 4096 6041 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6042 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10092544 Length: 8192 6043 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 4096 6044 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10125312 Length: 8192 6045 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6046 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6029312 Length: 8192 6047 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6045696 Length: 8192 6048 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6049 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 209408 Length: 4096 6050 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6051 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 213504 Length: 4096 6052 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6053 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10027008 Length: 8192 6054 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10047488 Length: 4096 6055 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10055680 Length: 4096 6056 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10072064 Length: 8192 6057 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6058 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 6059 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6060 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 217600 Length: 4096 6061 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6062 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9912320 Length: 4096 6063 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6064 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10002432 Length: 4096 6065 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10018816 Length: 4096 6066 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6067 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10162176 Length: 61440 6068 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6069 6:33:24 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 6070 6:33:24 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 6071 6:33:24 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 6072 6:33:24 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 6073 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10035200 Length: 4096 6074 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10051584 Length: 4096 6075 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6076 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 6077 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6078 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 221696 Length: 4096 6079 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6080 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 4096 6081 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 4096 6082 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6083 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10186752 Length: 4096 6084 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6033408 Length: 4096 6085 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6041600 Length: 8192 6086 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6087 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10022912 Length: 4096 6088 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6089 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 225792 Length: 4096 6090 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6091 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 229888 Length: 4096 6092 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6093 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 5185536 Length: 4096 6094 6:33:24 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6095 6:33:24 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10113024 Length: 4096 6096 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 86528 Length: 4096 6097 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6098 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10010624 Length: 4096 6099 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6100 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 233984 Length: 4096 6101 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6102 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 716800 Length: 4096 6103 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 6104 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10158080 Length: 8192 6105 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10170368 Length: 24576 6106 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10203136 Length: 16384 6107 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6108 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 238080 Length: 4096 6109 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6110 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 90624 Length: 4096 6111 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6112 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10104832 Length: 12288 6113 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10121216 Length: 8192 6114 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10133504 Length: 4096 6115 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6116 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 242176 Length: 4096 6117 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6118 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10006528 Length: 4096 6119 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6120 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 246272 Length: 4096 6121 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6122 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6037504 Length: 12288 6123 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6124 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Options: OpenIf Sequential Access: All 6125 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS FileStandardInformation 6126 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS Length: 262144 6127 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 6128 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 6129 6:33:25 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 6130 6:33:25 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 6131 6:33:25 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 6132 6:33:25 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 6133 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.002 SUCCESS Offset: 249856 Length: 8192 6134 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 6135 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 6136 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 6137 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Options: OpenIf Sequential Access: All 6138 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS FileStandardInformation 6139 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS Length: 262144 6140 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.002 SUCCESS 6141 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.001 SUCCESS Offset: 249856 Length: 8192 6142 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 6143 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiCL0001.001 SUCCESS 6144 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS Offset: 0 Length: 240 6145 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiCL0001.000 SUCCESS 6146 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10162176 Length: 4096 6147 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10203136 Length: 4096 6148 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10215424 Length: 4096 6149 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6150 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 250368 Length: 4096 6151 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6152 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1196032 Length: 4096 6153 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 6154 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2539520 Length: 16384 6155 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 6156 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 1445888 Length: 12288 6157 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 6158 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS Offset: 2555904 Length: 53248 6159 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps1 SUCCESS 6160 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 6161 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 6162 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 6163 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 6164 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 6165 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 6166 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 6167 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 6168 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 6169 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 6170 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 6171 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 6172 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.002 SUCCESS Offset: 0 Length: 4096 6173 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 6174 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 6175 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 6176 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 6177 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10027008 Length: 8192 6178 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10039296 Length: 16384 6179 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 12288 6180 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10080256 Length: 12288 6181 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6182 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10100736 Length: 4096 6183 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10108928 Length: 4096 6184 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10145792 Length: 4096 6185 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6186 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9056256 Length: 4096 6187 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6188 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10022912 Length: 4096 6189 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6190 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 6191 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 6192 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 6193 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 6194 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 6195 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 6196 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 6197 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 6198 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 6199 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 6200 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 6201 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 6202 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.002 SUCCESS Offset: 0 Length: 4096 6203 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 6204 6:33:25 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 6205 6:33:25 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 6206 6:33:25 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 6207 6:33:25 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 6208 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 6209 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 6210 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 6211 6:33:25 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 6212 6:33:25 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Length: 4198912 6213 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6214 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 512 Length: 512 6215 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1024 Length: 512 6216 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 1536 Length: 512 6217 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2048 Length: 512 6218 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 2560 Length: 512 6219 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3072 Length: 512 6220 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 3584 Length: 512 6221 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4096 Length: 512 6222 6:33:25 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 6223 6:33:25 PM cisvc.exe:600 SET INFORMATION C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Length: 4198912 6224 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6225 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 512 Length: 512 6226 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1024 Length: 512 6227 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 1536 Length: 512 6228 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2048 Length: 512 6229 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 2560 Length: 512 6230 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3072 Length: 512 6231 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 3584 Length: 512 6232 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4096 Length: 512 6233 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 4608 Length: 4096 6234 6:33:25 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6235 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6236 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Options: OpenIf Sequential Access: All 6237 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS FileStandardInformation 6238 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.002 SUCCESS Length: 65536 6239 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 6240 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 6241 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 6242 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 6243 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 6244 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Options: OpenIf Sequential Access: All 6245 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS FileStandardInformation 6246 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP20000.001 SUCCESS Length: 65536 6247 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.002 SUCCESS 6248 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.001 SUCCESS Offset: 0 Length: 4096 6249 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 6250 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP20000.001 SUCCESS 6251 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS Offset: 0 Length: 240 6252 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP20000.000 SUCCESS 6253 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 8704 Length: 4096 6254 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6255 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 4608 Length: 4096 6256 6:33:25 PM cisvc.exe:600 READ C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6257 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6258 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Options: OpenIf Sequential Access: All 6259 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS FileStandardInformation 6260 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.002 SUCCESS Length: 65536 6261 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 6262 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 6263 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 6264 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 6265 6:33:25 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 6266 6:33:25 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Options: OpenIf Sequential Access: All 6267 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS FileStandardInformation 6268 6:33:25 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiP10000.001 SUCCESS Length: 65536 6269 6:33:25 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.002 SUCCESS 6270 6:33:25 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.001 SUCCESS Offset: 0 Length: 4096 6271 6:33:25 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 6272 6:33:26 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiP10000.001 SUCCESS 6273 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS Offset: 0 Length: 240 6274 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiP10000.000 SUCCESS 6275 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 8704 Length: 4096 6276 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6277 6:33:26 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Options: OpenIf Sequential Access: All 6278 6:33:26 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS FileStandardInformation 6279 6:33:26 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS Length: 65536 6280 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 6281 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 6282 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 12800 Length: 4096 6283 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6284 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 12800 Length: 4096 6285 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6286 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 16896 Length: 4096 6287 6:33:26 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 6288 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6289 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 16896 Length: 4096 6290 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6291 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.001 SUCCESS Offset: 0 Length: 4096 6292 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 20992 Length: 4096 6293 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6294 6:33:26 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 6295 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 20992 Length: 4096 6296 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6297 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 9056256 Length: 4096 6298 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 6299 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 6300 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6301 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 25088 Length: 4096 6302 6:33:26 PM cisvc.exe:600 OPEN C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Options: OpenIf Sequential Access: All 6303 6:33:26 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS FileStandardInformation 6304 6:33:26 PM cisvc.exe:600 QUERY INFORMATION C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS Length: 65536 6305 6:33:26 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.001 SUCCESS 6306 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.002 SUCCESS Offset: 0 Length: 4096 6307 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6308 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 25088 Length: 4096 6309 6:33:26 PM cisvc.exe:600 FLUSH C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 6310 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6311 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 29184 Length: 4096 6312 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6313 6:33:26 PM cisvc.exe:600 CLOSE C:\system volume information\catalog.wci\CiSP0000.002 SUCCESS 6314 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS Offset: 0 Length: 240 6315 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\CiSP0000.000 SUCCESS 6316 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 29184 Length: 4096 6317 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6318 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 33280 Length: 4096 6319 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6320 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 33280 Length: 4096 6321 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6322 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 37376 Length: 4096 6323 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6324 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 37376 Length: 4096 6325 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6326 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 41472 Length: 4096 6327 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6328 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 41472 Length: 4096 6329 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6330 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 45568 Length: 4096 6331 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6332 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 45568 Length: 4096 6333 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6334 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 49664 Length: 4096 6335 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6336 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 49664 Length: 4096 6337 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6338 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 53760 Length: 4096 6339 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6340 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 57856 Length: 4096 6341 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6342 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 61952 Length: 4096 6343 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6344 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 66048 Length: 4096 6345 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6346 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 53760 Length: 4096 6347 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6348 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 70144 Length: 4096 6349 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6350 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 4096 6351 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10141696 Length: 4096 6352 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6353 6:33:26 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Attributes: A 6354 6:33:26 PM explorer.exe:924 OPEN C:\WINNT\System32\taskmgr.exe SUCCESS Options: Open Access: Execute 6355 6:33:26 PM explorer.exe:924 QUERY INFORMATION C:\WINNT\System32\taskmgr.exe SUCCESS Length: 87824 6356 6:33:26 PM explorer.exe:924 CLOSE C:\WINNT\System32\taskmgr.exe SUCCESS 6357 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 74240 Length: 4096 6358 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6359 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 78336 Length: 4096 6360 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6361 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 82432 Length: 4096 6362 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6363 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 57856 Length: 4096 6364 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6365 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10014720 Length: 4096 6366 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10022912 Length: 4096 6367 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6368 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 86528 Length: 4096 6369 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6370 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 61952 Length: 4096 6371 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6372 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 90624 Length: 4096 6373 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6374 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 94720 Length: 4096 6375 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6376 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 98816 Length: 4096 6377 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6378 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 102912 Length: 4096 6379 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6380 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 66048 Length: 4096 6381 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6382 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6037504 Length: 4096 6383 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 6045696 Length: 4096 6384 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6385 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 70144 Length: 4096 6386 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk1 SUCCESS Offset: 0 Length: 512 6387 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 107008 Length: 4096 6388 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6389 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10027008 Length: 4096 6390 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10035200 Length: 8192 6391 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10047488 Length: 8192 6392 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10063872 Length: 8192 6393 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10076160 Length: 8192 6394 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6395 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 111104 Length: 4096 6396 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6397 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 115200 Length: 4096 6398 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6399 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10014720 Length: 4096 6400 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6401 6:33:26 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 6402 6:33:26 PM Eudora.exe:1420 QUERY INFORMATION C:\Documents and Settings\Leonard Grossman\Local Settings\Temporary Internet Files\Content.IE5\index.dat SUCCESS Length: 1130496 6403 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 119296 Length: 4096 6404 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6405 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10223616 Length: 4096 6406 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6407 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 123392 Length: 4096 6408 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6409 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10170368 Length: 4096 6410 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10178560 Length: 12288 6411 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10194944 Length: 4096 6412 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10203136 Length: 16384 6413 6:33:26 PM cisvc.exe:600 FLUSH C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS 6414 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10047488 Length: 4096 6415 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 127488 Length: 4096 6416 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\propstor.bk2 SUCCESS Offset: 0 Length: 512 6417 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 SUCCESS Offset: 10117120 Length: 4096 6418 6:33:26 PM cisvc.exe:600 WRITE C:\System Volume Information\catalog.wci\00000002.ps2 Offset: 10133504 Length: 4096